DragonSpark Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (25)

Idioma

zh	14
en	8
ja	4

País

cn	22
us	4

Actores

Indexsinas	1
Calypso	1
DragonSpark	1
Cobalt Strike	1
Meterpreter	1

Interesse

Tipo

Not Defined	10
Content Management System	6
Router Operating System	4
Anti-Malware Software	2

Fabricante

Not Defined	12
Linksys	2
Joomla	2
DJI	2
Symantec	2

Produto

Linksys Router	2
Joomla CMS	2
DJI Drone	2
Symantec Endpoint Protection	2
Laravel	2

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	Redis Lua direitos alargados	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.97053	0.00	CVE-2022-0543
2	OpenVPN Access Server LDAP Fraca autenticação	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00430	0.04	CVE-2020-8953
3	EmbedThis HTTP Library/Appweb httpLib.c authCondition Fraca autenticação	7.7	7.5	$0-$5k	$0-$5k	High	Official Fix	0.00927	0.04	CVE-2018-8715
4	Zendesk Support Plugin Falsificação de Pedido Cross Site	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00	CVE-2023-23716
5	Netty vulnerabilidade desconhecida	6.5	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00167	0.02	CVE-2022-41915
6	Pureftpd pure-FTPd Directório Traversal	5.1	5.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.02	CVE-2011-3171
7	DJI Drone AeroScope Protocol Divulgação de Informação	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00115	0.04	CVE-2022-29945
8	Oracle MySQL Server Privileges Negação de Serviço	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00564	0.04	CVE-2018-2696
9	Linksys Router Fraca autenticação	9.8	9.6	$0-$5k	$0-$5k	High	Workaround	0.00042	0.02	CVE-1999-0508
10	Cisco Linksys Router direitos alargados	8.5	7.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.32333	0.03	CVE-2013-5122
11	Asus RT-AC68U/RT-AC5300 blocking_request.cgi Excesso de tampão	5.5	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00385	0.02	CVE-2021-45756
12	Laravel FileCookieJar.php direitos alargados	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.04	CVE-2022-30779
13	Watchguard Firebox/XTM Remote Code Execution	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.84170	0.03	CVE-2022-26318
14	Joomla CMS Login Injecção SQL	9.8	9.8	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00194	0.00	CVE-2006-1047
15	Joomla Fraca autenticação	6.3	6.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00201	0.04	CVE-2022-23795
16	Grafana Labs Permission Fraca autenticação	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.97240	0.04	CVE-2021-39226
17	Grafana Directório Traversal	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.97474	0.02	CVE-2021-43798
18	WordPress Injecção SQL	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.04	CVE-2022-21664
19	WordPress WP_Query Injecção SQL	6.3	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.93536	0.07	CVE-2022-21661
20	Filter Portfolio Gallery Plugin Gallery Delete Falsificação de Pedido Cross Site	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00062	0.00	CVE-2021-24795

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Actor	Identified	Tipo	Aceitação
1	43.129.227.159	DragonSpark	31/01/2023	verified	Alto
2	XXX.XX.XX.XXX	Xxxxxxxxxxx	31/01/2023	verified	Alto
3	XXX.XXX.XXX.XXX	Xxxxxxxxxxx	31/01/2023	verified	Alto
4	XXX.XXX.XXX.XXX	Xxxxxxxxxxx	31/01/2023	verified	Alto

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1068		CWE-264	Execution with Unnecessary Privileges	predictive	Alto
3	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
4	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
5	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	Alto
6	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	Alto

IOA - Indicator of Attack (5)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	/public/plugins/	predictive	Alto
2	File	blocking_request.cgi	predictive	Alto
3	File	xxxxxxxxxx\xxxxxx\xxxxxxxxxxxxx.xxx	predictive	Alto
4	Library	xxxx/xxxxxxx.x	predictive	Alto
5	Network Port	xxx/xxxx (xx-xxx)	predictive	Alto

Referências (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Do you know our Splunk app?

Download it now for free!