East Timor Unknown Analiza

IOB - Indicator of Behavior (28)

Oś czasu

Język

en24
de4

Kraj

us20
id6
pt2

Aktorzy

Zajęcia

Wysiłek

Oś czasu

Rodzaj

Sprzedawca

Produkt

Apache HTTP Server4
TP-LINK TL-MR32202
Photography-on-the-net Exhibit Engine 22
YaBB2
Host2

Luki w zabezpieczeniach

#Słaby punktBaseTemp0dayDzisiajWykPrzEPSSCTICVE
1Microsoft IIS WebDav memory corruption5.65.2$25k-$100k$0-$5kHighOfficial Fix0.974180.05CVE-2003-0109
2LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000004.35
3YaBB yabb.pl cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.012400.04CVE-2004-2402
4Benjamin Arnaudetr Ginkgocms index.php sql injection7.37.3$0-$5k$0-$5kHighNot Defined0.001610.00CVE-2013-5318
5Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.17CVE-2017-0055
6Apache HTTP Server mod_proxy_uwsgi privilege escalation6.96.7$5k-$25k$5k-$25kNot DefinedOfficial Fix0.018980.03CVE-2023-27522
7Apache HTTP Server mod_proxy privilege escalation7.47.3$5k-$25k$5k-$25kNot DefinedOfficial Fix0.007390.04CVE-2023-25690
8Apache HTTP Server Limit Directive ap_limit_section memory corruption6.46.3$5k-$25k$0-$5kHighOfficial Fix0.973050.03CVE-2017-9798
9Aruba Networks ArubaOS Command Line Interface denial of service5.15.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.000730.00CVE-2022-37910
10Arvados PAM weak authentication6.46.3$0-$5k$0-$5kNot DefinedOfficial Fix0.001040.00CVE-2022-39238
11Apple macOS wifivelocityd privilege escalation8.28.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.001480.33CVE-2020-3838
12Trend Micro Antivirus 2021 privilege escalation8.38.3$5k-$25k$5k-$25kNot DefinedNot Defined0.000450.00CVE-2021-43771
13Backdoor.Win32.Wollf.h Service Port 7300 weak authentication9.88.6$0-$5k$0-$5kProof-of-ConceptWorkaround0.000000.00
14Microsoft Exchange Server ProxyShell nieznana luka9.48.2$25k-$100k$5k-$25kUnprovenOfficial Fix0.782220.00CVE-2021-34523
15Microsoft Windows Multimedia Library winmm.dll memory corruption10.09.5$100k i więcej$0-$5kHighOfficial Fix0.972810.04CVE-2012-0003
16Microsoft Excel MergeCells Record Heap privilege escalation4.43.9$5k-$25k$0-$5kUnprovenOfficial Fix0.945530.02CVE-2012-0185
17ZTE ZXDT22 SF01 directory traversal6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.003200.00CVE-2017-10933
18Apache OpenMeetings Password Reset sendHashByUser information disclosure7.57.1$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.002230.03CVE-2016-0783
19Host Web Server phpinfo.php phpinfo information disclosure5.35.2$5k-$25k$0-$5kNot DefinedWorkaround0.000000.04
20IBM Tivoli Endpoint Manager HTTPOnly Flag Cookie Handling information disclosure7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.003050.00CVE-2012-1837

IOC - Indicator of Compromise (46)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDadres IPHostnameAktorKampanieIdentifiedRodzajPewność siebie
114.137.33.0East Timor Unknown2023-05-30verifiedWysoki
235.248.7.128East Timor Unknown2023-05-30verifiedWysoki
335.248.7.144East Timor Unknown2023-05-30verifiedWysoki
435.248.7.148East Timor Unknown2023-05-30verifiedWysoki
535.248.7.150var1.bch1-ae21-0.us.twtelecom.netEast Timor Unknown2023-05-30verifiedWysoki
635.248.7.152East Timor Unknown2023-05-30verifiedWysoki
735.248.7.156East Timor Unknown2023-05-30verifiedWysoki
835.248.7.158var2.bch1-ae21-0.3549.level3.netEast Timor Unknown2023-05-30verifiedWysoki
943.243.120.0East Timor Unknown2023-05-30verifiedWysoki
1043.254.56.0East Timor Unknown2023-01-13verifiedWysoki
11XX.XX.XX.XXXxx-xxxx-xx.xxxxxxxxxxxx.xxxXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
12XX.XX.XX.XXXXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
13XX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
14XX.XX.XXX.XXXXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
15XX.XX.XXX.XXXXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
16XX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
17XXX.XX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
18XXX.XX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
19XXX.XX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
20XXX.XX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
21XXX.XX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
22XXX.XX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
23XXX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
24XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
25XXX.XXX.XXX.Xxxx-xxx-xxx-x.xxxxx.xxXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
26XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
27XXX.XXX.XXX.Xxx-xxx-x.xxxxxxxxx.xxXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
28XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
29XXX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
30XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
31XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
32XXX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
33XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
34XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
35XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
36XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
37XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
38XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
39XXX.XX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
40XXX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
41XXX.XXX.XXX.XXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
42XXX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
43XXX.XXX.XX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki
44XXX.XX.XX.XXXXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
45XXX.XX.XXX.XXXXxxx Xxxxx Xxxxxxx2023-01-13verifiedWysoki
46XXX.XX.XXX.XXxxx Xxxxx Xxxxxxx2023-05-30verifiedWysoki

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueLuki w zabezpieczeniachWektor dostępuRodzajPewność siebie
1T1006CWE-22Path TraversalpredictiveWysoki
2T1059CWE-94Argument InjectionpredictiveWysoki
3TXXXX.XXXCWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveWysoki
4TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveWysoki
5TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveWysoki
6TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveWysoki
7TXXXXCWE-XXXXxxxxxxxxx XxxxxxpredictiveWysoki
8TXXXXCWE-XXXxx XxxxxxxxxpredictiveWysoki
9TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveWysoki

IOA - Indicator of Attack (17)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasaIndicatorRodzajPewność siebie
1File/forum/away.phppredictiveWysoki
2File/uncpath/predictiveMedium
3Filefetchsettings.phppredictiveWysoki
4Filexxx/xxxxxx.xxxpredictiveWysoki
5Filexxxxx.xxxpredictiveMedium
6Filexxxxx/xxxxx.xxxpredictiveWysoki
7Filexxxxxxx.xxxpredictiveMedium
8Filexxxx.xxpredictiveNiski
9Libraryxxxxx.xxxpredictiveMedium
10ArgumentxxxxxxxxpredictiveMedium
11ArgumentxxxxxpredictiveNiski
12ArgumentxxxxxxxxxxxpredictiveMedium
13ArgumentxxpredictiveNiski
14ArgumentxxxxpredictiveNiski
15ArgumentxxxxxxxxxxpredictiveMedium
16ArgumentxxxxxxpredictiveNiski
17Input Valuexxxxxxxxxxxxxxxxxxxxxxxxxxxx+xxxxx+xxxxxx+x,x,xxxx,xxx,x,x+xxxx+xxx_xxxxx+xxxxx+xx=x--+predictiveWysoki

Referencje (3)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!