Amnesia Analys

IOB - Indicator of Behavior (16)

Tidslinje

Lang

en16

Land

Skådespelare

Aktiviteter

Intressera

Tidslinje

Typ

Säljare

Produkt

PRTG Network Monitor2
GLPI2
Rocket.Chat Server2
Crocoblock JetEngine2
Yoast SEO Plugin2

Sårbarheter

#SårbarhetBaseTemp0dayI dagUtnRemEPSSCTICVE
1WordPress Post press-this.php privilegier eskalering5.55.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.000540.03CVE-2011-1762
2Elementor Website Builder Plugin AJAX Action module.php privilegier eskalering7.57.4$0-$5k$0-$5kNot DefinedNot Defined0.961970.02CVE-2022-1329
3Crocoblock JetEngine Form Data Privilege Escalation5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.002010.00CVE-2021-41844
4Crocoblock JetEngine Custom Forms cross site scripting3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000660.00CVE-2021-38607
5WPBakery XSS Protection Mechanism kses_remove_filters privilegier eskalering5.95.6$0-$5k$0-$5kNot DefinedOfficial Fix0.000580.02CVE-2020-28650
6Yoast SEO Plugin Term Description privilegier eskalering9.08.9$0-$5k$0-$5kNot DefinedOfficial Fix0.002440.02CVE-2019-13478
7Rocket.Chat Server NoSQL sql injektion8.58.3$0-$5k$0-$5kNot DefinedOfficial Fix0.003690.04CVE-2017-1000493
8vBulletin moderation.php sql injektion7.37.0$0-$5k$0-$5kHighOfficial Fix0.002840.01CVE-2016-6195
9PRTG Network Monitor addusers privilegier eskalering7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000930.00CVE-2018-19411
10PRTG Network Monitor login.htm privilegier eskalering8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.002880.04CVE-2018-19410
11Samba smbd _netr_ServerPasswordSet okänd sårbarhet6.55.7$0-$5k$0-$5kHighOfficial Fix0.974000.00CVE-2015-0240
12OpenSSH Authentication Username informationsgivning5.34.8$5k-$25k$0-$5kHighOfficial Fix0.107370.19CVE-2016-6210
13QNAP Music Station privilegier eskalering8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.002740.00CVE-2017-13069
14QNAP NAS cgi.cgi minneskorruption5.95.4$0-$5k$0-$5kProof-of-ConceptUnavailable0.000000.05
15Download Manager Redirect6.25.9$0-$5k$0-$5kNot DefinedOfficial Fix0.002330.00CVE-2017-2217
16GLPI informationsgivning5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.007030.00CVE-2011-2720

Kampanjer (1)

These are the campaigns that can be associated with the actor:

  • TVT Digital DVR Devices

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-adressHostnameSkådespelareKampanjerIdentifiedTypFörtroende
193.174.95.38AmnesiaTVT Digital DVR Devices30/08/2021verifiedHög

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (8)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlassIndicatorTypFörtroende
1File/api/adduserspredictiveHög
2File/home/httpd/cgi-bin/cgi.cgipredictiveHög
3File/xxxxxx/xxxxx.xxxpredictiveHög
4Filexxxxxxxxxxx/xxxxxxxx/xxxxxxxxxx.xxxpredictiveHög
5Filexx-xxxxx/xxxxx-xxxx.xxxpredictiveHög
6File~/xxxx/xxx/xxxxxxx/xxxxxxxxxx/xxxxxx.xxxpredictiveHög
7ArgumentxxxxxxxxpredictiveMedium
8ArgumentxxxxxxxpredictiveLåg

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!