Gorgon Group Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (13)

Idioma

en	14

País

pk	14

Actores

NjRAT	1

Interesse

Tipo

Not Defined	6
Web Server	4
Cloud Software	2

Fabricante

Microsoft	4
Not Defined	4
Apache	2
FiberHome	2

Produto

Apache HTTP Server	2
Microsoft Azure IoT Edge	2
Microsoft Hub Device Client SDK for Azure IoT	2
portable SDK for UPnP	2
FiberHome VDSL2 Modem HG 150-UB	2

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	Microsoft IIS Roteiro Cruzado de Sítios	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.31	CVE-2017-0055
2	Microsoft Azure IoT Edge/Hub Device Client SDK for Azure IoT MQTT Object Excesso de tampão	6.9	6.8	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.04729	0.00	CVE-2018-8531
3	PHP GD Extension imagewebp direitos alargados	5.3	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00544	0.02	CVE-2014-5120
4	Microsoft Windows Phone SMS Service Encriptação fraca	5.3	4.9	$5k-$25k	$5k-$25k	Unproven	Unavailable	0.05804	0.00	CVE-2012-2993
5	Apache HTTP Server ap_some_auth_required direitos alargados	3.7	3.2	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00522	0.04	CVE-2015-3185
6	MailCleaner Community Edition Logs.php direitos alargados	7.5	7.5	$0-$5k	$0-$5k	High	Not Defined	0.38848	0.00	CVE-2018-20323
7	ROCBOSS POST Request PostController.php doReward Injecção SQL	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00212	0.03	CVE-2019-11362
8	portable SDK for UPnP unique_service_name Excesso de tampão	10.0	9.5	$0-$5k	$0-$5k	High	Official Fix	0.97445	0.00	CVE-2012-5958
9	Microsoft IIS IP/Domain Restriction direitos alargados	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.44	CVE-2014-4078
10	Microsoft IIS File Name Tilde direitos alargados	6.5	5.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.96817	0.04	CVE-2005-4360
11	FiberHome VDSL2 Modem HG 150-UB Fraca autenticação	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00369	0.03	CVE-2018-9249

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Hostname	Actor	Campanhas	Identified	Tipo	Aceitação
1	115.186.136.237	115-186-136-237.nayatel.pk	Gorgon Group		17/12/2020	verified	Alto

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	Alto
2	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
3	TXXXX	CAPEC-108	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Alto

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	/uncpath/	predictive	Médio
2	File	app/controllers/frontend/PostController.php	predictive	Alto
3	File	xxx/xxxx/xxxxxxxxxxx/xxxxxx/xxxx.xxx	predictive	Alto
4	Argument	xxxxx	predictive	Baixo
5	Input Value	%xx	predictive	Baixo
6	Input Value	::$xxxxx_xxxxxxxxxx	predictive	Alto
7	Network Port	xxx xxxxxx xxxx	predictive	Alto

Referências (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!