CDRThief Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (10)

Lang

zh	6
en	4

Land

cn	10

Skådespelare

CDRThief	4

Intressera

Typ

Bug Tracking Software	2
Not Defined	2
Cloud Software	2
Wireless LAN Software	2
Printing Software	2

Säljare

Atlassian	2
Hotline	2
ownCloud	2
eEye	2
PrinterLogic	2

Produkt

Atlassian JIRA Server	2
Atlassian Data Center	2
Hotline Connect Server	2
ownCloud Server	2
eEye Retina WiFi Scanner	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Hotline Connect Server informationsgivning	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.00000	0.00
2	ownCloud Server Password Protected Public Links svag autentisering	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00074	0.00	CVE-2021-35948
3	ownCloud user_ldap privilegier eskalering	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00054	0.00	CVE-2021-40537
4	Atlassian JIRA Server/Data Center Endpoint web.xml kataloggenomgång	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.91900	0.03	CVE-2021-26086
5	Job and Node Ownership Plugin privilegier eskalering	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00055	0.00	CVE-2022-28151
6	PrinterLogic Web Stack svag kryptering	7.7	7.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.06463	0.00	CVE-2021-42635
7	eEye Retina WiFi Scanner minneskorruption	10.0	10.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.12680	0.00	CVE-2009-3859
8	PHP SoapClient query förnekande av tjänsten	6.4	6.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01231	0.00	CVE-2021-21702
9	Jitsi Meet svag autentisering	8.5	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00196	0.03	CVE-2020-11878
10	OpenSSH Key Exchange Initialization kex_input_kexinit förnekande av tjänsten	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.78351	0.01	CVE-2016-8858

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Identified	Typ	Förtroende
1	34.94.199.142	142.199.94.34.bc.googleusercontent.com	CDRThief	31/05/2021	verified	Medium
2	35.236.173.187	187.173.236.35.bc.googleusercontent.com	CDRThief	31/05/2021	verified	Medium
3	XXX.XX.XXX.XX		Xxxxxxxx	31/05/2021	verified	Hög
4	XXX.XXX.XXX.XXX		Xxxxxxxx	31/05/2021	verified	Hög
5	XXX.XXX.XXX.XXX		Xxxxxxxx	31/05/2021	verified	Hög
6	XXX.XXX.XX.XXX		Xxxxxxxx	31/05/2021	verified	Hög

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-119, CWE-285, CWE-384, CWE-399, CWE-404, CWE-476, CWE-862, CWE-863, CWE-918	Unknown Vulnerability	predictive	Hög
2	TXXXX	CAPEC-126	CWE-XX	Xxxx Xxxxxxxxx	predictive	Hög
3	TXXXX.XXX	CAPEC-191	CWE-XXX, CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Hög
4	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Hög
5	TXXXX.XXX	CAPEC-0	CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	Hög

IOA - Indicator of Attack (3)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/WEB-INF/web.xml	predictive	Hög
2	File	xxxxxxxx/xxxx_xxxx	predictive	Hög
3	Argument	xxx_xxx	predictive	Låg

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Do you need the next level of professionalism?

Upgrade your account now!