TunnelVision Analiza

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (45)

Język

en	44
fr	2

Kraj

us	34
mx	8
br	2
gb	2

Aktorzy

TunnelVision	6
Mint Sandstorm	2
IcedID	1
AsyncRAT	1

Wysiłek

Rodzaj

Not Defined	10
Programming Language Software	4
Content Management System	4
Domain Name Software	2
WordPress Plugin	2

Sprzedawca

Not Defined	12
Microsoft	4
D-Link	2
SourceCodester	2
DZCP	2

Produkt

D-Link DNR-320L	2
D-Link DNS-320LW	2
D-Link DNR-322L	2
D-Link DNR-326	2
D-Link DNS-327L	2

Luki w zabezpieczeniach

#	Słaby punkt	Base	Temp	0day	Dzisiaj	Wyk	Prz	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	SAP NetWeaver MigrationService privilege escalation	9.2	9.2	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00077	0.02	CVE-2021-21481
3	WordPress cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00364	0.02	CVE-2022-21662
4	WordPress WP_Query sql injection	6.3	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.93536	0.04	CVE-2022-21661
5	Microsoft Windows RDP privilege escalation	8.8	7.7	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00121	0.00	CVE-2021-1669
6	DZCP deV!L`z Clanportal config.php privilege escalation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.72	CVE-2010-0966
7	SourceCodester Petrol Pump Management Software service_crud.php privilege escalation	4.7	4.5	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.08	CVE-2024-2059
8	Cacti Request Parameter remote_agent.php privilege escalation	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96528	0.00	CVE-2022-46169
9	All in One SEO Plugin REST API Endpoint privilege escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02407	0.02	CVE-2021-25036
10	YITH WooCommerce Gift Cards Premium Plugin Shopping Cart php privilege escalation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.13451	0.00	CVE-2021-3120
11	WordPress wp-publications Plugin Archive bibtexbrowser.php directory traversal	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00529	0.03	CVE-2021-38360
12	WP Import Export Plugin class-wpie-general.php wpie_process_file_download privilege escalation	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00161	0.00	CVE-2022-0236
13	Cisco Small Business RV345 memory corruption	9.9	9.7	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.96250	0.04	CVE-2022-20699
14	WordPress Object privilege escalation	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00432	0.04	CVE-2022-21663
15	Oracle GlassFish Open Source Edition Demo Feature weak authentication	8.5	8.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00187	0.03	CVE-2018-14324
16	Microsoft Exchange Server Privilege Escalation	8.8	8.1	$25k-$100k	$0-$5k	Unproven	Official Fix	0.96514	0.04	CVE-2021-42321
17	F5 BIG-IP TMUI Privilege Escalation	8.8	8.4	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00159	0.00	CVE-2021-22988
18	Microsoft SharePoint Server Privilege Escalation	8.8	7.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.28292	0.00	CVE-2021-31181
19	Umbraco CMS Installation directory traversal	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00371	0.06	CVE-2020-5811
20	Dnsmasq helper.c create_helper information disclosure	3.7	3.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00347	0.00	CVE-2019-14834

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adres IP	Hostname	Aktor	Identified	Rodzaj	Pewność siebie
1	51.89.135.142	ip142.ip-51-89-135.eu	TunnelVision	2022-02-25	verified	Wysoki
2	51.89.169.198	ip198.ip-51-89-169.eu	TunnelVision	2022-02-25	verified	Wysoki
3	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxxxxxxxxxxx	2022-02-25	verified	Wysoki
4	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxxxxxxxxxxx	2022-02-25	verified	Wysoki
5	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xxx	Xxxxxxxxxxxx	2022-02-25	verified	Wysoki
6	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xxx	Xxxxxxxxxxxx	2022-02-25	verified	Wysoki
7	XXX.XX.XXX.X		Xxxxxxxxxxxx	2022-02-25	verified	Wysoki

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Luki w zabezpieczeniach	Wektor dostępu	Rodzaj	Pewność siebie
1	T1006	CWE-22	Path Traversal	predictive	Wysoki
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Wysoki
3	TXXXX	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	Wysoki
4	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Wysoki
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Wysoki
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Wysoki
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Wysoki
8	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	Wysoki
9	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Wysoki
10	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Wysoki

IOA - Indicator of Attack (33)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasa	Indicator	Rodzaj	Pewność siebie
1	File	/admin/app/service_crud.php	predictive	Wysoki
2	File	/cgi-bin/user/Config.cgi	predictive	Wysoki
3	File	/etc/sudoers	predictive	Medium
4	File	/src/helper.c	predictive	Wysoki
5	File	xxxxx.xxx/xxxx/xxx/xxxxx/	predictive	Wysoki
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	Wysoki
7	File	xxxxxx.xxx	predictive	Medium
8	File	xxx/xxxxxx.xxx	predictive	Wysoki
9	File	xxxxx_xxx.xxx	predictive	Wysoki
10	File	xxx	predictive	Niski
11	File	xxxx.xxx	predictive	Medium
12	File	xxxxxxxxx.xxx	predictive	Wysoki
13	File	xxxxxx_xxxxx.xxx	predictive	Wysoki
14	File	xxxx.xxx	predictive	Medium
15	File	xxxxxx/xxxxx.xxx/xxxx/xxxx	predictive	Wysoki
16	File	xxxxxxxxx.xxx	predictive	Wysoki
17	File	xxxxxx/xxxxx/xxxx_xxx.xxx	predictive	Wysoki
18	File	~/xxxxxxxxxxxxx.xxx	predictive	Wysoki
19	File	~/xxxxxxxx/xxxxxxx/xxxxx-xxxx-xxxxxxx.xxx	predictive	Wysoki
20	Argument	xxxxxxxx	predictive	Medium
21	Argument	xxx	predictive	Niski
22	Argument	xxxx/xxxxxxx	predictive	Medium
23	Argument	xxxx_xx	predictive	Niski
24	Argument	xxxxxxxx	predictive	Medium
25	Argument	xxxx	predictive	Niski
26	Argument	xxxxx	predictive	Niski
27	Argument	xxxxxxx	predictive	Niski
28	Argument	x_xxxx	predictive	Niski
29	Argument	xxxxx_xx	predictive	Medium
30	Argument	xxxxxxxx	predictive	Medium
31	Input Value	xxxxxx=xxx&xxxxxxxx=xxxxxxx.*	predictive	Wysoki
32	Input Value	xxxxx	predictive	Niski
33	Input Value	xxxxxxxxx xxxxx	predictive	Wysoki

Referencje (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PoprzedniPrzeglądKolejny ▸

Interested in the pricing of exploits?

See the underground prices here!