Bahamut Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (12)

Lang

en	6
de	6

Land

us	12

Skådespelare

Bahamut	2

Intressera

Typ

Not Defined	6
Content Management System	2
Chat Software	2
Router Operating System	2

Säljare

Not Defined	4
EdgeMAX	2
Itech	2
Phpheaven	2
Cisco	2

Produkt

SPIP	2
EdgeMAX EdgeSwitch	2
Itech Dating Script	2
Phpheaven PHPMyChat	2
Cisco Linksys EA2700	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	EdgeMAX EdgeSwitch privilegier eskalering	8.0	7.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00123	0.02	CVE-2019-5446
2	EdgeMAX EdgeSwitch HTTP Interface privilegier eskalering	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00402	0.03	CVE-2020-8233
3	Parallels Plesk Panel Administration Panel login_up.php3 informationsgivning	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00302	0.00	CVE-2011-4728
4	Parallels Plesk Panel Control Panel login_up.php3 svag kryptering	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.00226	0.02	CVE-2011-4736
5	SPIP spip_pass.php3 cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.04
6	MyPhPim Login Page calendar.php3 sql injektion	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.19924	0.00	CVE-2006-0167
7	Phpheaven PHPMyChat start_page.css.php3 cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00265	0.00	CVE-2005-1619
8	NullSoft WinAmp FLV File minneskorruption	6.8	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00044	0.00	CVE-2017-10725
9	Cisco Linksys EA2700 URL informationsgivning	4.3	4.1	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.08
10	Dating Script see_more_details.php sql injektion	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
11	Itech Dating Script see_more_details.php sql injektion	7.5	7.2	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00391	0.09	CVE-2017-20135
12	Maran PHP Shop prod.php sql injektion	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.03	CVE-2008-4879

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	104.21.10.79		Bahamut	05/03/2024	verified	Hög
2	XXX.XXX.XXX.XXX	xxx-xxxxxxxxx-x.xxx-xxx.xxx	Xxxxxxx	11/12/2023	verified	Hög
3	XXX.XXX.XXX.XXX	xxx-xxxxxxxxx-x.xxx-xxx.xxx	Xxxxxxx	30/01/2024	verified	Hög
4	XXX.XX.XXX.XX		Xxxxxxx	05/03/2024	verified	Hög

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	Hög
2	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
3	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Hög
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
5	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Hög

IOA - Indicator of Attack (10)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/see_more_details.php	predictive	Hög
2	File	calendar.php3	predictive	Hög
3	File	xxxxx_xx.xxxx	predictive	Hög
4	File	xxxx.xxx	predictive	Medium
5	File	xxxx_xxxx.xxxx	predictive	Hög
6	File	xxxxx_xxxx.xxx.xxxx	predictive	Hög
7	Argument	xxx_xx	predictive	Låg
8	Argument	xxx	predictive	Låg
9	Argument	xxxxxxxx	predictive	Medium
10	Argument	xx	predictive	Låg

Referenser (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Do you need the next level of professionalism?

Upgrade your account now!