UNC1151 Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (50)

Linguaggio

zh	32
en	12
es	2
de	2
ru	2

Nazione

cn	40
us	4
es	2
de	2
ru	2

Attori

UNC1151	4
Meterpreter	1
Hydra	1
RedLine Stealer	1

Interesse

Genere

Not Defined	30
Operating System	8
Content Management System	2
Web Server	2
Router Operating System	2

Fornitore

Not Defined	16
Apache	8
Linux	4
Microsoft	4
Fortinet	2

Prodotto

Linux Kernel	4
Microsoft Windows	4
hibernate-core	2
Fortinet FortiWeb	2
Hibernate Validator	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	CTI	EPSS	CVE
1	Joseph C Dolson My Tickets Plugin cross site request forgery	5.8	5.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00062	CVE-2022-47440
2	mongo-java-driver autenticazione debole	4.6	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00046	CVE-2021-20328
3	BusyBox xfuncs_printf.c xasprintf buffer overflow	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00044	CVE-2023-42363
4	busybox ash.c buffer overflow	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06	0.00134	CVE-2022-48174
5	MikroTik RouterOS Winbox/HTTP Interface escalazione di privilegi	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00055	CVE-2023-30799
6	D-Link DIR-635 Wireless.shtml cross site scripting	4.6	4.4	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00000
7	SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.05	0.00135	CVE-2023-2090
8	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	4.32	0.00000
9	Serendipity exit.php escalazione di privilegi	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.49	0.00000
10	Gin-vue-admin Parameter Validation directory traversal	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00126	CVE-2022-24843
11	Apache DolphinScheduler User Registration denial of service	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00090	CVE-2022-25598
12	ThinkPHP escalazione di privilegi	8.5	8.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03	0.97456	CVE-2019-9082
13	Microsoft Windows Runtime Remote Code Execution	8.1	7.4	$100k et plus	$5k-$25k	Unproven	Official Fix	0.00	0.47432	CVE-2022-21971
14	Apache APISIX batch-requests Plugin autenticazione debole	7.3	7.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.02	0.97415	CVE-2022-24112
15	Linux Kernel Timer Tree timerqueue.c timerqueue_add denial of service	3.1	3.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2021-20317
16	Oracle VM VirtualBox rivelazione di un 'informazione	3.8	3.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00045	CVE-2022-21295
17	Hashicorp Consul Enterprise HTTP Event vulnerabilità sconosciuta	6.0	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00259	CVE-2021-28156
18	Apache Shiro autenticazione debole	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01	0.00644	CVE-2014-0074
19	Cisco HyperFlex Software Graphite Interface autenticazione debole	4.2	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2019-1667
20	RabbitMQ Management UI cross site scripting	2.4	2.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.00096	CVE-2021-32718

Campagne (3)

These are the campaigns that can be associated with the actor:

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Campagne	Identified	Genere	Fiducia
1	88.99.104.179	static.179.104.99.88.clients.your-server.de	UNC1151	Ghostwriter	01/06/2021	verified	Alto
2	XX.XXX.XXX.XXX	xxxxxxxxxx.xxxxxxx.xxxxx	Xxxxxxx	Xxxxxxx	13/07/2023	verified	Alto
3	XXX.XXX.XX.XX	xxxx.xxxxxxxxxxxx.xx	Xxxxxxx	Xxxxxxxx Xxxxxxxxx Xxxxxxxx	01/03/2022	verified	Alto
4	XXX.XXX.XXX.XX	xxxx-xxx-xxx-xxx-xx.xxxxxxx.xxxx	Xxxxxxx	Xxxxxxxx Xxxxxxxxx Xxxxxxxx	01/03/2022	verified	Alto
5	XXX.XXX.XXX.XX	xxxxxxxxx.xxxxxx.xxxxx	Xxxxxxx	Xxxxxxxx Xxxxxxxxx Xxxxxxxx	01/03/2022	verified	Alto

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	T1059	CWE-94	Argument Injection	predictive	Alto
3	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
5	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Alto
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
8	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
9	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
10	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Alto

IOA - Indicator of Attack (19)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	/admin/maintenance/view_designation.php	predictive	Alto
2	File	/concat?/%2557EB-INF/web.xml	predictive	Alto
3	File	/context/%2e/WEB-INF/web.xml	predictive	Alto
4	File	/xxxxx/xxxx.xxx	predictive	Alto
5	File	xxx.x	predictive	Basso
6	File	xxxxx/xxxxxxxx.xxxxx	predictive	Alto
7	File	xxxx.xxx	predictive	Media
8	File	xxx/xxxx/xx_xxxx.x	predictive	Alto
9	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	Alto
10	File	xxxx/xxx/xxx_xxxx.x	predictive	Alto
11	File	xxxxxx_xxxxxx.x	predictive	Alto
12	Library	xxxxxxxxxxx.xxx	predictive	Alto
13	Library	xxx/xxxxxxxxxx.x	predictive	Alto
14	Argument	$_xxxxxx['xxxxx_xxxxxx']	predictive	Alto
15	Argument	xxxxxxxxxxxxxx[x]xxxx_xxxxxxxx[x]xxxx	predictive	Alto
16	Argument	xx	predictive	Basso
17	Argument	xxx	predictive	Basso
18	Input Value	-x	predictive	Basso
19	Network Port	xxx/xx (xxx xxxxxxxx)	predictive	Alto

Referenze (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Might our Artificial Intelligence support you?

Check our Alexa App!