APT30 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (7)

言語

zh	4
en	4

国・地域

cn	6
us	2

アクター

APT30	1

関心

タイプ

Not Defined	2
Network Management Software	2
Groupware Software	2

ベンダー

Combodo	2
Not Defined	2
Microsoft	2

製品

Combodo iTop	2
Zabbix	2
Microsoft Exchange Server	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	Combodo iTop config.php TestConfig 特権昇格	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00089	0.04	CVE-2018-10642
2	Inter7 SqWebMail Error Message 情報の漏洩	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00591	0.00	CVE-2004-2313
3	Softnext SPAM SQR 特権昇格	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00143	0.04	CVE-2023-24835
4	Microsoft Exchange Server Privilege Escalation	8.8	7.7	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.01258	0.00	CVE-2021-28482
5	Linux Kernel z90crypt_unlocked_ioctl 特権昇格	5.9	5.6	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00042	0.02	CVE-2009-1883
6	Zabbix Dashboard Page 弱い認証	8.2	8.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.35520	0.00	CVE-2019-17382

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	Identified	タイプ	信頼度
1	5.1.0.29	5-1-0-29.datagroup.ua	APT30	2020年12月26日	verified	高
2	XXX.XXX.XX.XXX		Xxxxx	2024年02月19日	verified	高
3	XXX.XXX.X.XXX		Xxxxx	2020年12月24日	verified	高
4	XXX.XXX.XXX.XXX		Xxxxx	2024年02月19日	verified	高

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	脆弱性	アクセスベクター	タイプ	信頼度
1	T1059	CWE-94	Argument Injection	predictive	高
2	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
3	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	web/env-production/itop-config/config.php	predictive	高
2	File	xxxxxx.xxx?xxxxxx=xxxxxxxxx.xxxx&xxxxxxxxxxx=x	predictive	高

参考 (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!