Luoxk Analyse

IOB - Indicator of Behavior (87)

Chronologie

Langue

en58
zh30

De campagne

cn70
us18

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Microsoft IIS4
OpenVPN Private Tunnel Installer2
Mail20002
Linux Kernel2
HPE integrated Lights Out2

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConCTIEPSSCVE
1Sophos Firewall User Portal/Webadmin authentification faible8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.020.97434CVE-2022-1040
2XoruX LPAR2RRD/STOR2RRD authentification faible6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00262CVE-2021-42371
3OpenSSL c_rehash elévation de privilèges5.55.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.09738CVE-2022-1292
4Oracle Database Server Core RDBMS Privilege Escalation7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.040.00113CVE-2011-2253
5Apache ActiveMQ PortfolioPublishServlet.java cross site scripting4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00425CVE-2012-6092
6Next.js directory traversal5.04.4$0-$5k$0-$5kNot DefinedOfficial Fix0.090.00213CVE-2020-5284
7Python E-mail Module Remote Code Execution6.36.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.050.00095CVE-2023-27043
8Oracle Database server Encryption chiffrement faible9.88.8$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.000.00773CVE-2006-0270
9Filebrowser cross site request forgery6.96.4$0-$5k$0-$5kFunctionalOfficial Fix0.030.00762CVE-2021-46398
10lighttpd http_auth.c base64_decode dénie de service5.34.8$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.02569CVE-2011-4362
11Labelgate mora Downloader elévation de privilèges9.89.4$0-$5kCalculateurNot DefinedOfficial Fix0.000.00306CVE-2012-5188
12Oracle Email Center Message Display vulnérabilité inconnue8.27.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00192CVE-2021-2090
13Oracle MySQL Cluster Node.js elévation de privilèges8.27.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.040.00545CVE-2021-22884
14RemiCoin transferFrom buffer overflow7.47.4$0-$5k$0-$5kNot DefinedNot Defined0.000.00896CVE-2018-12230
15ZyXEL USG FLEX 50 CGI Program elévation de privilèges8.58.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.040.97482CVE-2022-30525
16Ivanti EPM Cloud Services Appliance elévation de privilèges6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.030.96887CVE-2021-44529
17Linux Kernel ptrace race condition4.43.9$0-$5kCalculateurProof-of-ConceptOfficial Fix0.020.00042CVE-2014-4699
18lighttpd Log File http_auth.c elévation de privilèges7.57.1$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.01123CVE-2015-3200
19Mail2000 Login portal cross site scripting5.24.8$0-$5k$0-$5kNot DefinedNot Defined0.000.00334CVE-2019-15072
20Backdoor.Win32.Controlit.10 Service Port 3347 elévation de privilèges7.36.4$0-$5k$0-$5kProof-of-ConceptWorkaround0.020.00000

Campagnes (1)

These are the campaigns that can be associated with the actor:

  • CVE-2018-2893

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1006CWE-21, CWE-22, CWE-23Path TraversalpredictiveÉlevé
2T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveÉlevé
3T1059CWE-94Argument InjectionpredictiveÉlevé
4T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveÉlevé
5TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
6TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveÉlevé
7TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
8TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveÉlevé
9TXXXXCWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveÉlevé
10TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
11TXXXX.XXXCWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveÉlevé
12TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
13TXXXXCWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveÉlevé
14TXXXX.XXXCWE-XXXXxxxxxxx Xx Xxx Xxxxxxx Xx X Xxxxxxxx XxxxxxxxpredictiveÉlevé
15TXXXX.XXXCWE-XXXXxxxxxxxpredictiveÉlevé
16TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
17TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé
18TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveÉlevé

IOA - Indicator of Attack (34)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File/cgi-bin/portalpredictiveÉlevé
2File/forum/away.phppredictiveÉlevé
3File/service/uploadpredictiveÉlevé
4File/tmppredictiveFaible
5Fileadclick.phppredictiveMoyen
6Filexxxxx.xxxpredictiveMoyen
7Filexxxxxxxxxxx\xxxx\xxxxxxxxxx\xxxxxxxxxxxxxxxxx.xxxxx.xxxpredictiveÉlevé
8Filexxx\xxxxx\xxxxxxxxxx\xxxxxxxxxxxxxxx.xxxpredictiveÉlevé
9Filexxxxxxxx\xxxxx.xxxpredictiveÉlevé
10Filexxxx/xxxxxxxxxxxx.xxxpredictiveÉlevé
11Filex_xxxxxxpredictiveMoyen
12Filexxxxxxx/xxxxx/xxxxxxxx/xxxxxpredictiveÉlevé
13Filexx/xx-xx.xpredictiveMoyen
14Filexxxx_xxxx.xpredictiveMoyen
15Filexxx/xxxxxx.xxxpredictiveÉlevé
16Filexxxxx.xxxpredictiveMoyen
17Filexxxxx.xxx/xxxxxxxxxxxxx/xxxpredictiveÉlevé
18Filexxxxxxx.xxxpredictiveMoyen
19Filexxxxxxx.xxpredictiveMoyen
20Filexxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
21Filexxxxxxxxx.xxxpredictiveÉlevé
22ArgumentxxxxxxxpredictiveFaible
23ArgumentxxxxxxpredictiveFaible
24ArgumentxxxxxxxxpredictiveMoyen
25ArgumentxxxxxxxxpredictiveMoyen
26ArgumentxxpredictiveFaible
27ArgumentxxxxxxpredictiveFaible
28ArgumentxxxxxxxpredictiveFaible
29ArgumentxxxxxxxpredictiveFaible
30ArgumentxxxxpredictiveFaible
31ArgumentxxxxxxxxpredictiveMoyen
32Argumentxxxxxx[]predictiveMoyen
33Input Value..\predictiveFaible
34Pattern|xx|xx|xx|predictiveMoyen

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!