Goldfin Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (68)

Język

en	64
fr	2
ru	2

Kraj

us	34
ru	12
se	4
ir	4
au	2

Aktorzy

Patchwork	2
Carbanak	1
Silence	1
Baldr	1
Octopus	1

Wysiłek

Rodzaj

Not Defined	14
Content Management System	6
WordPress Plugin	6
Web Server	4
Cloud Software	4

Sprzedawca

Not Defined	18
Cisco	4
Microsoft	4
Web4Future	2
Green Packet	2

Produkt

Web4Future eCommerce	2
Green Packet DX-350	2
D-Link DWR-932B	2
WordPress	2
Cisco Identity Services Engine	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php privilege escalation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.58	CVE-2010-0966
2	TYPO3 ImageMagick/GraphicsMagick privilege escalation	7.4	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00775	0.00	CVE-2019-11832
3	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
4	Amazon Echo/Echo Dot/Echo Show/Echo Spot Listening Spying weak authentication	3.8	3.5	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00105	0.00	CVE-2018-11567
5	Microsoft Exchange Server Privilege Escalation	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.01502	0.03	CVE-2022-23277
6	vBulletin moderation.php sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00284	0.01	CVE-2016-6195
7	YaBB yabb.pl cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01240	0.04	CVE-2004-2402
8	Oracle MySQL Server InnoDB privilege escalation	7.1	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00156	0.02	CVE-2018-3064
9	Contact Form 7 Plugin privilege escalation	6.7	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00161	0.05	CVE-2023-6449
10	Omnisend Email Marketing for WooCommerce Plugin information disclosure	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2023-47244
11	PixelYourSite Plugin cross site scripting	2.4	2.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00051	0.00	CVE-2023-2584
12	TRENDnet TEW-652BRP Web Service cfg_op.ccp memory corruption	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00097	0.00	CVE-2023-0618
13	TRENDnet TEW-652BRP Web Interface ping.ccp privilege escalation	8.1	7.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01049	0.00	CVE-2023-0640
14	PHP Cookie privilege escalation	5.0	4.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00634	0.00	CVE-2022-31629
15	1C-Bitrix Bitrix24 AD/LDAP ldap_server_edit.php information disclosure	4.6	4.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00104	0.03	CVE-2022-43959
16	Profile Builder Plugin wppb_front_end_password_recovery weak authentication	8.1	8.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00073	0.00	CVE-2023-2297
17	WordPress Pingback privilege escalation	5.7	5.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00120	0.00	CVE-2022-3590
18	Abraham Williams TwitterOAuth privilege escalation	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00093	0.00	CVE-2011-5243
19	Hangzhou Xiongmai XMeye P2P Cloud Server weak authentication	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00080	0.04	CVE-2018-17919
20	Microsoft Exchange Server information disclosure	5.8	5.3	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00144	0.00	CVE-2022-24463

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	5.8.88.64		Goldfin	2020-12-22	verified	Wysoki
2	X.XXX.XX.XXX		Xxxxxxx	2020-12-22	verified	Wysoki
3	XX.XX.XX.XX	xxxx.xxxxxxx.xx	Xxxxxxx	2020-12-22	verified	Wysoki
4	XX.XXX.XXX.XXX		Xxxxxxx	2020-12-22	verified	Wysoki
5	XXX.XX.XX.XXX	xx.xxxxxxx.xx	Xxxxxxx	2020-12-22	verified	Wysoki

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klasa	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Wysoki
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Wysoki
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	Wysoki
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
5	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Wysoki
6	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
8	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
9	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Wysoki
10	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
11	TXXXX.XXX	CAPEC-0	CWE-XX	Xxxxxxxxxxxxx	predictive	Wysoki
12	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (28)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/bitrix/admin/ldap_server_edit.php	predictive	Wysoki
2	File	/debug/pprof	predictive	Medium
3	File	/redbin/rpwebutilities.exe/text	predictive	Wysoki
4	File	/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf	predictive	Wysoki
5	File	/xxxxxxx/	predictive	Medium
6	File	xxx_xx.xxx	predictive	Medium
7	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Wysoki
8	File	xxxxxxx/xxx/x_xxx.x	predictive	Wysoki
9	File	xxxxxxxxxxx/xxxxxxxx/xxxxxxxxxx.xxx	predictive	Wysoki
10	File	xxxxxxxxxxxx.xxx	predictive	Wysoki
11	File	xxx/xxxxxx.xxx	predictive	Wysoki
12	File	xxxxx.xxx	predictive	Medium
13	File	xxxxx.xxx	predictive	Medium
14	File	xxxx.xxx	predictive	Medium
15	File	xxxx.xxx	predictive	Medium
16	File	xxxxx.xxx	predictive	Medium
17	File	xxxxxxxxx.xxx	predictive	Wysoki
18	File	xxxx.xx	predictive	Niski
19	Argument	xxxxxxxx	predictive	Medium
20	Argument	xxxxx	predictive	Niski
21	Argument	xxx_xxxx/xxx_xxxxxxx	predictive	Wysoki
22	Argument	xxx	predictive	Niski
23	Argument	xxxxxx	predictive	Niski
24	Argument	xxxxxxx	predictive	Niski
25	Argument	xxxx_xx	predictive	Niski
26	Argument	xxx	predictive	Niski
27	Network Port	xxx/xx (xxxxxx)	predictive	Wysoki
28	Network Port	xxx/xxxx	predictive	Medium

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Do you need the next level of professionalism?

Upgrade your account now!