RedFoxtrot 分析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (755)

语言

en	652
zh	84
it	8
ja	6
de	2

国家/地区

cn	142
us	142
bd	2
kr	2
gb	2

演员

RedFoxtrot	21
Cobalt Strike	5
IcedID	3
ShadowPad	1
Lodeinfo	1

利益

类型

Not Defined	134
Operating System	120
Web Browser	58
Smartphone Operating System	38
Multimedia Player Software	38

供应商

Not Defined	130
Microsoft	122
Apple	86
IBM	34
Oracle	32

产品

Microsoft Windows	54
Apple iOS	22
Microsoft Internet Explorer	18
Apple macOS	18
Google Chrome	18

漏洞

#	漏洞	Base	Temp	0day	今天	易	修正	CTI	EPSS	CVE
1	TikiWiki tiki-register.php 权限升级	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	9.62	0.01009	CVE-2006-6168
2	DZCP deV!L`z Clanportal config.php 权限升级	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	2.03	0.00943	CVE-2010-0966
3	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 信息公开	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
4	Tiki Admin Password tiki-login.php 弱身份验证	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	5.10	0.00936	CVE-2020-15906
5	Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php 权限升级	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00092	CVE-2023-4873
6	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	3.94	0.00000
7	WordPress SQL注入	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00467	CVE-2022-21664
8	SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php SQL注入	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.12	0.00135	CVE-2023-2090
9	Drupal Database Connection Error Message 信息公开	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00000
10	Sun Java fontmanager.dll UIManager.getSystemLookAndFeelClassName 内存损坏	7.8	7.5	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.02	0.00000
11	Citrix XenServer Web Self Service Management Interface Privilege Escalation	6.3	6.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.02	0.00000
12	WP Statistics Plugin class-wp-statistics-hits.php SQL注入	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.30136	CVE-2022-25149
13	xrdp sesman Server 内存损坏	7.8	7.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00050	CVE-2022-23613
14	Liferay Portal CE JSON Payload 权限升级	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.01289	CVE-2019-16891
15	Cisco ASA Command Line Interface EpicBanana/JetPlow 权限升级	7.8	7.4	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.97507	CVE-2016-6367
16	Hikvision Product Message 权限升级	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.97493	CVE-2021-36260
17	VMware ESXi/Workstation/Fusion vmxnet3 Virtual Network Adapter 内存损坏	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00044	CVE-2020-3971
18	Mail Masta Plugin csvexport.php SQL注入	8.5	8.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.00597	CVE-2017-6095
19	Apple macOS 信息公开	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00077	CVE-2020-9944
20	Apple tvOS 信息公开	4.4	4.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00077	CVE-2020-9943

IOC - Indicator of Compromise (22)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP地址	Hostname	参与者	Identified	类型	可信度
1	45.32.22.220	45.32.22.220.vultrusercontent.com	RedFoxtrot	2022-10-12	verified	高
2	45.32.146.174	45.32.146.174.vultrusercontent.com	RedFoxtrot	2022-10-12	verified	高
3	45.76.216.62	45.76.216.62.vultrusercontent.com	RedFoxtrot	2022-10-12	verified	高
4	45.77.178.76	thematrix.dev	RedFoxtrot	2022-10-12	verified	高
5	66.42.33.214	66.42.33.214.vultrusercontent.com	RedFoxtrot	2022-10-12	verified	高
6	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
7	XXX.XX.XXX.XX	xxxxxxx-xxxx.xxxxxxxxxxxxxxxx	Xxxxxxxxxx	2022-10-12	verified	高
8	XXX.XXX.XXX.XXX		Xxxxxxxxxx	2022-10-12	verified	高
9	XXX.XXX.XXX.XX		Xxxxxxxxxx	2022-10-12	verified	高
10	XXX.XXX.XXX.XXX	xx-xxxxxxx-xxxxxx-xxxxxxxx.xxxxx.xxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
11	XXX.XX.XXX.XXX	xxx.xx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
12	XXX.XX.XXX.XXX		Xxxxxxxxxx	2022-10-12	verified	高
13	XXX.XXX.XXX.X		Xxxxxxxxxx	2022-10-12	verified	高
14	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
15	XXX.XXX.XXX.XXX		Xxxxxxxxxx	2022-10-12	verified	高
16	XXX.XXX.XXX.XXX		Xxxxxxxxxx	2022-10-12	verified	高
17	XXX.XXX.XXX.XX		Xxxxxxxxxx	2022-10-12	verified	高
18	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
19	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
20	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	2022-10-12	verified	高
21	XXX.XXX.XXX.XXX		Xxxxxxxxxx	2022-10-12	verified	高
22	XXX.XXX.XXX.XXX	xxxxxxxxxxxxxx.xxxxx	Xxxxxxxxxx	2022-10-12	verified	高

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	漏洞	访问向量	类型	可信度
1	T1006	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	高
2	T1040	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	高
3	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
4	T1059	CWE-94	Argument Injection	predictive	高
5	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	高
6	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
7	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	高
8	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
9	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
10	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
11	TXXXX	CWE-XXX, CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
12	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
13	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	高
14	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
15	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx	predictive	高
16	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	高
17	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
18	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	高
19	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
20	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高
21	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	高

IOA - Indicator of Attack (192)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	分类	Indicator	类型	可信度
1	File	/admin/maintenance/view_designation.php	predictive	高
2	File	/admin/sys_sql_query.php	predictive	高
3	File	/app/Http/Controllers/Admin/NEditorController.php	predictive	高
4	File	/cgi-bin/luci/api/wireless	predictive	高
5	File	/cgi-bin/vitogate.cgi	predictive	高
6	File	/forum/away.php	predictive	高
7	File	/getcfg.php	predictive	中
8	File	/group1/uploa	predictive	高
9	File	/importexport.php	predictive	高
10	File	/inc/lists/csvexport.php	predictive	高
11	File	/server-status	predictive	高
12	File	/sgmi/	predictive	低
13	File	/system/user/resetPwd	predictive	高
14	File	/tos/index.php?editor/fileGet	predictive	高
15	File	/uncpath/	predictive	中
16	File	/user/updatePwd	predictive	高
17	File	/var/log/nginx	predictive	高
18	File	addentry.php	predictive	中
19	File	admin-ajax.php?action=get_wdtable order[0][dir]	predictive	高
20	File	admin/plib/api-rpc/Agent.php	predictive	高
21	File	applications/core/modules/front/system/content.php	predictive	高
22	File	att_protocol.cc	predictive	高
23	File	xxxx-xxxx.x	predictive	中
24	File	xxxxxxxxxxxxxx.xxx	predictive	高
25	File	xxxxx.xxx	predictive	中
26	File	xxx.x	predictive	低
27	File	xxxxx/xxxxxxx.xxx	predictive	高
28	File	xxxxx.xxx	predictive	中
29	File	xxxxxxxx.x	predictive	中
30	File	xxxxxxxxx.xxx	predictive	高
31	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
32	File	xx.xxx	predictive	低
33	File	xxxxxxxx.xxx	predictive	中
34	File	xxxx.xxx	predictive	中
35	File	xx_xxxxxx.xxx	predictive	高
36	File	xxxx/xx/xxxxxxxxx/xxxxxxxxxxxxxxxxxx.xxx	predictive	高
37	File	xxxxx.xxx	predictive	中
38	File	xxx/xxxxxx/xxxxxx.x	predictive	高
39	File	xxxx.xxx	predictive	中
40	File	xxxxxxxx.xxx	predictive	中
41	File	xxxxxxxx.xxx	predictive	中
42	File	xx/xxxx/xxxxxxx.x	predictive	高
43	File	xx/xxx/xxx_xxxxxxxx.x	predictive	高
44	File	xxxxxx.xxx	predictive	中
45	File	xxx_xxx.xxx	predictive	中
46	File	xxxxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
47	File	xxxxxxxxxx.xxx	predictive	高
48	File	xx_xxx.xxx	predictive	中
49	File	xxx/xxxxxx.xxx	predictive	高
50	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	高
51	File	xxxxx.xxx	predictive	中
52	File	xxxxxxxxxxxxx.xxx	predictive	高
53	File	xx/xxx/xxxxx.xxx	predictive	高
54	File	xxxxxx.x	predictive	中
55	File	xxxxxx/xxxxx.x	predictive	高
56	File	xxxxxxxxxx.xxx	predictive	高
57	File	xxxxx.xxx	predictive	中
58	File	xxxxx.xxx	predictive	中
59	File	xxxxxxxxxx/xxxxxxx.x	predictive	高
60	File	xxxx-xxxxxx.x	predictive	高
61	File	xxxxxxxx.xxx	predictive	中
62	File	xxx/xxxxxx.x	predictive	中
63	File	xxx.xxx	predictive	低
64	File	xxxxxx.x	predictive	中
65	File	xxxxxxxx.xxx	predictive	中
66	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	高
67	File	xxxxxxxx.xxx	predictive	中
68	File	xxxxxxxx.xxx	predictive	中
69	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	高
70	File	xxxxxxxxx/xxxxxxx/xxxx/xxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	高
71	File	xx_xxxx.xx	predictive	中
72	File	xxxxxxxx.xxx	predictive	中
73	File	xxxxxxx.xxx	predictive	中
74	File	xxxxx.xxx	predictive	中
75	File	xxxx-xxxxxx.x	predictive	高
76	File	xxxx_xxxxxx_xxxxxx.xxx	predictive	高
77	File	xxxxxx.xx	predictive	中
78	File	xxx/xxxxxxxx/xxxx_xxxxxx.x	predictive	高
79	File	xxxxxx.xxx	predictive	中
80	File	xxxxxx/xxxxxxx/xxxxxx/xxxxxxxx.xxx	predictive	高
81	File	xxxxxx/xxxxxxx/xx-xx/xxxx/xxxxx.xxx	predictive	高
82	File	xxxxxx/xxxxxxxxx/xxxxxxx.x	predictive	高
83	File	xxxx-xxxxx.xxx	predictive	高
84	File	xxxx-xxxxxxxx.xxx	predictive	高
85	File	xxxxxxxx.xxx	predictive	中
86	File	xxxxx/xxxxxx.x	predictive	高
87	File	xxx.xxx	predictive	低
88	File	xxxxx/xxxxxxxx.xxx	predictive	高
89	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	高
90	File	xxxxxxx.xxx	predictive	中
91	File	xxxxxxx.xxx	predictive	中
92	File	xxxxxx.xxx	predictive	中
93	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	高
94	File	xx-xxxxx/xxxxx.xxx	predictive	高
95	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	高
96	File	xx-xxxxxxxx/xxxxx.xxx	predictive	高
97	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxx.xxx	predictive	高
98	Library	/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxx/xxxxx.xxx	predictive	高
99	Library	xxxxxxxxxxx.xxx	predictive	高
100	Library	xxxxxxxxx/xxx-xxxxxx/xxxxxxxx.xxx	predictive	高
101	Library	xxxxxxxx.xxx	predictive	中
102	Library	xxxxxxxxxxx.xxx	predictive	高
103	Library	xxxxx.xxx	predictive	中
104	Library	xxxxxxxxxxxxxxxx.xxx	predictive	高
105	Library	xxx.xxx	predictive	低
106	Library	xxxxxxx.xxx	predictive	中
107	Library	xxxxxxx.xxx	predictive	中
108	Library	xxxxxx.xxx	predictive	中
109	Library	xxx xxxxxxxxx	predictive	高
110	Library	xxxxxx/x/xxxxxxxx	predictive	高
111	Argument	$_xxx['xxxx']	predictive	高
112	Argument	-x	predictive	低
113	Argument	xxxxxxxxxx	predictive	中
114	Argument	xxx	predictive	低
115	Argument	xxxxxxxxxxxxxx	predictive	高
116	Argument	xxxxxxxx	predictive	中
117	Argument	xxxxxx	predictive	低
118	Argument	xxxxxxx_xx	predictive	中
119	Argument	xxxxxxxxxx	predictive	中
120	Argument	xxxxxxx_xxxxx	predictive	高
121	Argument	xxxxxxxxxxx	predictive	中
122	Argument	xxxxxx	predictive	低
123	Argument	xxxx/xxxx	predictive	中
124	Argument	xxxxxxxxxxxxx	predictive	高
125	Argument	xxxxx	predictive	低
126	Argument	xxxx	predictive	低
127	Argument	xxxxxxxx	predictive	中
128	Argument	xxxxxxxx	predictive	中
129	Argument	xxxx:	predictive	低
130	Argument	xx	predictive	低
131	Argument	xx	predictive	低
132	Argument	xxxxxxxxx	predictive	中
133	Argument	xx	predictive	低
134	Argument	xxxx_xx	predictive	低
135	Argument	xxxxx[xxxxxxx]	predictive	高
136	Argument	xxxx	predictive	低
137	Argument	xxxxxxxxxxx	predictive	中
138	Argument	xxx	predictive	低
139	Argument	xxxxx/xxxx	predictive	中
140	Argument	xxxxxxx/xxxxx	predictive	高
141	Argument	xxxxxx	predictive	低
142	Argument	xxxx_xxx	predictive	中
143	Argument	xxxxxx_xxxx	predictive	中
144	Argument	xxxxxxx xxxxxx	predictive	高
145	Argument	xxx_xx	predictive	低
146	Argument	xxxx_xxxx	predictive	中
147	Argument	xxxxxxxxxx	predictive	中
148	Argument	xxxxxx	predictive	低
149	Argument	xxxxxxxxxx	predictive	中
150	Argument	xxxxxx_xx	predictive	中
151	Argument	xxxxxxxx	predictive	中
152	Argument	xxx	predictive	低
153	Argument	xxxxxxxxxx	predictive	中
154	Argument	xxx	predictive	低
155	Argument	xxx	predictive	低
156	Argument	xxxxxxxxxx	predictive	中
157	Argument	xxxxxxxxxxx	predictive	中
158	Argument	xxxxxx xxxxxx	predictive	高
159	Argument	xxx	predictive	低
160	Argument	xxx	predictive	低
161	Argument	xxxx-xxxxxxxx	predictive	高
162	Argument	xxxxxxxx/xxxx	predictive	高
163	Argument	xxxx	predictive	低
164	Argument	xxxxx/xxxxx/xxxxx/xxxx/xxxxxx	predictive	高
165	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	高
166	Input Value	../../	predictive	低
167	Input Value	/xxxxxx/..%xx	predictive	高
168	Input Value	::$xxxxx_xxxxxxxxxx	predictive	高
169	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	predictive	高
170	Input Value	xxxxxx	predictive	低
171	Pattern	+\|xx xx xx xx xx xx xx\|	predictive	高
172	Pattern	/xxxxx/xxxxxxx.xxx	predictive	高
173	Pattern	/xxxxxxxxxx/	predictive	中
174	Pattern	xxxx\|xx\|	predictive	中
175	Pattern	xxxx	predictive	低
176	Pattern	xxx	predictive	低
177	Pattern	xxxxxxxxxxx	predictive	中
178	Pattern	xxxxxxx\|xx xx xx xx xx\|	predictive	高
179	Pattern	xxxx	predictive	低
180	Pattern	xxxx	predictive	低
181	Pattern	xxxxxxxxx\|xx\|	predictive	高
182	Pattern	xxxx	predictive	低
183	Pattern	x\|xx\|x\|xx\|_\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|x\|xx\|	predictive	高
184	Pattern	xxxxxx.xxxxxx	predictive	高
185	Pattern	xxxxx/xxxxxxxxx	predictive	高
186	Pattern	\|xx xx xx xx\|	predictive	高
187	Pattern	\|xx xx\|	predictive	低
188	Pattern	\|xx xx xx xx\|<\|xx xx xx\|xxxx	predictive	高
189	Pattern	\|xx\|x\|xx xx\|	predictive	中
190	Network Port	xxx/xx	predictive	低
191	Network Port	xxx/xxxx (xxx)	predictive	高
192	Network Port	xxx xxxxxx xxxx	predictive	高

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 上一步一览下一步 ▸

Might our Artificial Intelligence support you?

Check our Alexa App!