lightSpy Análise

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (64)

Idioma

en	40
zh	24

País

cn	38
us	26

Actores

Cobalt Strike	3
PlugX	2
APT41	2
Kuluoz	1
FF-Rat	1

Interesse

Tipo

Not Defined	26
Programming Language Software	4
Firewall Software	4
Operating System	4
Mail Server Software	2

Fabricante

Not Defined	26
Microsoft	4
Icecast	2
Alt-N	2
Xiph	2

Produto

PHP	4
Microsoft Windows	4
KeyCloak	4
Keycloak	2
Icecast ezstream	2

Vulnerabilidades

#	Vulnerabilidade	Base	Temp	0day	Hoje	Exp	Mas	EPSS	CTI	CVE
1	vsftpd deny_file vulnerabilidade desconhecida	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00312	0.12	CVE-2015-1419
2	Google Chrome V8 Remote Code Execution	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.24380	0.02	CVE-2020-16040
3	Synacor Zimbra Collaboration Suite WebEx Zimlet direitos alargados	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.70648	0.00	CVE-2020-7796
4	Cisco Unity Connection direitos alargados	8.1	8.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00127	0.06	CVE-2024-20272
5	Devilz Clanportal Injecção SQL	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00684	0.03	CVE-2006-6339
6	Ikuai Router OS webman.lua ActionLogin direitos alargados	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00803	0.00	CVE-2023-34849
7	Keycloak mTLS Authentication Fraca autenticação	4.6	4.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00086	0.04	CVE-2023-2422
8	KeyCloak Password Reset direitos alargados	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00293	0.00	CVE-2017-12161
9	ONLYOFFICE Document Server FontFileBase.h Excesso de tampão	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00211	0.00	CVE-2022-29777
10	ONLYOFFICE Server User Name direitos alargados	4.5	4.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00071	0.03	CVE-2021-43448
11	ONLYOFFICE Server Document Editor Service direitos alargados	6.8	6.5	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00100	0.04	CVE-2021-43449
12	ONLYOFFICE Document Server Example editor Roteiro Cruzado de Sítios	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00116	0.03	CVE-2022-24229
13	ONLYOFFICE Document Server WebSocket API Injecção SQL	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00174	0.00	CVE-2020-11537
14	ONLYOFFICE Server Document Editor Fraca autenticação	6.9	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00076	0.04	CVE-2021-43447
15	ONLYOFFICE Community Server UploadProgress.ashx direitos alargados	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00633	0.04	CVE-2023-34939
16	Microsoft Windows BitLocker Local Privilege Escalation	6.1	5.3	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00054	0.00	CVE-2021-38632
17	MyBatis PageHelper Injecção SQL	5.0	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00599	0.05	CVE-2022-28111
18	mingSoft MCMS IContentDao.xml Injecção SQL	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01610	0.04	CVE-2022-23898
19	Git Plugin Build direitos alargados	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01156	0.08	CVE-2022-36883
20	HelpSystems Cobalt Strike Roteiro Cruzado de Sítios	4.8	4.7	$0-$5k	$0-$5k	High	Official Fix	0.00767	0.04	CVE-2022-39197

Campanhas (1)

These are the campaigns that can be associated with the actor:

LightSpy

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	Endereço IP	Actor	Campanhas	Identified	Tipo	Aceitação
1	46.17.43.74	APT41	LightSpy	29/10/2023	verified	Alto
2	XXX.XX.XXX.XXX	Xxxxx	Xxxxxxxx	29/10/2023	verified	Alto
3	XXX.XX.XXX.XXX	Xxxxxxxx		16/04/2024	verified	Alto

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classificação	Vulnerabilidades	Tipo de acesso	Tipo	Aceitação
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Alto
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Alto
3	T1059	CAPEC-137	CWE-88, CWE-94	Argument Injection	predictive	Alto
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
5	TXXXX	CAPEC-58	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
6	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	Alto
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto
9	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
10	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
11	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto
12	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (30)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Tipo	Aceitação
1	File	/example/editor	predictive	Alto
2	File	admin/killsource	predictive	Alto
3	File	cgi-bin/webfile_mgr.cgi	predictive	Alto
4	File	data/gbconfiguration.dat	predictive	Alto
5	File	xxxxxxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxx/xxxxxxxxxxxx.x	predictive	Alto
6	File	xxxxxxxxxxx.xxx	predictive	Alto
7	File	xxx.xx	predictive	Baixo
8	File	xxxxx.xxx/xxxx/x/	predictive	Alto
9	File	xxxxxxx.x	predictive	Médio
10	File	xxx/xxxxxxxx.x	predictive	Alto
11	File	xxxxxxxxxxxxxx.xxxx	predictive	Alto
12	File	xxxxxx.xxx	predictive	Médio
13	File	xx-xxxxx/xxxxx.xxx?xxxx=xxxxxxxxx_xxxxxxxx_xxxxxxx&xxx=xxxxxxxx_xxxxx	predictive	Alto
14	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	Alto
15	Library	xxxxxxxxxxx.xxx	predictive	Alto
16	Argument	xxxxxxxxxx	predictive	Médio
17	Argument	xxxxxxx	predictive	Baixo
18	Argument	xxxxxxx	predictive	Baixo
19	Argument	xxxxx	predictive	Baixo
20	Argument	xxxx	predictive	Baixo
21	Argument	xx	predictive	Baixo
22	Argument	xxxxx	predictive	Baixo
23	Argument	xxxx	predictive	Baixo
24	Argument	xxxxxxx	predictive	Baixo
25	Argument	xxxxxxx	predictive	Baixo
26	Argument	xxxxxxxx	predictive	Médio
27	Argument	xxxx->xxxxxxx	predictive	Alto
28	Argument	_xxxxx	predictive	Baixo
29	Input Value	/xxxx.xxx	predictive	Médio
30	Input Value	{xxxxx:xx(xxxx($_xxx[x]))}x{/xxxxx:xx}	predictive	Alto

Referências (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ VoltarVisão GeralPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!