Sarwent Analys

IOB - Indicator of Behavior (18)

Tidslinje

Lang

en18

Land

us18

Skådespelare

Aktiviteter

Intressera

Tidslinje

Typ

Säljare

Produkt

Dahua IPC-HDW1X2X4
Dahua IPC-HFW1X2X4
Dahua IPC-HDW2X2X4
Dahua IPC-HFW2X2X4
Dahua IPC-HDW4X2X4

Sårbarheter

#SårbarhetBaseTemp0dayI dagUtnRemCTIEPSSCVE
1Dahua IP Camera privilegier eskalering7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.030.00101CVE-2017-7253
2eSyndicat Directory Software suggest-listing.php cross site scripting3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.040.00000
3Reolink RLC-410W Firmware Update Privilege Escalation5.55.3$0-$5k$0-$5kNot DefinedNot Defined0.030.00149CVE-2021-40419
4Dahua IPC-HDBW2XXX/IPC-HFW2XXX/ASI7XXXX ONVIF svag autentisering7.87.6$0-$5k$0-$5kNot DefinedOfficial Fix0.010.00135CVE-2022-30563
5Dahua DH-IPC-Hxxxxxxxxx Authentication svag autentisering7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.000.03148CVE-2017-7927
6Dahua IPC-HDW1X2X IP Address informationsgivning5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00084CVE-2019-9680
7Dahua IPC-HDW1X2X Login privilegier eskalering6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.060.00103CVE-2019-9678
8Dahua IPC-HDW1X2X Debug Function privilegier eskalering7.57.2$0-$5kBeräknandeNot DefinedOfficial Fix0.000.00104CVE-2019-9679
9Dahua IPC-HDW1X2X Online Upgrade Reverse Engineering informationsgivning5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00084CVE-2019-9681
10Dahua IPC-HDW1X2X CGI Interface minneskorruption8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00250CVE-2019-9677
11Dahua DHI-HCVR7216A-S3 MD5 privilegier eskalering5.95.9$0-$5kBeräknandeNot DefinedNot Defined0.020.31255CVE-2017-6343
12TP-Link TL-WR841N V13 Traceroute privilegier eskalering7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00770CVE-2020-35576
13PCCS-Linux MySQLDatabase Admin Tool dbconnect.inc Password informationsgivning7.37.0$5k-$25kBeräknandeNot DefinedOfficial Fix0.020.00696CVE-2000-0707
14Red Hat Linux nfs-utils rpc.statd Format String9.88.8$25k-$100kBeräknandeProof-of-ConceptOfficial Fix0.040.08052CVE-2000-0666
15SonicWall SSLVPN SMA100 sql injektion7.37.1$0-$5k$0-$5kFunctionalNot Defined0.020.02628CVE-2021-20016

Kampanjer (1)

These are the campaigns that can be associated with the actor:

  • Amnesty International and Pegasus

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-adressHostnameSkådespelareKampanjerIdentifiedTypFörtroende
187.249.53.124713697-cj66716.tmweb.ruSarwentAmnesty International and Pegasus30/09/2021verifiedHög
2XXX.XXX.XXX.XXXxxxxxxXxxxxxx Xxxxxxxxxxxxx Xxx Xxxxxxx30/09/2021verifiedHög
3XXX.X.XX.XXXxxxx.xxxxxx.xxxxxxxXxxxxxxXxxxxxx Xxxxxxxxxxxxx Xxx Xxxxxxx30/09/2021verifiedHög

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueSårbarheterÅtkomstvektorTypFörtroende
1T1040CWE-294Authentication Bypass by Capture-replaypredictiveHög
2T1059.007CWE-80Cross Site ScriptingpredictiveHög
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHög
4TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveHög
5TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHög
6TXXXXCWE-XXXXxxxxxxxxx XxxxxxpredictiveHög
7TXXXXCWE-XXXxx XxxxxxxxxpredictiveHög
8TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHög

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlassIndicatorTypFörtroende
1Filedbconnect.incpredictiveHög
2Filexxx.xxxxxpredictiveMedium
3Filexxxxxxx-xxxxxxx.xxxpredictiveHög
4ArgumentxxxxxpredictiveLåg

Referenser (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!