BlueShell Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (9)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	10

Country

us	8
cn	2

Actors

BlueShell	2
PingPull	1

Activities

Interest

Timeline

Type

Web Server	2
Not Defined	2
Operating System	2
Programming Tool Software	2
Office Suite Software	2

Vendor

Microsoft	6
Nginx	2
Not Defined	2

Product

Nginx njs	2
Firejail	2
Microsoft Windows	2
Microsoft Visual Studio	2
Microsoft .NET	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	SiteFactory CMS download.aspx path traversal	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00560	0.04	CVE-2015-6914
2	Nginx njs njs_module.c njs_module_read buffer overflow	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00521	0.00	CVE-2020-19692
3	Microsoft Windows ICMP Remote Code Execution	9.8	8.9	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.02818	0.04	CVE-2023-23415
4	Microsoft Windows DHCP Server Service Remote Code Execution	8.6	8.0	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.08510	0.00	CVE-2023-28231
5	Microsoft Visual Studio/.NET Local Privilege Escalation	7.8	7.3	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00183	0.02	CVE-2023-28260
6	Microsoft Office Graphics Remote Code Execution	7.3	6.7	$5k-$25k	$0-$5k	Unproven	Official Fix	0.01029	0.04	CVE-2023-28285
7	Firejail User Namespace join.c access control	8.8	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00042	0.04	CVE-2022-31214
8	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.04	CVE-2022-21664
9	Jetty Login Password.java information disclosure	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00299	0.04	CVE-2017-9735

Campaigns (1)

These are the campaigns that can be associated with the actor:

Korea / Thailand

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Campaigns	Identified	Type	Confidence
1	20.200.213.72	BlueShell		02/08/2024	verified	High
2	XX.XXX.XXX.XXX	Xxxxxxxxx	Xxxxx / Xxxxxxxx	10/11/2023	verified	High
3	XXX.XXX.XXX.XXX	Xxxxxxxxx		03/18/2024	verified	High
4	XXX.XX.XXX.XXX	Xxxxxxxxx		02/08/2024	verified	High

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX	CAPEC-19	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (5)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	assets/download.aspx	predictive	High
2	File	join.c	predictive	Low
3	File	xxx_xxxxxx.x	predictive	Medium
4	File	xxxx/xxxxxxxx/xxxxxxxx.xxxx	predictive	High
5	Argument	xxxx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!