BelialDemon Analisi

IOB - Indicator of Behavior (22)

Sequenza temporale

Linguaggio

en22

Nazione

Attori

Attività

Interesse

Sequenza temporale

Genere

Fornitore

Prodotto

uppy Package2
Tenda W30E2
Sympa2
WPG Plugin2
United Planet Intrexx Professional2

Vulnerabilità

#VulnerabilitàBaseTemp0dayOggiSfrConEPSSCTICVE
1SonicBOOM riscv-boom escalazione di privilegi5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.000550.00CVE-2020-29561
2United Planet Intrexx Professional cross site scripting4.84.6$0-$5k$0-$5kNot DefinedOfficial Fix0.000890.00CVE-2020-24188
3Huawei Mate 20 Digital Balance escalazione di privilegi3.93.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000580.00CVE-2020-1831
4Aviatrix Controller Web Interface cross site request forgery5.45.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000530.00CVE-2020-13416
5Tenda Tenda W30E NatStaticSetting buffer overflow6.56.4$0-$5k$0-$5kNot DefinedNot Defined0.000750.00CVE-2022-45516
6Tenda W30E CertListInfo buffer overflow5.55.3$0-$5k$0-$5kNot DefinedNot Defined0.000750.00CVE-2022-45525
7thinkphp-bjyblog AdminBaseController.class.php exit cross site scripting4.84.8$0-$5k$0-$5kNot DefinedNot Defined0.000780.00CVE-2021-43682
8WPG Plugin buffer overflow8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.013670.00CVE-2021-27362
9ownCloud escalazione di privilegi6.86.5$0-$5k$0-$5kNot DefinedOfficial Fix0.001030.00CVE-2020-28645
10Star Practice Management Web WIP Detail escalazione di privilegi4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.000650.00CVE-2020-28401
11Microsoft .NET Framework XML denial of service6.46.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.004100.00CVE-2018-0764
12Wireshark Dissection Engine denial of service4.24.0$0-$5k$0-$5kNot DefinedOfficial Fix0.003340.00CVE-2020-26419
13Sympa SOAP API authenticateAndRun escalazione di privilegi6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.002660.00CVE-2020-29668
14Symantec Messaging Gateway Web UI rivelazione di un 'informazione4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.000650.02CVE-2020-12595
15Google Chrome Omnibox autenticazione debole6.46.1$25k-$100k$5k-$25kNot DefinedOfficial Fix0.005420.00CVE-2020-6565
16osTicket ajax.draft.php _uploadInlineImage cross site scripting5.24.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000780.00CVE-2020-24917
17uppy Package escalazione di privilegi7.47.1$0-$5k$0-$5kNot DefinedOfficial Fix0.003270.00CVE-2020-8205

Campagne (1)

These are the campaigns that can be associated with the actor:

  • Matanbuchus

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDindirizzo IPHostnameAttoreCampagneIdentifiedGenereFiducia
134.94.151.129129.151.94.34.bc.googleusercontent.comBelialDemonMatanbuchus29/08/2021verifiedMedia
2XX.XXX.XX.XXxx.xx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxxxXxxxxxxxxxx29/08/2021verifiedMedia
3XX.XXX.XXX.XXXxxx.xxx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxxxXxxxxxxxxxx29/08/2021verifiedMedia

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClasseVulnerabilitàAccesso al vettoreGenereFiducia
1T1059.007CAPEC-209CWE-79Cross Site ScriptingpredictiveAlto
2TXXXXCAPEC-0CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveAlto
3TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveAlto
4TXXXXCAPEC-116CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveAlto

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorGenereFiducia
1File/goform/CertListInfopredictiveAlto
2File/goform/NatStaticSettingpredictiveAlto
3Filexxxxxxxxxxxxxxxxxxx.xxxxx.xxxpredictiveAlto
4Filexxxxxxx/xxxx.xxxxx.xxxpredictiveAlto
5ArgumentxxxxxxxxxxpredictiveMedia
6ArgumentxxxxpredictiveBasso
7ArgumentxxxxxxxpredictiveBasso

Referenze (2)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!