DEV-0322 Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (87)

Langue

en	60
zh	16
es	4
de	2
fr	2

De campagne

cn	44
us	42

Acteurs

DEV-0322	8
Cobalt Strike	4

Intérêt

Taper

Not Defined	40
Operating System	6
Smartphone Operating System	4
Router Operating System	4
JavaScript Library	4

Fournisseur

Not Defined	34
Adobe	6
Microsoft	6
D-Link	4
MailEnable	2

Produit

Adobe Magento Commerce	6
Next.js	4
Microsoft Windows	4
MailEnable Enterprise Premium	2
Google Android	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	0.64	CVE-2007-0354
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
3	VMware Horizon Client/Horizon Message Framework Library divulgation de l'information	6.4	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00379	0.03	CVE-2018-6970
4	D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi elévation de privilèges	7.3	6.7	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00471	0.77	CVE-2024-3273
5	Sustainsys.Saml2 vulnérabilité inconnue	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00054	0.05	CVE-2023-41890
6	WeiYe-Jing datax-web HTTP POST Request killJob elévation de privilèges	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00256	0.05	CVE-2023-7116
7	cskefu elévation de privilèges	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00084	0.02	CVE-2022-36521
8	Apple macOS AppleMobileFileIntegrity divulgation de l'information	3.3	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00060	0.00	CVE-2023-23499
9	Tesla Model 3 Mobile App Phone Key Authentication authentification faible	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00047	0.07	CVE-2022-37709
10	SSH SSH-1 Protocol chiffrement faible	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00258	0.03	CVE-2001-1473
11	Laravel PendingBroadcast.php __destruct elévation de privilèges	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.00	CVE-2022-31279
12	EmdedThis GoAhead elévation de privilèges	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03418	0.00	CVE-2021-42342
13	Next.js URL dénie de service	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00374	0.03	CVE-2021-43803
14	Next.js _error.js Redirect	5.0	4.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00062	0.00	CVE-2021-37699
15	Swagger UI CSS elévation de privilèges	7.0	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01741	0.05	CVE-2019-17495
16	OpenSSL c_rehash elévation de privilèges	5.5	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.09738	0.02	CVE-2022-1292
17	Hikvision Product Message elévation de privilèges	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.97493	0.02	CVE-2021-36260
18	HD-Network Real-time Monitoring System Parameter lang directory traversal	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05404	0.02	CVE-2021-45043
19	CodeIgniter HTTP Request elévation de privilèges	8.3	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00195	0.02	CVE-2022-24711
20	jwt-go Access Restriction elévation de privilèges	7.4	7.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00193	0.01	CVE-2020-26160

Campagnes (2)

These are the campaigns that can be associated with the actor:

CVE-2021-35211
Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx

IOC - Indicator of Compromise (14)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Campagnes	Identified	Taper	Confiance
1	24.64.36.238	mail.target-realty.com	DEV-0322	ManageEngine ADSelfService Plus	11/11/2021	verified	Élevé
2	45.63.62.109	45.63.62.109.vultr.com	DEV-0322	ManageEngine ADSelfService Plus	11/11/2021	verified	Moyen
3	45.76.173.103	45.76.173.103.vultr.com	DEV-0322	ManageEngine ADSelfService Plus	11/11/2021	verified	Moyen
4	XX.XX.XXX.XXX	xx.xx.xxx.xxx.xxxxx.xxx	Xxx-xxxx	Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx	11/11/2021	verified	Moyen
5	XX.XX.XX.XXX	xx.xx.xx.xxx.xxxxx.xxx	Xxx-xxxx	Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx	11/11/2021	verified	Moyen
6	XX.XXX.XXX.XX	xxxxxxx-xxx-xxx-xx-xxx-xxx-xx.xxxxxx.xx	Xxx-xxxx	Xxx-xxxx-xxxxx	14/07/2021	verified	Élevé
7	XX.XX.XX.XX	xxxx-xx-xx-xx-xx.xx.xxx.xx.xxx	Xxx-xxxx	Xxx-xxxx-xxxxx	14/07/2021	verified	Élevé
8	XX.XXX.XXX.XX	xxxx-xxx-xxx-xx.xx.xx.xxx.xxx	Xxx-xxxx	Xxx-xxxx-xxxxx	14/07/2021	verified	Élevé
9	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxx.xxx	Xxx-xxxx	Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx	11/11/2021	verified	Moyen
10	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxxxxx.xxx	Xxx-xxxx	Xxx-xxxx-xxxxx	14/07/2021	verified	Élevé
11	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxx.xxx	Xxx-xxxx	Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx	11/11/2021	verified	Moyen
12	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxx.xxx	Xxx-xxxx	Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx	11/11/2021	verified	Moyen
13	XXX.XXX.XX.XXX		Xxx-xxxx	Xxxxxxxxxxxx Xxxxxxxxxxxxx Xxxx	11/11/2021	verified	Élevé
14	XXX.XXX.XX.XX	xx.xx.xxx.xxx.xxxxxx.xxxx.xxxxx.xx	Xxx-xxxx	Xxx-xxxx-xxxxx	14/07/2021	verified	Élevé

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	Élevé
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	T1059	CWE-94	Argument Injection	predictive	Élevé
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
9	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
10	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Élevé
11	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	Élevé
12	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
13	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé
14	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (42)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/api/log/killJob	predictive	Élevé
2	File	/cgi-bin/nas_sharing.cgi	predictive	Élevé
3	File	/language/lang	predictive	Élevé
4	File	admin/conf_users_edit.php	predictive	Élevé
5	File	c_rehash	predictive	Moyen
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Élevé
7	File	xxxxx.xxx	predictive	Moyen
8	File	xxxx.xxx	predictive	Moyen
9	File	xxxxxx/xxxxxxxxxxxx	predictive	Élevé
10	File	xxxxxxxxxxxxxxxxxxx.xxxx	predictive	Élevé
11	File	xxxxxxxxxx\xxxxxxxxxxxx\xxxxxxxxxxxxxxxx.xxx	predictive	Élevé
12	File	xxxxx_xxxxxxx.xxx	predictive	Élevé
13	File	xxxxxxx.x	predictive	Moyen
14	File	xxxxxxx.xxx	predictive	Moyen
15	File	xxxxx/_xxxxx.xx	predictive	Élevé
16	File	xxxxx.xxx	predictive	Moyen
17	File	xxxxxxxx.xxx	predictive	Moyen
18	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Élevé
19	File	xxxxxxxx_xxxx.xxx	predictive	Élevé
20	File	xxxxxxxxxxxxxxxxxxxxxxxxx.xx	predictive	Élevé
21	File	xxxx/xxxxxxxx/xxxxxxxx.xxxx	predictive	Élevé
22	File	xx/xxxxxxxxx/xx	predictive	Élevé
23	File	xxxxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Élevé
24	File	xxx/xxx-xxxxxxxxxx/xxxx-xxxxxx/xxxxxx.xxx	predictive	Élevé
25	File	xx-xxxxx.xxx	predictive	Moyen
26	File	xx/xx/xxxxx	predictive	Moyen
27	Argument	--xxxxxx/--xxxxxxxx	predictive	Élevé
28	Argument	xxxxxxxxxx	predictive	Moyen
29	Argument	xxxxx_xxxxxx	predictive	Moyen
30	Argument	xx	predictive	Faible
31	Argument	xx	predictive	Faible
32	Argument	xxxxx	predictive	Faible
33	Argument	xxxxxxx_xxx	predictive	Moyen
34	Argument	xxxxxxxxx	predictive	Moyen
35	Argument	xxxxxx_xxx	predictive	Moyen
36	Argument	xxxxxx	predictive	Faible
37	Argument	x_xxxxxxxx	predictive	Moyen
38	Argument	xxxxxxx.xx-xxxxx-xxxx	predictive	Élevé
39	Input Value	/../	predictive	Faible
40	Input Value	[]xxxxxx{}/x["xxx"]	predictive	Élevé
41	Pattern	xxxxxxxxxxx	predictive	Moyen
42	Network Port	xxx/xxxx	predictive	Moyen

Références (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!