Windigo Анализ

IOB - Indicator of Behavior (12)

Временная шкала

Язык

en10
de2

Страна

Акторы

Деятельность

Интерес

Временная шкала

Тип

Поставщик

Продукт

F5 BIG-IP2
AXIS 2110 Network Camera2
Zend Framework2
Interspire Email Marketer2
PHP2

Уязвимости

#УязвимостиBaseTemp0dayСегодняЭ�RemEPSSCTICVE
1Microsoft IIS IP/Domain Restriction эскалация привилегий6.55.7$25k-$100k$0-$5kUnprovenOfficial Fix0.008170.14CVE-2014-4078
2AXIS 2110 Network Camera virtualinput.cgi эскалация привилегий7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.056840.02CVE-2004-2425
3Adobe ColdFusion раскрытие информации3.73.6$0-$5k$0-$5kHighOfficial Fix0.966340.38CVE-2013-0631
4Adobe ColdFusion эскалация привилегий8.58.4$0-$5k$0-$5kHighOfficial Fix0.974360.00CVE-2018-15961
5MODX Revolution Access Control phpthumb эскалация привилегий5.95.7$0-$5k$0-$5kHighOfficial Fix0.623920.02CVE-2018-1000207
6Microsoft IIS межсайтовый скриптинг5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.14CVE-2017-0055
7Interspire Email Marketer Cookie init.php слабая аутентификация8.57.7$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.208010.03CVE-2017-14322
81st News 4 Professional products.php sql-инъекция7.37.3$0-$5k$0-$5kHighUnavailable0.000870.04CVE-2008-4890
9Zend Framework Zend_Db_Select sql-инъекция8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.019220.02CVE-2016-6233
10F5 BIG-IP REST Authentication Timeout restjavad.0.log Log раскрытие информации4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2016-6249
11PHP wddx_deserialize повреждение памяти9.89.6$25k-$100k$0-$5kNot DefinedOfficial Fix0.017040.02CVE-2016-7413

Кампании (1)

These are the campaigns that can be associated with the actor:

  • Windigo

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-адресHostnameАкторКампанииIdentifiedТипУверенность
177.67.80.31WindigoWindigo31.05.2021verifiedВысокий
2XX.XXX.XX.Xxxxxxxxx.xxxxxxxxxxxx.xxxXxxxxxxXxxxxxx31.05.2021verifiedВысокий
3XX.XX.XXX.XXxxxxxxxx.xx-xx-xx-xxx.xxXxxxxxxXxxxxxx31.05.2021verifiedВысокий

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueКлассУязвимостиВектор доступаТипУверенность
1CAPEC-10CWE-119, CWE-287, CWE-416Unknown VulnerabilitypredictiveВысокий
2T1059.007CAPEC-10CWE-74, CWE-79, CWE-707Cross Site ScriptingpredictiveВысокий
3TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveВысокий
4TXXXXCAPEC-10CWE-XX, CWE-XX, CWE-XXXXxx XxxxxxxxxpredictiveВысокий
5TXXXXCAPEC-116CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveВысокий
6TXXXX.XXXCAPEC-19CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveВысокий

IOA - Indicator of Attack (8)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDКлассIndicatorТипУверенность
1File/uncpath/predictiveСредний
2File/var/log/restjavad.0.logpredictiveВысокий
3Filexxxx.xxxpredictiveСредний
4Filexxxxxxxx.xxxpredictiveСредний
5Filexxxxxxxxxxxx.xxxpredictiveВысокий
6ArgumentxxpredictiveНизкий
7Argumentxxx_xxxxxxxxxxxpredictiveВысокий
8Input Value[\x]*predictiveНизкий

Ссылки (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!