Anatsa Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (17)

Lang

ru	8
de	4
en	4
zh	2

Land

us	6
ru	4
gb	4
cn	2
tr	2

Skådespelare

RecordBreaker	1
Elephant	1
Raccoon	1
FIN7	1
Vidar	1

Intressera

Typ

Not Defined	6
Groupware Software	4
Router Operating System	2
Operating System	2
Unified Communication Software	2

Säljare

Microsoft	8
TP-LINK	4
Not Defined	2
Swagger	2
Malwarebytes	2

Produkt

Microsoft Exchange Server	4
TP-LINK TL-WR840N	2
TP-LINK TL-WR841N	2
JAI-EXT	2
Microsoft Windows	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Google Chrome V8 minneskorruption	7.5	7.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00080	0.04	CVE-2024-0517
2	Microsoft Windows Kerberos Remote Code Execution	8.1	7.4	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00309	0.02	CVE-2023-28244
3	OpenVPN Access Server Authentication Token privilegier eskalering	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00202	0.00	CVE-2020-36382
4	Vesta Control Panel/myVesta UploadHandler.php privilegier eskalering	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02028	0.00	CVE-2021-28379
5	JAI-EXT Janino privilegier eskalering	8.6	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.82170	0.00	CVE-2022-24816
6	Swagger UI URL informationsgivning	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00265	0.04	CVE-2018-25031
7	John G. Myers mpack munpack minneskorruption	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01203	0.00	CVE-2002-1424
8	Squid Proxy HTTP Header privilegier eskalering	5.4	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00248	0.00	CVE-2015-0881
9	WordPress sql injektion	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.03	CVE-2022-21664
10	Microsoft Exchange Server PowerShell ProxyNotShell Privilege Escalation	7.7	7.3	$5k-$25k	$0-$5k	High	Official Fix	0.11506	0.03	CVE-2022-41082
11	Microsoft Exchange Server ProxyNotShell privilegier eskalering	7.5	7.5	$25k-$100k	$0-$5k	High	Workaround	0.96644	0.04	CVE-2022-41040
12	Laravel PendingBroadcast.php dispatch privilegier eskalering	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00049	0.02	CVE-2022-30778
13	TP-LINK Archer C5 Configuration File privilegier eskalering	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00414	0.00	CVE-2018-19537
14	TP-LINK TL-WR840N/TL-WR841N Session svag autentisering	8.5	7.5	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.30057	0.07	CVE-2018-11714
15	Malwarebytes Anti-Malware Driver FARFLT.SYS privilegier eskalering	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2018-5279
16	Apache HTTP Server mod_mime minneskorruption	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00643	0.00	CVE-2017-7679
17	Microsoft Skype for Business Remote Code Execution	7.0	6.7	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.09311	0.00	CVE-2017-0281

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	91.242.229.85	vm289569.pq.hosting	Anatsa	23/02/2022	verified	Hög
2	XXX.XX.XX.XXX	xxxxxx.xx.xxxxxxxxx.xxx	Xxxxxx	23/02/2022	verified	Hög
3	XXX.XXX.XX.XX	xxxxxx.xx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxx	23/02/2022	verified	Hög
4	XXX.XXX.XX.XX	xxxxxx.xx.xx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxx	23/02/2022	verified	Hög

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Hög
2	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Hög
3	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
4	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Hög

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	Illuminate\Broadcasting\PendingBroadcast.php	predictive	Hög
2	File	xxx/xxxxxx/xxxxxxxxxxxxx.xxx	predictive	Hög
3	Library	xxxxxx.xxx	predictive	Medium
4	Argument	xxx_xxx_xxxxxxxx	predictive	Hög

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Interested in the pricing of exploits?

See the underground prices here!