Finteam Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (67)

Linguaggio

en	56
it	4
es	4
fr	2
de	2

Nazione

us	58
cn	4
ru	4

Attori

Finteam	3
Cobalt Strike	3
Silence	2
IcedID	2
RedLine Stealer	1

Interesse

Genere

Not Defined	38
Database Software	6
Content Management System	4
Router Operating System	4
Hosting Control Software	2

Fornitore

Not Defined	26
Comersus Open Technologies	4
VMware	4
Cisco	4
Virtuenetz	2

Prodotto

PostgreSQL	6
VMware Workspace ONE Access	4
VMware Identity Manager	4
Virtuenetz Virtue Shopping Mall	2
cPanel	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	Comersus Open Technologies Comersus BackOffice Plus comersus_backoffice_searchitemform.asp cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00230	0.02	CVE-2005-3285
2	aasi media Net Clubs Pro sendim.cgi cross site scripting	5.4	5.1	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00789	0.00	CVE-2006-1965
3	ThinkPHP index.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00173	0.02	CVE-2018-10225
4	PostgreSQL Client rivelazione di un 'informazione	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00080	0.04	CVE-2022-41862
5	PostgreSQL User ID Local Privilege Escalation	5.9	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00049	0.02	CVE-2023-2455
6	PostgreSQL Extension Script sql injection	7.1	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00145	0.03	CVE-2023-39417
7	PostgreSQL MERGE vulnerabilità sconosciuta	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00085	0.02	CVE-2023-39418
8	WALLIX Bastion Network Access Administration Web Interface rivelazione di un 'informazione	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00087	0.00	CVE-2023-46319
9	Cisco IOS XE Web UI Remote Code Execution	9.9	9.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.90080	0.04	CVE-2023-20198
10	PHP-Nuke modules.php sql injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.02	CVE-2014-3934
11	Microsoft Windows Common Log File System Driver Privilege Escalation	8.1	7.4	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00125	0.02	CVE-2022-37969
12	Microsoft Windows IIS Remote Code Execution	7.6	7.0	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00104	0.06	CVE-2022-30209
13	VMware Workspace ONE Access autenticazione debole	9.8	9.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.70435	0.00	CVE-2022-31656
14	VMware Workspace ONE Access/Identity Manager URL escalazione di privilegi	7.4	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00160	0.00	CVE-2022-31657
15	VMware Workspace ONE Access JDBC escalazione di privilegi	4.7	4.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00222	0.00	CVE-2022-31665
16	Microsoft .NET Core Remote Code Execution	8.1	7.1	$25k-$100k	$0-$5k	Unproven	Official Fix	0.08067	0.05	CVE-2021-26701
17	Sitecore Rocks Plugin Service escalazione di privilegi	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00326	0.00	CVE-2019-12440
18	sudo sudoers_policy_main buffer overflow	8.3	8.0	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.97051	0.00	CVE-2021-3156
19	Hikvision DS-2CD7153-E autenticazione debole	8.5	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.53976	0.04	CVE-2013-4976
20	Micro Focus GroupWise Administration Console escalazione di privilegi	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00393	0.00	CVE-2018-12468

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Attore	Identified	Genere	Fiducia
1	146.0.72.180	Finteam	22/12/2020	verified	Alto
2	XXX.XX.XXX.XXX	Xxxxxxx	22/12/2020	verified	Alto
3	XXX.XXX.XX.X	Xxxxxxx	12/02/2022	verified	Alto

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
9	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (66)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/cgi-bin/user/Config.cgi	predictive	Alto
2	File	/cgi-sys/FormMail-clone.cgi	predictive	Alto
3	File	account.php	predictive	Media
4	File	apply.cgi	predictive	Media
5	File	article.php	predictive	Media
6	File	cart.php	predictive	Media
7	File	catalog.asp	predictive	Media
8	File	category.php	predictive	Media
9	File	cgi-bin/reorder2.asp	predictive	Alto
10	File	xxxxxxxx_xxxxxxxxxx_xxxxxxxxxxxxxx.xxx	predictive	Alto
11	File	xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	Alto
12	File	xxxxxxxx_xxxxxxxxxx.xxx	predictive	Alto
13	File	xxxxxxx.xxx	predictive	Media
14	File	xxxxxx.xxx	predictive	Media
15	File	xxxxxxxxxxx.xxx	predictive	Alto
16	File	xxxxxxx/xxxxxxxxx_xxxxxxx.xxx.xxx	predictive	Alto
17	File	xxxxx.xxx	predictive	Media
18	File	xxxxx.xxx	predictive	Media
19	File	xxxx.xxx	predictive	Media
20	File	xxxx.xxx	predictive	Media
21	File	xxxxxxx.xxx	predictive	Media
22	File	xxxxxxxxxxxx.xxx	predictive	Alto
23	File	xxxxxxx.xxx	predictive	Media
24	File	xxxxxxxx.xxx	predictive	Media
25	File	xxxxxxx_xxxxxxx.xxx	predictive	Alto
26	File	xxxxxx.xxx	predictive	Media
27	File	xxxxxxx.xxx	predictive	Media
28	File	xxxxxx.xxx	predictive	Media
29	File	xxxxxx.xxx	predictive	Media
30	File	xxxx.xxx	predictive	Media
31	File	xxxx.xxx	predictive	Media
32	File	xxxx.xxx	predictive	Media
33	File	xxxxxxxxxxxxx.xxx	predictive	Alto
34	File	xxxxxxxx.xxxx	predictive	Alto
35	File	xxxxx_xxxxxx_xxxxxx.xxx	predictive	Alto
36	File	xxxx_xxxx.xxx	predictive	Alto
37	File	xxxxxxxxxx.xxx	predictive	Alto
38	Argument	xxx	predictive	Basso
39	Argument	xxxxxxx	predictive	Basso
40	Argument	xxxxxxxxxx	predictive	Media
41	Argument	xxxxxxxxxx	predictive	Media
42	Argument	xxxxxxxx_xx	predictive	Media
43	Argument	xxxxx	predictive	Basso
44	Argument	xxx_xx	predictive	Basso
45	Argument	xxx	predictive	Basso
46	Argument	xxxxxxx	predictive	Basso
47	Argument	xxxxxxx	predictive	Basso
48	Argument	xx	predictive	Basso
49	Argument	xxxxxxxxx	predictive	Media
50	Argument	xxxx_xx[]	predictive	Media
51	Argument	xxxx_xxxx	predictive	Media
52	Argument	xxx	predictive	Basso
53	Argument	xxxxxx_xx	predictive	Media
54	Argument	xxxxxxx	predictive	Basso
55	Argument	xxxx	predictive	Basso
56	Argument	xxxx_xx	predictive	Basso
57	Argument	xxxx_xx/xxxxxx	predictive	Alto
58	Argument	xxxxxx	predictive	Basso
59	Argument	xxxxxx	predictive	Basso
60	Argument	xxxxxxx_xx	predictive	Media
61	Argument	x_xx	predictive	Basso
62	Argument	xxx_xxx	predictive	Basso
63	Argument	xxxxxx	predictive	Basso
64	Argument	xxxxxx[]	predictive	Media
65	Argument	xxxx/xxxxx/xxxx	predictive	Alto
66	Input Value	xxxxxx=xxx&xxxxxxxx=xxxxxxx.*	predictive	Alto

Referenze (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!