Gorgon Group Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (13)

Język

en	14

Kraj

pk	14

Aktorzy

NjRAT	1

Wysiłek

Rodzaj

Web Server	4
Not Defined	4
Operating System	2
Cloud Software	2

Sprzedawca

Microsoft	8
Not Defined	4

Produkt

Microsoft IIS	4
ROCBOSS	2
Microsoft Windows Phone	2
portable SDK for UPnP	2
Microsoft Azure IoT Edge	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.07	CVE-2017-0055
2	Microsoft Azure IoT Edge/Hub Device Client SDK for Azure IoT MQTT Object memory corruption	6.9	6.8	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.04729	0.00	CVE-2018-8531
3	PHP GD Extension imagewebp privilege escalation	5.3	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00544	0.02	CVE-2014-5120
4	Microsoft Windows Phone SMS Service weak encryption	5.3	4.9	$5k-$25k	$5k-$25k	Unproven	Unavailable	0.05409	0.00	CVE-2012-2993
5	Apache HTTP Server ap_some_auth_required privilege escalation	3.7	3.2	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00522	0.09	CVE-2015-3185
6	MailCleaner Community Edition Logs.php privilege escalation	7.5	7.5	$0-$5k	$0-$5k	High	Not Defined	0.38848	0.00	CVE-2018-20323
7	ROCBOSS POST Request PostController.php doReward sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00212	0.03	CVE-2019-11362
8	portable SDK for UPnP unique_service_name memory corruption	10.0	9.5	$0-$5k	$0-$5k	High	Official Fix	0.97445	0.00	CVE-2012-5958
9	Microsoft IIS IP/Domain Restriction privilege escalation	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.28	CVE-2014-4078
10	Microsoft IIS File Name Tilde privilege escalation	6.5	5.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.96817	0.00	CVE-2005-4360
11	FiberHome VDSL2 Modem HG 150-UB weak authentication	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00369	0.03	CVE-2018-9249

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Kampanie	Identified	Rodzaj	Pewność siebie
1	115.186.136.237	115-186-136-237.nayatel.pk	Gorgon Group		2020-12-17	verified	Wysoki

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1059.007	CWE-79	Cross Site Scripting	predictive	Wysoki
2	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
3	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
4	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Wysoki

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/uncpath/	predictive	Medium
2	File	app/controllers/frontend/PostController.php	predictive	Wysoki
3	File	xxx/xxxx/xxxxxxxxxxx/xxxxxx/xxxx.xxx	predictive	Wysoki
4	Argument	xxxxx	predictive	Niski
5	Input Value	%xx	predictive	Niski
6	Input Value	::$xxxxx_xxxxxxxxxx	predictive	Wysoki
7	Network Port	xxx xxxxxx xxxx	predictive	Wysoki

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Interested in the pricing of exploits?

See the underground prices here!