Dust Storm Analyse

IOB - Indicator of Behavior (1000)

Chronologie

Langue

en976
zh24

De campagne

cn996
us4

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Qualcomm Snapdragon Auto16
Qualcomm Snapdragon Consumer IOT16
Qualcomm Snapdragon Industrial IOT16
Qualcomm Snapdragon Mobile16
Qualcomm Snapdragon Voice 14

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConEPSSCTICVE
1librsvg URL Decoder directory traversal4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001580.00CVE-2023-38633
2Pluck CMS Installation install.php cross site scripting3.53.5$0-$5k$0-$5kProof-of-ConceptNot Defined0.000510.19CVE-2023-5013
3Windriver VxWorks elévation de privilèges5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.011320.04CVE-2013-0716
4Windriver VxWorks chiffrement faible7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.001510.04CVE-2010-2967
5Windriver VxWorks Hardcoded Credentials elévation de privilèges7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.003720.04CVE-2010-2966
6Cisco RV340 Web-based Management Interface buffer overflow5.55.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.006990.04CVE-2020-3451
7jeecgboot JimuReport Template elévation de privilèges7.57.3$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.004570.08CVE-2023-4450
8Adminer adminer.php elévation de privilèges7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020920.05CVE-2021-21311
9Wagtail String Comparison divulgation de l'information4.03.5$0-$5k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2020-11037
10Netgear D3600/D6000/D6100/R6100 buffer overflow7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.000790.00CVE-2018-21217
11Netgear WNR2050 Reflected cross site scripting4.44.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2018-21209
12pixl-class create elévation de privilèges8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.003470.00CVE-2020-7640
13Mozilla Firefox Private Browsing Password authentification faible2.82.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2020-6824
14Mozilla Firefox/Firefox ESR/Thunderbird buffer overflow7.57.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.003090.00CVE-2020-6822
15Advanced Woo Search Plugin class-aws-search.php divulgation de l'information6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.002640.03CVE-2020-12070
16Nginx Controller TLS authentification faible5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.001780.00CVE-2020-5864
17Netgear R7800 elévation de privilèges6.15.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.000440.00CVE-2018-21106

Campagnes (1)

These are the campaigns that can be associated with the actor:

  • Dust Storm

IOC - Indicator of Compromise (34)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadresse IPHostnameActeurCampagnesIdentifiedTaperConfiance
16.9.2.1Dust StormDust Storm23/12/2020verifiedÉlevé
223.238.229.128Dust StormDust Storm23/12/2020verifiedÉlevé
327.255.72.68Dust StormDust Storm23/12/2020verifiedÉlevé
427.255.72.69Dust StormDust Storm23/12/2020verifiedÉlevé
527.255.72.78Dust StormDust Storm23/12/2020verifiedÉlevé
659.120.59.259-120-59-2.hinet-ip.hinet.netDust StormDust Storm23/12/2020verifiedÉlevé
759.188.13.133Dust StormDust Storm23/12/2020verifiedÉlevé
8XX.XXX.XX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
9XX.XXX.XXX.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
10XX.XXX.XXX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
11XXX.X.X.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
12XXX.XX.XXX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
13XXX.XX.XXX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
14XXX.XXX.XX.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
15XXX.XXX.XX.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
16XXX.XX.XXX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
17XXX.XX.XXX.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
18XXX.XXX.XXX.XXxxxxxx-xx-xx-xxx-xxx-xxx.xxx.xxxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
19XXX.XXX.XXX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
20XXX.XX.XX.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
21XXX.XXX.XXX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
22XXX.XX.XX.XXxxx.xxxxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
23XXX.XXX.XXX.XXXxxx.xxxx.xxx.xxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
24XXX.XXX.XXX.XXXxxxxx.xxxx.xxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
25XXX.XXX.XX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
26XXX.XX.XX.XXXxx.xx.xx.xxxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
27XXX.X.XXX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
28XXX.XX.XXX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
29XXX.XX.XXX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
30XXX.XXX.XX.XXXxxxxxxxxxxxxxxxxxxxx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
31XXX.XX.XX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
32XXX.XX.XX.XXXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
33XXX.XX.XXX.XXxxx-xx-xxx-xx.xxxxx-xx.xxxxx.xxxXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé
34XXX.XX.XXX.XXXxxx XxxxxXxxx Xxxxx23/12/2020verifiedÉlevé

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1006CWE-22Path TraversalpredictiveÉlevé
2T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveÉlevé
3T1059CWE-88, CWE-94Argument InjectionpredictiveÉlevé
4T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveÉlevé
5T1068CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveÉlevé
6TXXXXCWE-XXXXxxx Xxx Xxxxxxxxx Xxxxxxxxxxx XxxxxxxxpredictiveÉlevé
7TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveÉlevé
8TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
9TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveÉlevé
10TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveÉlevé
11TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveÉlevé
12TXXXXCWE-XXXXxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx XxxxxpredictiveÉlevé
13TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
14TXXXX.XXXCWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveÉlevé
15TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
16TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveÉlevé
17TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
18TXXXXCWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
19TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé
20TXXXX.XXXCWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveÉlevé
21TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveÉlevé

IOA - Indicator of Attack (184)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File.htaccesspredictiveMoyen
2File/admin.php?p=/Area/index#tab=t2predictiveÉlevé
3File/bin/shpredictiveFaible
4File/gateway/services/EdgeServiceImplpredictiveÉlevé
5File/goform/net\_Web\_get_valuepredictiveÉlevé
6File/HNAP1predictiveFaible
7File/Maintenance/configfile.cfgpredictiveÉlevé
8File/module/comment/savepredictiveÉlevé
9File/restpredictiveFaible
10File/rootpredictiveFaible
11File/scripts/unlock_tasks.phppredictiveÉlevé
12File/tmppredictiveFaible
13File/topicpredictiveFaible
14File/upload/localhostpredictiveÉlevé
15File/wp-admin/admin-ajax.phppredictiveÉlevé
16Fileaccount/login.phppredictiveÉlevé
17FileActiveMQConnection.javapredictiveÉlevé
18FileActivityManagerService.javapredictiveÉlevé
19Fileadmin/app/mediamanagerpredictiveÉlevé
20Fileadmin/cms/template/getTemplates.html?res_path=respredictiveÉlevé
21Filexxxxx/xxxxxx.xxxpredictiveÉlevé
22Filexxxxx/xxxxxxxx/xxxxxxxxxxxx?xx=xxpredictiveÉlevé
23Filexxxxx/_xxxxxxx.xxxpredictiveÉlevé
24Filexxxxxxx.xxxpredictiveMoyen
25Filexxxxxxxxxxxxx_xxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
26Filexxx.xxx/xxx/xxxxxxpredictiveÉlevé
27Filexxx/xxxxxx/xxxxxxxxxx.xxxpredictiveÉlevé
28Filexxx/xxxxxx/xxxxxxxx/xxxxx/xxxxxxxx_xxxxxxx.xxxxx.xxxpredictiveÉlevé
29Filexxxxx/xxx_xxxx.xpredictiveÉlevé
30Filexxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
31Filexxxxxx/xxxxxx/predictiveÉlevé
32Filexxxxxxxxx-xxxxxxx/xxx/xxxx/xxxx/xx/xxxxxxx/xxxxxxxxx/xxxxxxx/xxxxxxx/xxxxxx.xxxxpredictiveÉlevé
33Filexxx_xx_xxx.xxpredictiveÉlevé
34Filexxxxxxxxxx.xpredictiveMoyen
35Filexxxxx.xxpredictiveMoyen
36Filexxx-xxx/xxxx/xxxxx/xxxxxxx/xxxxxxxx/xxxxxxxxpredictiveÉlevé
37Filexxx.xxxpredictiveFaible
38Filexxx.xxxxxxxx.xxxxxxx.xxx.xxx.xxxxxxxxxxxxxpredictiveÉlevé
39Filexxxxxxxxxx/xxx.xxpredictiveÉlevé
40Filexxxxxx.xxxpredictiveMoyen
41Filexxxx/xxxxxxxxxxx.xxxpredictiveÉlevé
42Filexxxxx/xxxx/xxxxxxxxxxx/xxxxx/xxxxx.xxxpredictiveÉlevé
43Filexxxxxx_x_x.xxxpredictiveÉlevé
44Filexxxxxxxxx_xxx_xxxxxx_xxx/predictiveÉlevé
45Filexxxxxxx/xxx/xxxxxxxx/xxxxxxxxx/xxx/xxxxxx/xxxx.xpredictiveÉlevé
46Filexxxxxxx/xx/xxxxxxxx.xpredictiveÉlevé
47Filexxx_xxx.xpredictiveMoyen
48Filexxxxxxx/xxxxxxxx.xxxpredictiveÉlevé
49Filexxx-xxxxx.xpredictiveMoyen
50Filexxx/xxxxxx/xxx/?xxxxxx=xxxx&xx=xxxpredictiveÉlevé
51Filexxxxxxxx_xxx.xpredictiveÉlevé
52Filexxxxxx.xxxpredictiveMoyen
53Filexxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
54Filexxxxxxxx.xxpredictiveMoyen
55Filexxxxxxxxxxxxxxxxxxxxxxxx.xxxpredictiveÉlevé
56Filexx/xxxx/xxxxx.xpredictiveÉlevé
57Filexxxxxxxxxx.xpredictiveMoyen
58Filexxxxxx/xxxx/xxxxxx.xxxpredictiveÉlevé
59Filexxxxxxxxxxxxx.xxxpredictiveÉlevé
60Filexxxxx.xxxpredictiveMoyen
61Filexxxx/xxxx.xpredictiveMoyen
62Filexxxxxxxx/xxxx.xxxpredictiveÉlevé
63Filexxxxxxxx/xxxxx-xxx-xxxxxx.xxxpredictiveÉlevé
64Filexxxxx.xxxpredictiveMoyen
65Filexxxxx.xxx?x=/xxxxx/xxxxxx/xxxxxx/xxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictiveÉlevé
66Filexxxxx_xxxxxx.xxxpredictiveÉlevé
67Filexxxxxxx.xxxpredictiveMoyen
68Filexxxxxxxxxxxxxxx.xxxxx.xxxxxxpredictiveÉlevé
69Filexxxxxxxx/xxxxx_xxxxxx.xxxpredictiveÉlevé
70Filexxx-xxxx.xpredictiveMoyen
71Filexxxxxxxxxxx.xxpredictiveÉlevé
72Filexxxxxxx-xxxxxxx.xxxpredictiveÉlevé
73Filexxxxxxxx.xpredictiveMoyen
74Filexxx.xpredictiveFaible
75Filexxxxxxxxxx/xxxxxx.xpredictiveÉlevé
76Filexxxxxxx/xxxxx.xpredictiveÉlevé
77Filexxxxxx.xpredictiveMoyen
78Filexxxxxx_xxxx_xx_xx_xxx.xpredictiveÉlevé
79Filexxxxxxx/xxxxx_xxxx.xxxpredictiveÉlevé
80Filexxxx.xpredictiveFaible
81Filexxxxxxxx.xxxpredictiveMoyen
82Filexxxxxx.xpredictiveMoyen
83Filexxxxxxxx.xxxpredictiveMoyen
84Filexxxxx.xpredictiveFaible
85Filexxx/xxxxxxxxxx/xxxxxx.xpredictiveÉlevé
86Filexxx/xxxx/xx_xxxx.xpredictiveÉlevé
87Filexxxxxx.xpredictiveMoyen
88Filexxxx_xxxx.xxxpredictiveÉlevé
89Filexxxxx/xxxx-xxxxx.xxxpredictiveÉlevé
90Filexxxxxxxx.xxxpredictiveMoyen
91Filexxxx.xxxpredictiveMoyen
92Filexxxxxxxxxxxxxx.xxxpredictiveÉlevé
93Filexxxxxxxx_xxx.xxxpredictiveÉlevé
94Filexx-xxxxx/xxxxx.xxx?xxx=xxxx&xxx=xxxxxxpredictiveÉlevé
95Filexxxxxxx.xxxpredictiveMoyen
96Filexxxxxx/xxx.xxxpredictiveÉlevé
97Filexxxxx.xxxpredictiveMoyen
98Filex/xxxxx/xxxxxxx/xxxx/xxxpredictiveÉlevé
99Filexxxxxxx/xxxxxxxxxx.xxxpredictiveÉlevé
100Filexxxxxx-xxx-xxxx.xpredictiveÉlevé
101Filexxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
102Filexxxxxxxxxx.xpredictiveMoyen
103Filexxxxxx/xxxx_xxxxxxx?xxxpredictiveÉlevé
104Filexxxxxxxxxxxx/xxxxx.xxpredictiveÉlevé
105Filexxx_xxxxx.xpredictiveMoyen
106Filexxxxx/xxxx_xxxx.xpredictiveÉlevé
107Filexxx.xxxpredictiveFaible
108Filexxxx/xxxx.xxxpredictiveÉlevé
109Filexxxxx/x/xxxxpredictiveMoyen
110Filexxxx_xxxxxx.xxxpredictiveÉlevé
111Filexxx_xxxxxx.xpredictiveMoyen
112FilexxxxxxxxxxpredictiveMoyen
113Filexxxxxxxxxxxxx.xxxpredictiveÉlevé
114Filexxxxxxxxxxx.xxxpredictiveÉlevé
115Filexx-xxxxx/xxxxx-xxxx.xxx?xxxxxx=xxxx_xxxxxxx_xxxx_xxxxxxxpredictiveÉlevé
116Filexx.xxxpredictiveFaible
117Filexxxxxxxx.xpredictiveMoyen
118Libraryxxxxxxxxx.xxxpredictiveÉlevé
119Libraryxxx/xxxx/xxxxxxxxxx.xxpredictiveÉlevé
120Libraryxxxxxxx_xxxxx_xxxxxxpredictiveÉlevé
121Libraryxxxxx.xxxpredictiveMoyen
122Libraryxxxxxx/xxxx/xxxxxx/xxxxx.xpredictiveÉlevé
123Libraryxxxxx.xxxpredictiveMoyen
124Libraryxxxxx.xxxpredictiveMoyen
125Argument-xpredictiveFaible
126ArgumentxxxxxxxxxxxpredictiveMoyen
127Argumentxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxx/xxxxx/xxxxx_xxxxxxxpredictiveÉlevé
128ArgumentxxxxxpredictiveFaible
129Argumentxxxxxxx/xxxxxxxxpredictiveÉlevé
130ArgumentxxxxxxxxpredictiveMoyen
131Argumentxxxxxxx/xxxxpredictiveMoyen
132ArgumentxxxxxxxxpredictiveMoyen
133ArgumentxxxxxpredictiveFaible
134ArgumentxxxxxxxxxxxxxxxxpredictiveÉlevé
135ArgumentxxxpredictiveFaible
136ArgumentxxxxxxpredictiveFaible
137Argumentxxxxx_xxxxpredictiveMoyen
138Argumentxxxxxx[xxxxxxxxxxxxxx]predictiveÉlevé
139Argumentxxxxxxxxx/xxxxxxxxxx/xxxxx/xxxxxxx/xxxxxxx/xxxxxxxxpredictiveÉlevé
140ArgumentxxxxpredictiveFaible
141ArgumentxxxxxxpredictiveFaible
142ArgumentxxxxxxxxxpredictiveMoyen
143ArgumentxxxxxpredictiveFaible
144ArgumentxxxxxxxpredictiveFaible
145ArgumentxxxpredictiveFaible
146Argumentx_xxpredictiveFaible
147ArgumentxxxxpredictiveFaible
148Argumentxxxx_xxpredictiveFaible
149ArgumentxxxxxxxxpredictiveMoyen
150ArgumentxxxpredictiveFaible
151Argumentxxxxxxxxxx/xxxxxxxxxxxxpredictiveÉlevé
152ArgumentxxxxxpredictiveFaible
153Argumentxxx_xxxxxpredictiveMoyen
154ArgumentxxxxxxxxpredictiveMoyen
155ArgumentxxxxxxxxpredictiveMoyen
156ArgumentxxxxxxxxpredictiveMoyen
157ArgumentxxxxxxxxpredictiveMoyen
158Argumentxxxx_xxpredictiveFaible
159ArgumentxxxxxxxxxxxxxxxxpredictiveÉlevé
160ArgumentxxxxxxxxxxxxxxpredictiveÉlevé
161ArgumentxxxxxxpredictiveFaible
162ArgumentxxxxxxxxxxxxxxxxxxxpredictiveÉlevé
163ArgumentxxxxxxxxxxxxxxxpredictiveÉlevé
164Argumentxxxxxxxx/xxxxxxxxxxxxxpredictiveÉlevé
165ArgumentxxxpredictiveFaible
166ArgumentxxxxpredictiveFaible
167Argumentxxxxxx-xxxpredictiveMoyen
168Argumentxxxxxx xxxxx/xxxxxx xxxxpredictiveÉlevé
169ArgumentxxxxxxxxxpredictiveMoyen
170ArgumentxxxxxxxxxxpredictiveMoyen
171Argumentxx_xxxx_xxxxxxx/xx_xxxxxx_xxxxxxxxpredictiveÉlevé
172Input Value../predictiveFaible
173Input Valuex xxx xxxxx(x)predictiveÉlevé
174Input Value<?xxxpredictiveFaible
175Input Value<xxxxxx>xxxxx('xxx')</xxxxxx>predictiveÉlevé
176Input Valuexxxx@xxpredictiveFaible
177Input ValuexxxxxxxxpredictiveMoyen
178Input Valuexxxxxxxxxx&#x;:xxxxxpredictiveÉlevé
179Input Valuexxxx=xxx-xxxxxxxx-xxxxxxxpredictiveÉlevé
180Network PortxxxxpredictiveFaible
181Network Portxxx/xx (xxx)predictiveMoyen
182Network Portxxx/xxxpredictiveFaible
183Network Portxxx/xxxxpredictiveMoyen
184Network Portxxx/xxxxxpredictiveMoyen

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!