Nukesped Analys

IOB - Indicator of Behavior (1000)

Tidslinje

Lang

en630
zh352
ja6
sv4
de2

Land

hk968
us12
cn6
gb2
ua2

Skådespelare

Aktiviteter

Intressera

Tidslinje

Typ

Säljare

Produkt

Google Chrome62
Microsoft Windows38
Tuxera ntfs-3g26
Apache HTTP Server14
Microsoft Exchange Server12

Sårbarheter

#SårbarhetBaseTemp0dayI dagUtnRemEPSSCTICVE
1nginx privilegier eskalering6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002413.14CVE-2020-12440
2Apple iOS/iPadOS IOSurfaceAccelerator minneskorruption8.28.0$25k-$100k$5k-$25kHighOfficial Fix0.003230.04CVE-2023-28206
3D-Link DIR-645 Interface Wireless privilegier eskalering9.89.4$5k-$25k$0-$5kHighOfficial Fix0.971380.21CVE-2015-2051
4Symantec Gateway ipchange.php exec privilegier eskalering8.88.4$5k-$25k$0-$5kHighOfficial Fix0.973480.02CVE-2012-0297
5Fortinet FortiOS/FortiProxy Administrative Interface svag autentisering9.89.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.971690.00CVE-2022-40684
6Palo Alto PAN-OS GlobalProtect Portal minneskorruption9.89.6$0-$5k$0-$5kNot DefinedOfficial Fix0.002340.03CVE-2021-3064
7NVIDIA Omniverse Kit Create/Audio2Face/Isaac Sim/View/Code/Machinima privilegier eskalering8.38.3$0-$5k$0-$5kNot DefinedNot Defined0.000700.04CVE-2022-42268
8Oracle Banking Digital Experience Framework Remote Code Execution8.38.1$25k-$100k$0-$5kNot DefinedOfficial Fix0.013160.00CVE-2021-2351
9Apache HTTP Server mod_proxy privilegier eskalering7.36.4$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.964970.04CVE-2014-0117
10Fortinet FortiOS sslvpnd minneskorruption9.89.3$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.418830.00CVE-2022-42475
11Apache Ambari kataloggenomgång6.56.5$5k-$25k$5k-$25kNot DefinedNot Defined0.001410.04CVE-2020-13924
12OpenSSL AES OCB Mode svag kryptering5.65.5$5k-$25k$0-$5kNot DefinedOfficial Fix0.003630.00CVE-2022-2097
13Cisco ASA/Firepower Threat Defense DNS Inspection förnekande av tjänsten8.07.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.001370.00CVE-2022-20760
14Apple iOS/iPadOS Kernel minneskorruption7.87.5$25k-$100k$5k-$25kHighOfficial Fix0.000620.02CVE-2022-32917
15Microsoft Windows Support Diagnostic Tool Follina Remote Code Execution7.37.1$25k-$100k$0-$5kHighWorkaround0.971410.00CVE-2022-30190
16Apache Log4j Incomplete Fix CVE-2021-44228 privilegier eskalering4.54.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.973630.02CVE-2021-45046
17Google Chrome Profiles minneskorruption7.57.4$25k-$100k$5k-$25kNot DefinedOfficial Fix0.002360.04CVE-2023-5472
18IEEE 802.11 Packet Routing svag autentisering5.04.4$0-$5k$0-$5kProof-of-ConceptWorkaround0.000590.04CVE-2022-47522
19PHP IMAP mb_send_mail okänd sårbarhet5.45.1$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.000860.00CVE-2006-1014
20Oracle Banking Digital Experience UI General privilegier eskalering9.89.6$25k-$100k$5k-$25kNot DefinedOfficial Fix0.028500.00CVE-2022-46364

Kampanjer (1)

These are the campaigns that can be associated with the actor:

  • NukeSped

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (27)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueKlassSårbarheterÅtkomstvektorTypFörtroende
1T1006CAPEC-126CWE-21, CWE-22, CWE-23, CWE-24, CWE-425Path TraversalpredictiveHög
2T1040CAPEC-102CWE-319Authentication Bypass by Capture-replaypredictiveHög
3T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveHög
4T1059CAPEC-137CWE-88, CWE-94, CWE-1321Argument InjectionpredictiveHög
5T1059.007CAPEC-209CWE-79, CWE-80Cross Site ScriptingpredictiveHög
6T1068CAPEC-104CWE-250, CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveHög
7TXXXX.XXXCAPEC-0CWE-XXXXxx Xx Xxxx-xxxxx XxxxxxxxpredictiveHög
8TXXXX.XXXCAPEC-16CWE-XXX, CWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveHög
9TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHög
10TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveHög
11TXXXXCAPEC-0CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHög
12TXXXXCAPEC-0CWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveHög
13TXXXXCAPEC-184CWE-XXXXxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx XxxxxpredictiveHög
14TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveHög
15TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveHög
16TXXXXCAPEC-112CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveHög
17TXXXXCAPEC-37CWE-XXXXxxxxxxxx Xxxxxxx Xx Xxxxxxxxx XxxxxxxxxxxpredictiveHög
18TXXXXCAPEC-466CWE-XXX, CWE-XXXXxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxxpredictiveHög
19TXXXX.XXXCAPEC-220CWE-XXXXxxxxxxxx XxxxxxxxxpredictiveHög
20TXXXXCAPEC-38CWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveHög
21TXXXX.XXXCAPEC-0CWE-XXXXxxxxxxx Xxxxxx XxxxpredictiveHög
22TXXXX.XXXCAPEC-459CWE-XXX, CWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHög
23TXXXX.XXXCAPEC-133CWE-XXXXxxxxxxxpredictiveHög
24TXXXXCAPEC-116CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHög
25TXXXXCAPEC-157CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveHög
26TXXXX.XXXCAPEC-0CWE-XXX, CWE-XXX, CWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveHög
27TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveHög

IOA - Indicator of Attack (218)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlassIndicatorTypFörtroende
1File/admin-panel1.phppredictiveHög
2File/admin/academic/studenview_left.phppredictiveHög
3File/admin/ajax.phppredictiveHög
4File/admin/ajax.php?action=confirm_orderpredictiveHög
5File/admin/controller/JobLogController.javapredictiveHög
6File/admin/login.phppredictiveHög
7File/ad_js.phppredictiveMedium
8File/alerts/alertConfigField.phppredictiveHög
9File/api/blade-log/api/listpredictiveHög
10File/api/v1/terminal/sessions/?limit=1predictiveHög
11File/blogpredictiveLåg
12File/config/myfield/test.phppredictiveHög
13File/context/%2e/WEB-INF/web.xmlpredictiveHög
14File/core/conditions/AbstractWrapper.javapredictiveHög
15File/data/removepredictiveMedium
16File/debug/pprofpredictiveMedium
17File/etc/passwdpredictiveMedium
18File/face-recognition-php/facepay-master/camera.phppredictiveHög
19File/forms/doLoginpredictiveHög
20File/fuel/index.php/fuel/logs/itemspredictiveHög
21File/fuel/index.php/fuel/pages/itemspredictiveHög
22File/goform/aspFormpredictiveHög
23File/image_zoom.phppredictiveHög
24File/include/config.cache.phppredictiveHög
25File/index.phppredictiveMedium
26File/lists/index.phppredictiveHög
27File/mkshop/Men/profile.phppredictiveHög
28File/xxxxx.xxxx.xxxpredictiveHög
29File/xxx/xxxxxxxxxxxx.xxxpredictiveHög
30File/xxxxx/predictiveLåg
31File/xxxxxx/xxxxxxx/predictiveHög
32File/xxxx/xxx/x/xxxxxxpredictiveHög
33File/xxxx/xxx/xxxxxx/xxxxxxxxxxxxxxx/xxxpredictiveHög
34File/xxxxxxx/xxxxxxxx.xxxpredictiveHög
35File/xxxpredictiveLåg
36File/xxxxxxx/predictiveMedium
37File/xxxxxxpredictiveLåg
38File/xxxxx/xxxxxxxxxxxxxxpredictiveHög
39File/xx-xxxxx/xxxxx-xxxx.xxxpredictiveHög
40File/xxx-xxx-xxxxx/xxxxxxxpredictiveHög
41Filexxxxxxxxxxxxxxxxxxx.xxxxpredictiveHög
42Filexxxxxx/xxxx/xxxxxx.xxxxpredictiveHög
43Filexxxxx.xxxpredictiveMedium
44Filexxxxx/xxxxxx/xxx/xxxxxxxx.xxpredictiveHög
45Filexxx_xxxxxx_xxxxxx.xxxpredictiveHög
46Filexxxx/xxxxxxxxx.xxxpredictiveHög
47Filexxx_xxxxxxx.xxxpredictiveHög
48Filexxx/xxxxxxxx/xxxx/xxxxxxxxxxxxxxxxx.xxxxpredictiveHög
49Filexxxxxx.xxxpredictiveMedium
50Filexxxxxxxxxxxxxx.xxxpredictiveHög
51Filexxxxxxxx.xxxpredictiveMedium
52Filexxxxxx.xpredictiveMedium
53Filexxxx_xxxx_xx.xxpredictiveHög
54Filexxxxxxxxxxxxxxxxxxx.xxxxpredictiveHög
55Filexxx_xxxx_xxxx.xpredictiveHög
56Filexxx_xxxxxxxxxxx_xxx.xxxpredictiveHög
57Filexxx.xxxpredictiveLåg
58Filexxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHög
59Filexxxxxxx.xxxpredictiveMedium
60Filexxxxxxx_xxxx.xxxpredictiveHög
61Filexxxxxx.xxxpredictiveMedium
62Filexxxxxxxxx.xxxxxxx.xxxpredictiveHög
63Filexxxxxxxxxx/xxxx.xxxpredictiveHög
64Filexxxxxx-xxxxxxx.xxxpredictiveHög
65Filexxxxxx/xx/xx_xxxxx.xpredictiveHög
66Filexxxxxx/xxxx/xxxxxxxx.xpredictiveHög
67Filexxxxxx/xxxxxxx/xxx_xxx.xpredictiveHög
68Filexxxxxxxxxx.xpredictiveMedium
69Filexxxxxxx.xxxxx.xxxpredictiveHög
70Filexxxxxxx/xxxx/xxxxx/xxxxx_xxxx.xpredictiveHög
71Filexxxxxxx/xxx/xxx/xxx/xxxx_xxx.xpredictiveHög
72Filexxxxxxx/xxxxx/xxxxx/xxxxxxx.xpredictiveHög
73Filexxxxxxx_xxxx.xxxx.xxx/xxxxxxx_xxxx.xxxpredictiveHög
74Filexx/xxxxx/xxxxxxx.xpredictiveHög
75Filexxxx/xxxxxxx/xxxx/xxxxxxxxxxx/xxxxx.xxxpredictiveHög
76Filexxxxx/xxxxx.xxpredictiveHög
77Filexxxx.xpredictiveLåg
78Filexxxxx.xxxpredictiveMedium
79Filexxxxx.xxx/xxxxxxx/xxxxx/xxxxxpredictiveHög
80Filexxxxx.xxx/xxxxxxx/xxxxx/xxxxxxxxxpredictiveHög
81Filexxxxx.xxx/xxxxxxx/xxxx/xxxxxxxxxxxpredictiveHög
82Filexxxxx.xxx/xxxxxxx/xxxx/xxxxxpredictiveHög
83Filexxxxx.xxx?x=xxxx&x=xxxxxxx&x=xxxpredictiveHög
84Filexxxxx.xxx?x=/xxxx/xxxxxxxxxxxx/xxxxxxxpredictiveHög
85Filexxxxx.xxx?x=/xxxx/xxxxxxxxxxxx/xxxxxxxxpredictiveHög
86Filexxxxxxx.xpredictiveMedium
87Filexxxxxx.xpredictiveMedium
88Filexxxxxxxxxxxxxx.xxxpredictiveHög
89Filexxxxxxx/xxx_xxx.xpredictiveHög
90Filexxxxx.xxxpredictiveMedium
91Filexxx-xxxxxxxx/xxxx.xxxpredictiveHög
92Filexxxxxxxxxxx.xxxpredictiveHög
93Filexxxxxxxx_xxxx.xxxpredictiveHög
94Filexxxxxxx/xxxxx/xx_xxxxxx.xpredictiveHög
95Filexxx_xxxxx.xpredictiveMedium
96Filexxx/xxxx/xxxxxx.xpredictiveHög
97Filexxx_xxxxxxxx.xpredictiveHög
98Filexxx_xxxx.xpredictiveMedium
99Filexxx.xpredictiveLåg
100Filexx/xxxxpredictiveLåg
101Filexx_xxx.xpredictiveMedium
102Filexxxxxxxx/xxxxxx-xxxxx/xxxxxxxxxxx/xxxx.xxpredictiveHög
103Filexxxxxxxxxx.xxpredictiveHög
104Filexxxxxxx.xxxpredictiveMedium
105Filexxxxxxxxx/xxxxxxxxxxxxpredictiveHög
106Filexxxxx/xxxxxxx.xpredictiveHög
107Filexxxxxxxxxx.xxxpredictiveHög
108Filexxxx\xxxxxxx\xxxxxxx\xxxxxxxx_xxxxxx.xxxpredictiveHög
109Filexxxxxxxxxx.xxpredictiveHög
110Filexxxxxxxx-xxx-xxxxxx.xpredictiveHög
111Filexxxx_xxx_xx.xpredictiveHög
112Filexxxx-xxx/xxxxxxxx.xxxpredictiveHög
113Filexxxxxxxxxx_xxxxpredictiveHög
114Filexxxxxx.xxpredictiveMedium
115Filexxxxx.xxxpredictiveMedium
116Filexxxx/xxxxxx.xxxpredictiveHög
117Filexxx_xxxx.xpredictiveMedium
118Filexx/xxx.xpredictiveMedium
119Filexxxxxx.xxxpredictiveMedium
120Filexxxxxx-xxxx.xxxpredictiveHög
121Filexxxxxxxx/xxxxxxxxpredictiveHög
122Filexxxx/xxxxxxxx/xxxxxxxx.xxxxpredictiveHög
123Filexxxxxxxx/predictiveMedium
124Filexxxxxx-xxxxx.xxxpredictiveHög
125Filexxx.xxxxpredictiveMedium
126Filexxxxxxx/xxxx/xxx/xxxx.xxxpredictiveHög
127Filexxxxxx.xxxpredictiveMedium
128Filexxxxx/xxxxxxxxpredictiveHög
129Filexxxxxxxx.xpredictiveMedium
130File~/xxxxx-xxxxx.xxxpredictiveHög
131File~/xxxxxx-xxxx.xxxpredictiveHög
132File~/xxxxx-xxxxxxxx.xxxpredictiveHög
133File~/xxxxxx-xxxxx.xxxpredictiveHög
134File~/xxxxxxxxxxxxx-xxxxxxxxxxxxxx.xxxpredictiveHög
135File~/xxx/xxxxxxxxx/xxxxxxxxxxxx.xxxpredictiveHög
136File~/xxxxxxx-xxxxxxx-xxxxxx.xxxpredictiveHög
137File~/xxxx-xxxxxxxxxx-xxxxx.xxxpredictiveHög
138File~/xxxx/xxxxxxxxxx.xxxpredictiveHög
139File~/xxxxx/xxxxxxxxxxxxx.xxxx.xxxpredictiveHög
140Libraryxxxxx.xxxpredictiveMedium
141Libraryxxxxxx.xxxpredictiveMedium
142Libraryxxx/xxxxxxx/xxxxxxxxx.xxxpredictiveHög
143Libraryxxx/xxxx/xxxxxxxxxx.xxpredictiveHög
144Libraryxxxxxxxxxxx.xpredictiveHög
145Libraryxxxxxx.xxxpredictiveMedium
146Libraryxxxxxxxx.xxxpredictiveMedium
147Argument$_xxxxxx["xxx_xxxx"]predictiveHög
148Argument$_xxxxxx['xxxx_xxxx_xxxxx']predictiveHög
149ArgumentxxxxxxpredictiveLåg
150Argumentxxxxxx:/xxxxxxxx:/xxxxxxxxxxxxxx:predictiveHög
151Argumentxxx/xxxxpredictiveMedium
152Argumentxxx_xxxxx_xxxxpredictiveHög
153ArgumentxxxxxxpredictiveLåg
154ArgumentxxxxxxxxxxxxxpredictiveHög
155Argumentxxxx_xxxxxpredictiveMedium
156Argumentxxx_xxx[]predictiveMedium
157Argumentxxxxxxxx_xxxxpredictiveHög
158ArgumentxxxpredictiveLåg
159ArgumentxxxxxxpredictiveLåg
160Argumentxxxxxxxxx xxxxpredictiveHög
161Argumentxxxxxxx_xxxx/xxxxxxxx/xxxx/xxxxx_xxxxxxpredictiveHög
162Argumentxxxxxxx-xxxxxxpredictiveHög
163ArgumentxxxxxxxxxxpredictiveMedium
164ArgumentxxxpredictiveLåg
165ArgumentxxxxxpredictiveLåg
166ArgumentxxxxxxxxpredictiveMedium
167ArgumentxxxxxxxxxpredictiveMedium
168Argumentxx_xxxxx_xxpredictiveMedium
169Argumentxxxxxxxx/xxxxxxx/xxxxxpredictiveHög
170ArgumentxxxxxxxxxxxxpredictiveMedium
171ArgumentxxxxxxxxxxxxxxxxxxxpredictiveHög
172Argumentxxxxx xxxxxpredictiveMedium
173Argumentxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxx/xxxxxxx/xxxxxxxxxxx/xxxxxxxxxxxpredictiveHög
174ArgumentxxpredictiveLåg
175Argumentxx_xxxxxxxxpredictiveMedium
176ArgumentxxxpredictiveLåg
177Argumentxxxx_xxxxxxpredictiveMedium
178Argumentxx_xxxxxxpredictiveMedium
179Argumentxxxxxxx/xxxxxxxxpredictiveHög
180ArgumentxxxxpredictiveLåg
181ArgumentxxxxxxxxpredictiveMedium
182ArgumentxxxxxxxpredictiveLåg
183ArgumentxxxxxxxpredictiveLåg
184Argumentxxxxx_xxxxpredictiveMedium
185Argumentxxxx_xxpredictiveLåg
186Argumentxxx_xx_xxxx/xxx_xx_xxxxxxxxpredictiveHög
187Argumentxxxxxxx_xx/xxxx_xxpredictiveHög
188ArgumentxxxpredictiveLåg
189ArgumentxxxxxpredictiveLåg
190Argumentxxxxxxxx_xxxxpredictiveHög
191ArgumentxxxxxxxxxxpredictiveMedium
192ArgumentxxxxxxxxxxxxpredictiveMedium
193ArgumentxxxxxxxxxpredictiveMedium
194ArgumentxxxxxxxxxpredictiveMedium
195Argumentxxxxxx_xxxx_xxxpredictiveHög
196ArgumentxxxpredictiveLåg
197ArgumentxxxpredictiveLåg
198ArgumentxxxxxxxxpredictiveMedium
199Argumentxxxxxxxx-xxxxxxxxpredictiveHög
200Argumentxxx-xxxpredictiveLåg
201ArgumentxxxpredictiveLåg
202ArgumentxxxxxxpredictiveLåg
203Argumentxxxx_xxxxxxxxxpredictiveHög
204Argumentxxxxx_xxxxxxxxxx_xxxxxpredictiveHög
205Argument_xxxxxxxxpredictiveMedium
206Input Value%xx%xxpredictiveLåg
207Input Value..predictiveLåg
208Input Value../predictiveLåg
209Input Valuex:\xxxxx\xxxx\xxx\xxx\xxxxxxxxxx.xxxpredictiveHög
210Input Value[]xxxxxx{}/x["xxx"]predictiveHög
211Input Value\xxxxxpredictiveLåg
212Input Value\xxx\xxx\xxx\xxxpredictiveHög
213PatternxxxxpredictiveLåg
214Network Portxxxx/xxxxxpredictiveMedium
215Network Portxxx/xx (xxxxxx)predictiveHög
216Network Portxxx/xxxxpredictiveMedium
217Network Portxxx/xxx (xxxx)predictiveHög
218Network Portxxx/xxxpredictiveLåg

Referenser (4)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!