Bifrost Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (39)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	32
zh	4
es	2
fr	2

Country

us	24
cn	8
es	2
ru	2
fr	2

Actors

Bifrost	5
Grabit	1
Snake	1
Cobalt Strike	1

Activities

Interest

Timeline

Type

Not Defined	10
Operating System	6
Programming Tool Software	2
Asset Management Software	2
Communications System	2

Vendor

Not Defined	12
Microsoft	4
Mattermost	2
Tenable	2
Cisco	2

Product

Microsoft Windows	4
radare2	2
JDOM	2
GLPI	2
Mattermost Server	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Linux Kernel TCP Stack resource management	6.4	6.0	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.03585	0.03	CVE-2017-5972
2	ZoneMinder Language Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.38401	0.08	CVE-2022-29806
3	Apache CXF Fediz OIDC Service cross-site request forgery	6.5	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00145	0.00	CVE-2017-7662
4	PHPList Subscription sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00152	0.06	CVE-2017-20032
5	PHPList Sending Campain sql injection	5.3	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00088	0.06	CVE-2017-20030
6	Digium Asterisk RTP resource consumption	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.00
7	Gradle Enterprise support-bundle information disclosure	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00181	0.00	CVE-2022-41575
8	ZoneMinder Snapshot Action shell_exec authorization	8.1	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96928	0.03	CVE-2023-26035
9	Microsoft Windows Imaging Library memory corruption	7.3	7.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.02009	0.00	CVE-2020-0708
10	Mattermost Server Password Reset improper authentication	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00087	0.00	CVE-2023-3591
11	y_project RuoYi File Upload uploadFilesPath cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00060	0.08	CVE-2023-3815
12	WordPress REST API class-wp-rest-users-controller.php information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Functional	Official Fix	0.87410	0.04	CVE-2017-5487
13	JDOM SAXBuilder denial of service	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00480	0.00	CVE-2021-33813
14	Microsoft Windows Point-to-Point Protocol Remote Code Execution	9.8	8.5	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.40009	0.02	CVE-2022-35744
15	avada Theme Stored cross site scripting	5.2	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00078	0.00	CVE-2017-18606
16	mxBB Kb Mods file inclusion	9.8	8.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.01573	0.00	CVE-2006-6567
17	WordPress Access Restriction user-new.php access control	7.5	7.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00372	0.03	CVE-2017-17091
18	Cisco Industrial Network Director Web Interface Reflected cross site scripting	5.2	5.2	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00129	0.00	CVE-2017-6675
19	radare2 DEX File config.c r_config_set use after free	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00084	0.00	CVE-2017-9520
20	Schneider Electric SoMachine HVAC DLL Loader access control	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01128	0.00	CVE-2017-7966

IOC - Indicator of Compromise (19)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	20.72.235.82		Bifrost	01/30/2023	verified	High
2	23.222.236.33	a23-222-236-33.deploy.static.akamaitechnologies.com	Bifrost	01/16/2023	verified	High
3	24.201.72.161	modemcable161.72-201-24.mc.videotron.ca	Bifrost	01/16/2023	verified	High
4	31.170.164.19		Bifrost	01/30/2023	verified	High
5	XX.XX.XX.XXX		Xxxxxxx	03/05/2024	verified	High
6	XX.X.XXX.XX	xxx-xx-x-xxx-xx.xx-xxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxxxxxx	01/30/2023	verified	Medium
7	XX.XXX.XXX.XXX		Xxxxxxx	06/03/2023	verified	High
8	XXX.XX.XX.XX		Xxxxxxx	07/22/2021	verified	High
9	XXX.XX.XXX.XXX	xxxx-xx-xxx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	01/30/2023	verified	High
10	XXX.XXX.XX.XXX	xxxxxxxx-xx-xxx.xxxxx.xxx	Xxxxxxx	06/03/2023	verified	High
11	XXX.XXX.XXX.XXX	x-xxxxxx.xx	Xxxxxxx	01/30/2023	verified	High
12	XXX.XX.XXX.XXX	xxxxxxxx.xxxx.xx	Xxxxxxx	04/12/2022	verified	High
13	XXX.XXX.XXX.XXX	xxxxxx-xxx.xxxxxxx.xxxxxx.xxx	Xxxxxxx	07/22/2021	verified	High
14	XXX.XXX.X.XXX	xxxxxxxx-xx-xx.xxxxx.xxx	Xxxxxxx	07/22/2021	verified	High
15	XXX.XXX.XX.XX	xxxx.xxxx.xxx.xxx	Xxxxxxx	01/16/2023	verified	High
16	XXX.XXX.XX.XXX		Xxxxxxx	01/30/2023	verified	High
17	XXX.XX.XX.XXX		Xxxxxxx	04/12/2022	verified	High
18	XXX.XX.XXX.XX		Xxxxxxx	01/30/2023	verified	High
19	XXX.XX.XXX.XXX	xxxx.xxxx.xx	Xxxxxxx	01/30/2023	verified	High

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/lists/admin/	predictive	High
2	File	convert.c	predictive	Medium
3	File	inc/autoload.function.php	predictive	High
4	File	xxxxxx/xxxxx/xxxx_xxxxxx.x	predictive	High
5	File	xxxx/xxxxxx/xxxxxx.x	predictive	High
6	File	xxxxxxxx.xxx	predictive	Medium
7	File	xxxxxxxxxxxx.xx	predictive	High
8	File	xx-xxxxx/xxxx-xxx.xxx	predictive	High
9	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
10	Argument	xxxxxxxxxx	predictive	Medium
11	Argument	xxxxxxxx	predictive	Medium
12	Argument	xxxxxx_xxxx_xxxx	predictive	High
13	Argument	xxxxxxxxxxxxxxxxx	predictive	High
14	Argument	xxx_xxxxxxxxx_xxxxxxx_xxxx	predictive	High
15	Input Value	.._	predictive	Low

References (8)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!