IRGC Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (115)

Język

en	116

Kraj

de	104
us	10
ir	2

Aktorzy

IRGC	4
APT17	1
Ballistic Bobcat	1
SMSspy	1
IRATA	1

Wysiłek

Rodzaj

Content Management System	4
Operating System	4
E-Commerce Management Software	2
Calendar Software	2
Forum Software	2

Sprzedawca

Not Defined	10
Microsoft	4
YITH	2
VMware	2
IBM	2

Produkt

Microsoft Windows	4
GeniXCMS	2
YITH WooCommerce Compare	2
WebCalendar	2
jforum	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	CTI	EPSS	CVE
1	DZCP deV!L`z Clanportal config.php privilege escalation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.78	0.00943	CVE-2010-0966
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
3	jforum User privilege escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00289	CVE-2019-7550
4	TikiWiki tiki-register.php privilege escalation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	10.00	0.01009	CVE-2006-6168
5	nginx privilege escalation	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.14	0.00241	CVE-2020-12440
6	Microsoft Windows IIS Server Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00	0.00133	CVE-2023-36434
7	ajenti API privilege escalation	7.1	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.01285	CVE-2019-25066
8	YITH WooCommerce Compare privilege escalation	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00000
9	Check Point Mobile Access/SSL VPN Portal Agent privilege escalation	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00118	CVE-2021-30358
10	SonicWALL Secure Remote Access cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.03350	CVE-2021-20028
11	SonicWall SSLVPN SMA100 sql injection	7.3	7.1	$0-$5k	$0-$5k	Functional	Not Defined	0.02	0.02628	CVE-2021-20016
12	Microsoft Exchange Server Privilege Escalation	9.0	8.2	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00	0.00223	CVE-2022-21969
13	VMware vCenter Server Analytics Service privilege escalation	8.6	8.5	$5k-$25k	$0-$5k	Functional	Official Fix	0.02	0.97389	CVE-2021-22005
14	MC Coming Soon Script users.php privilege escalation	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00000
15	Gophish cross site scripting	3.6	3.6	$0-$5k	Obliczenie	Not Defined	Official Fix	0.02	0.00054	CVE-2019-16146
16	GeniXCMS index.php cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00088	CVE-2017-14765
17	WebCalendar search.php cross site scripting	3.5	3.5	$0-$5k	Obliczenie	Not Defined	Not Defined	0.03	0.00000
18	Microsoft Windows Work Folder Service privilege escalation	7.3	7.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00	0.00043	CVE-2020-1094
19	IBM Security Guardium Database Activity Monitor sql injection	8.6	8.2	$5k-$25k	Obliczenie	Not Defined	Official Fix	0.00	0.00136	CVE-2016-0249

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	54.39.78.148	ip148.ip-54-39-78.net	IRGC	2022-09-14	verified	Wysoki
2	95.217.193.86	static.86.193.217.95.clients.your-server.de	IRGC	2022-09-14	verified	Wysoki
3	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	2022-09-14	verified	Wysoki
4	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	2022-09-14	verified	Wysoki
5	XXX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxx	2022-09-14	verified	Wysoki
6	XXX.XXX.XX.XXX	xxxxxx.xxx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxx	2022-09-14	verified	Wysoki
7	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	2022-09-14	verified	Wysoki
8	XXX.XXX.XXX.XXX		Xxxx	2022-09-14	verified	Wysoki
9	XXX.XX.XX.XXX	xxx-xx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	2022-09-14	verified	Wysoki
10	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	2022-09-14	verified	Wysoki

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1059	CWE-94	Argument Injection	predictive	Wysoki
2	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Wysoki
3	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
4	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
6	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
7	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (10)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/admin/users.php	predictive	Wysoki
2	File	data/gbconfiguration.dat	predictive	Wysoki
3	File	xxxxxxx/xxxxx.xxx	predictive	Wysoki
4	File	xxx/xxxxxx.xxx	predictive	Wysoki
5	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	Wysoki
6	File	xxxxxx.xxx	predictive	Medium
7	File	xxxx-xxxxxxxx.xxx	predictive	Wysoki
8	Argument	xxx	predictive	Niski
9	Argument	xxxxxxxx	predictive	Medium
10	Argument	xxxx xx	predictive	Niski

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Interested in the pricing of exploits?

See the underground prices here!