Gaza Cybergang Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (46)

Język

en	38
de	8

Kraj

us	20
gb	10
ws	6
ru	2
de	2

Aktorzy

Gaza Cybergang	5
RedLine Stealer	1
Locky	1
Conti	1
pupy	1

Wysiłek

Rodzaj

Not Defined	20
Content Management System	6
Web Server	4
File Transfer Software	2
Firewall Software	2

Sprzedawca

Not Defined	18
Microsoft	10
FileZilla	2
Cisco	2
phpkaiyuancms	2

Produkt

Microsoft IIS	4
WordPress	4
ioquake3	2
FileZilla Filezilla Server	2
Cisco ASA	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	jforum User privilege escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00289	0.05	CVE-2019-7550
2	Samsung Gallery Lockscreen privilege escalation	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00052	0.00	CVE-2024-20827
3	IBM Watson CP4D Data Stores denial of service	6.4	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00056	0.00	CVE-2023-27540
4	IBM Watson Knowledge Catalog on Cloud Pak for Data privilege escalation	7.4	7.3	$5k-$25k	$5k-$25k	Not Defined	Official Fix	0.00045	0.00	CVE-2023-28958
5	IBM Watson Knowledge Catalog on Cloud Pak for Data Request denial of service	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2023-28955
6	Joomla Webservice Endpoint privilege escalation	5.4	5.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.95214	0.06	CVE-2023-23752
7	Atlassian JIRA Server/Data Center Service Management Addon privilege escalation	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00283	0.00	CVE-2021-39128
8	magmi cross site request forgery	8.0	7.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.50353	0.02	CVE-2020-5776
9	Microsoft Exchange Server information disclosure	5.4	4.7	$5k-$25k	$0-$5k	Unproven	Official Fix	0.96172	0.04	CVE-2021-41349
10	Microsoft IIS Unicode directory traversal	7.3	6.6	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.93793	0.00	CVE-2000-0884
11	Siemens Polarion Web Page Generator Reflected cross site scripting	3.5	3.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00054	0.04	CVE-2019-13934
12	Cisco Unified Communications Manager SOAP API Endpoint privilege escalation	8.8	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00238	0.00	CVE-2021-1362
13	Lenovo Integrated Management Module 2 Web Administration memory corruption	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00250	0.00	CVE-2017-3774
14	vsftpd Service Port 6200 privilege escalation	8.5	8.4	$25k-$100k	$25k-$100k	Not Defined	Workaround	0.84215	0.07	CVE-2011-2523
15	TP-LINK TD-8840t HTTP Request tools_admin_1 cross site request forgery	4.6	4.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.04
16	Revive Adserver Flash Cross-Domain Policy crossdomain.xml privilege escalation	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00749	0.05	CVE-2015-7369
17	Oracle E-Business Suite iRecruitment nieznana luka	5.3	5.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00168	0.00	CVE-2010-2408
18	Octopus Deploy Package privilege escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.03	CVE-2019-19084
19	Cisco IOS XAUTH IKE Authentication weak authentication	6.5	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00517	0.00	CVE-2005-1058
20	Microsoft IIS privilege escalation	9.8	9.6	$25k-$100k	$5k-$25k	Not Defined	Workaround	0.00000	0.00

Kampanie (1)

These are the campaigns that can be associated with the actor:

Electric Powder

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Kampanie	Identified	Rodzaj	Pewność siebie
1	45.63.97.44	45.63.97.44.vultr.com	Gaza Cybergang		2020-12-22	verified	Medium
2	82.211.30.186		Gaza Cybergang	Electric Powder	2020-12-23	verified	Wysoki
3	XX.XXX.XX.XXX		Xxxx Xxxxxxxxx	Xxxxxxxx Xxxxxx	2020-12-23	verified	Wysoki
4	XX.XXX.XX.XXX		Xxxx Xxxxxxxxx	Xxxxxxxx Xxxxxx	2020-12-23	verified	Wysoki
5	XX.XXX.X.XX		Xxxx Xxxxxxxxx	Xxxxxxxx Xxxxxx	2020-12-23	verified	Wysoki
6	XX.XXX.XX.XXX		Xxxx Xxxxxxxxx	Xxxxxxxx Xxxxxx	2020-12-23	verified	Wysoki
7	XX.XXX.XX.XXX		Xxxx Xxxxxxxxx	Xxxxxxxx Xxxxxx	2020-12-23	verified	Wysoki
8	XX.XXX.XX.XX		Xxxx Xxxxxxxxx	Xxxxxxxx Xxxxxx	2020-12-23	verified	Wysoki
9	XXX.XXX.XX.XXX		Xxxx Xxxxxxxxx		2020-12-22	verified	Wysoki
10	XXX.XXX.X.XXX	xxxxxxxxxx.xxx	Xxxx Xxxxxxxxx		2020-12-22	verified	Wysoki

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klasa	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Wysoki
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Wysoki
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Wysoki
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
6	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
8	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Wysoki
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
10	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Wysoki
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (17)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/index.php/newsletter/subscriber/new/	predictive	Wysoki
2	File	api_poller.php	predictive	Wysoki
3	File	crossdomain.xml	predictive	Wysoki
4	File	xxx/xxxxxx/xxxxxx/xxxxxxxxxxx/xxx.xxx	predictive	Wysoki
5	File	xxxxx/xxxxx_xxxxx_x	predictive	Wysoki
6	File	xxxxxxx/xxxx_xxxxxxxxxx.xxx	predictive	Wysoki
7	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Wysoki
8	File	xxxxx.xxx	predictive	Medium
9	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	Wysoki
10	Library	x:\xxxxxxx\xxxxxxxx\xxxxxxxxxxx\xxxxxxxxxxxxxx\xxxxxxxx.xxx_xxxxx_xxxxxxxxxxxxxxxx\xxxxx\xxxxxxxxxxx.xxx	predictive	Wysoki
11	Library	xxxxxx.xxx	predictive	Medium
12	Argument	xxx	predictive	Niski
13	Argument	xxxxxxxx.xxxx	predictive	Wysoki
14	Argument	xxx	predictive	Niski
15	Argument	xxxx->xxxxxxx	predictive	Wysoki
16	Input Value	xx-xxxx://	predictive	Medium
17	Network Port	xxx/xxxx	predictive	Medium

Referencje (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Might our Artificial Intelligence support you?

Check our Alexa App!