Gorgon Group Analys

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (13)

Lang

en	14

Land

pk	14

Skådespelare

NjRAT	1

Intressera

Typ

Not Defined	6
Web Server	4
Programming Language Software	2

Säljare

Not Defined	6
MailCleaner	2
Apache	2
Microsoft	2

Produkt

ROCBOSS	2
MailCleaner Community Edition	2
portable SDK for UPnP	2
Apache HTTP Server	2
PHP	2

Sårbarheter

#	Sårbarhet	Base	Temp	0day	I dag	Utn	Rem	EPSS	CTI	CVE
1	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.24	CVE-2017-0055
2	Microsoft Azure IoT Edge/Hub Device Client SDK for Azure IoT MQTT Object minneskorruption	6.9	6.8	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.04729	0.00	CVE-2018-8531
3	PHP GD Extension imagewebp privilegier eskalering	5.3	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00544	0.02	CVE-2014-5120
4	Microsoft Windows Phone SMS Service svag kryptering	5.3	4.9	$5k-$25k	$5k-$25k	Unproven	Unavailable	0.05804	0.00	CVE-2012-2993
5	Apache HTTP Server ap_some_auth_required privilegier eskalering	3.7	3.2	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00522	0.04	CVE-2015-3185
6	MailCleaner Community Edition Logs.php privilegier eskalering	7.5	7.5	$0-$5k	$0-$5k	High	Not Defined	0.38848	0.00	CVE-2018-20323
7	ROCBOSS POST Request PostController.php doReward sql injektion	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00212	0.03	CVE-2019-11362
8	portable SDK for UPnP unique_service_name minneskorruption	10.0	9.5	$0-$5k	$0-$5k	High	Official Fix	0.97445	0.00	CVE-2012-5958
9	Microsoft IIS IP/Domain Restriction privilegier eskalering	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.24	CVE-2014-4078
10	Microsoft IIS File Name Tilde privilegier eskalering	6.5	5.9	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.96817	0.04	CVE-2005-4360
11	FiberHome VDSL2 Modem HG 150-UB svag autentisering	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00369	0.03	CVE-2018-9249

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-adress	Hostname	Skådespelare	Kampanjer	Identified	Typ	Förtroende
1	115.186.136.237	115-186-136-237.nayatel.pk	Gorgon Group		17/12/2020	verified	Hög

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klass	Sårbarheter	Åtkomstvektor	Typ	Förtroende
1		CAPEC-10	CWE-20, CWE-119, CWE-287	Unknown Vulnerability	predictive	Hög
2	T1059.007	CAPEC-10	CWE-74, CWE-79, CWE-707	Cross Site Scripting	predictive	Hög
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Hög
4	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Hög
5	TXXXX	CAPEC-10	CWE-XX, CWE-XX, CWE-XXX	Xxx Xxxxxxxxx	predictive	Hög
6	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Hög

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klass	Indicator	Typ	Förtroende
1	File	/uncpath/	predictive	Medium
2	File	app/controllers/frontend/PostController.php	predictive	Hög
3	File	xxx/xxxx/xxxxxxxxxxx/xxxxxx/xxxx.xxx	predictive	Hög
4	Argument	xxxxx	predictive	Låg
5	Input Value	%xx	predictive	Låg
6	Input Value	::$xxxxx_xxxxxxxxxx	predictive	Hög
7	Network Port	xxx xxxxxx xxxx	predictive	Hög

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ TidigareÖversiktNästa ▸

Interested in the pricing of exploits?

See the underground prices here!