SpeakUp Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (109)

Język

en	104
de	2
fr	2
pl	2

Kraj

us	28
cn	8
ie	4
nl	4
pl	2

Aktorzy

SpeakUp	3
Cobalt Strike	2
Agrius	1
Bashlite	1
Mirai	1

Wysiłek

Rodzaj

Not Defined	46
Smartphone Operating System	6
Operating System	6
WordPress Plugin	6
Bug Tracking Software	4

Sprzedawca

Not Defined	46
Microsoft	8
Apple	4
Reolink	4
Google	2

Produkt

Microsoft Windows	6
Apple iOS	4
Reolink RLC-410W	4
Google Android	2
Host	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
2	Rittal PDU-3C002DEC/CMCIII-PU-9333E0FB privilege escalation	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00171	CVE-2020-11953
3	SmarterTools SmarterMail Email Stored cross site scripting	5.2	4.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00084	CVE-2019-7211
4	Backdoor.Win32.Psychward.b Service Port 8888 weak authentication	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.04	0.00000
5	Echelon SmartServer 1/SmartServer 2/i.LON 100/i.LON 600 weak authentication	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00205	CVE-2018-8859
6	Cybozu Garoon privilege escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00082	CVE-2022-27661
7	GitLab Community Edition/Enterprise Edition Rrunner Jobs API privilege escalation	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00081	CVE-2022-2227
8	Barco TransForm N Control Room Management Suite Web Application cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00078	CVE-2022-26974
9	BigBlueButton Chat Message information disclosure	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00069	CVE-2022-29232
10	wolfSSL BASE64 PEM File Decoding information disclosure	2.2	2.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00063	CVE-2021-24116
11	Google Go IP Address net.ParseCIDR privilege escalation	7.3	7.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00208	CVE-2021-29923
12	Camunda Modeler IPC Message writeFile privilege escalation	7.0	7.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00871	CVE-2021-28154
13	cocoapods-downloader privilege escalation	6.8	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00131	CVE-2022-21223
14	Deno privilege escalation	8.6	8.5	$0-$5k	Obliczenie	Not Defined	Official Fix	0.00	0.00197	CVE-2022-24783
15	Rockwell Automation ISaGRAF Runtime privilege escalation	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00045	CVE-2020-25184
16	Cost Calculator Plugin Cost Calculator Post's Layout directory traversal	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00065	CVE-2021-24820
17	Zabbix SAML weak authentication	8.2	8.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.97186	CVE-2022-23131
18	Shared Groovy Libraries Plugin privilege escalation	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00104	CVE-2022-25183
19	Sangoma Corporation Switchvox privilege escalation	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00109	CVE-2021-45310
20	Samsung Smartphone Edge Panel information disclosure	2.7	2.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00047	CVE-2022-24001

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	5.2.73.127		SpeakUp	2022-02-12	verified	Wysoki
2	X.XXX.XX.XX	xxxxxxxx.xxxxxxx.xxx	Xxxxxxx	2022-02-12	verified	Wysoki
3	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxxxx.xxx	Xxxxxxx	2022-02-12	verified	Wysoki
4	XXX.XX.XXX.XXX		Xxxxxxx	2022-02-12	verified	Wysoki
5	XXX.XX.XXX.XXX	xxx.xxxxx.xx	Xxxxxxx	2022-02-12	verified	Wysoki

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CWE-21, CWE-22	Path Traversal	predictive	Wysoki
2	T1059	CWE-88, CWE-94	Argument Injection	predictive	Wysoki
3	T1059.007	CWE-79	Cross Site Scripting	predictive	Wysoki
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
5	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Wysoki
6	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Wysoki
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	Wysoki
8	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	Wysoki
9	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Wysoki
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Wysoki
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
13	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
14	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Wysoki
15	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (34)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/cgi-bin/kerbynet	predictive	Wysoki
2	File	/damicms-master/admin.php?s=/Article/doedit	predictive	Wysoki
3	File	/etc/quagga	predictive	Medium
4	File	/main?cmd=invalid_browser	predictive	Wysoki
5	File	backend/upcean.c	predictive	Wysoki
6	File	xxxxxxxxx.xxx	predictive	Wysoki
7	File	xxxxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	Wysoki
8	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Wysoki
9	File	xxxx-xxxxxxxx-xxxxxx.xxx	predictive	Wysoki
10	File	xxxx/xxxx_xxxxxxxx_xxx/xxx_xxxx	predictive	Wysoki
11	File	xxxxxxxxx.xxx	predictive	Wysoki
12	File	xx_xxx_xx.x	predictive	Medium
13	File	xxx/xxxxx/xxxx-xxxxxxxx.xxx	predictive	Wysoki
14	File	xxxxx.xxx	predictive	Medium
15	File	xxxxxxx.xxx	predictive	Medium
16	File	xxxxxxx.xxx	predictive	Medium
17	File	xxxx/xxxxxxxxxxxxxx.xxxx	predictive	Wysoki
18	File	xxxxxxx:xxxxxxxxxxxxxxxx	predictive	Wysoki
19	File	xx_xxxx/xx/	predictive	Medium
20	File	xxxx.xxx	predictive	Medium
21	File	xxxxxxx	predictive	Niski
22	Library	xxxxxxxxxx.xxx	predictive	Wysoki
23	Argument	xxx	predictive	Niski
24	Argument	xxxxxxxxxxxxxxx	predictive	Wysoki
25	Argument	xxxxxxxxxxxx	predictive	Medium
26	Argument	xxxxxx	predictive	Niski
27	Argument	xxxxxx_xxxxx_xxx	predictive	Wysoki
28	Argument	xx	predictive	Niski
29	Argument	xx	predictive	Niski
30	Argument	xxxx xxxxx	predictive	Medium
31	Argument	xxxxxxxxxxxxxxxxxxx	predictive	Wysoki
32	Argument	xxxxxxx	predictive	Niski
33	Argument	xxxx	predictive	Niski
34	Input Value	%xx%xxxxx%xx/xxx/xxxxxx%xx%xx	predictive	Wysoki

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!