Decoy Dog Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (39)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	30
zh	8
es	2

Country

cn	22
us	8
ru	6
ga	4

Actors

Decoy Dog	3
Cobalt Strike	2
Mirai_ptea	1
Sliver	1
Mirai	1

Activities

Interest

Timeline

Type

Not Defined	16
Content Management System	6
Mail Server Software	4
Unified Communication Software	2
WordPress Plugin	2

Vendor

Not Defined	20
Apache	4
Cisco	2
Tortoise	2
Fiyo	2

Product

Exim	4
Apache NiFi	2
Cisco Unity Connection	2
Tortoise ORM	2
Fiyo CMS	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Apache NiFi ExtractCCDAAttributes Processor xml external entity reference	6.5	6.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00129	0.00	CVE-2023-22832
2	imgurl localhost sql injection	4.6	4.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00172	0.03	CVE-2022-29305
3	atoms183 CMS product_admin.php sql injection	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00157	0.04	CVE-2021-35283
4	Cisco Unity Connection unrestricted upload	8.1	8.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00127	0.06	CVE-2024-20272
5	Tortoise ORM Mass Update sql injection	6.3	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00104	0.04	CVE-2020-11010
6	Microsoft IIS IP/Domain Restriction access control	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.34	CVE-2014-4078
7	National Education Technologies Boomerang Parental Control App ADB Backup information disclosure	1.8	1.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00052	0.00	CVE-2023-36620
8	Seiko Epson Product untrusted search path	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00090	0.02	CVE-2020-5674
9	Lexmark Device input validation	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.19121	0.00	CVE-2023-26068
10	Skipper File unrestricted upload	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00343	0.02	CVE-2022-27262
11	jQuery Cookie Prototype cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00068	0.02	CVE-2022-23395
12	Node.js permission	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00146	0.03	CVE-2023-23918
13	OpenSSH Supplemental Group privileges management	4.6	4.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00056	0.09	CVE-2021-41617
14	zzcms Cookie search.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00212	0.05	CVE-2018-18791
15	Fuel CMS 1 sql injection	8.0	7.2	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.41100	0.00	CVE-2020-24791
16	gVectors wpDiscuz Plugin wmuUploadFiles code injection	9.1	9.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.97490	0.03	CVE-2020-24186
17	WP Visitor Statistics Plugin AJAX Action refDetails sql injection	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01945	0.00	CVE-2021-24750
18	ImpressCMS findusers.php sql injection	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00939	0.00	CVE-2021-26599
19	Xerte fileupload.php path traversal	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06288	0.00	CVE-2021-44664
20	ChurchCRM WhyCameEditor.php sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00855	0.02	CVE-2022-31325

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	185.22.152.227	exdamnhust.com	Decoy Dog	02/19/2024	verified	High
2	XXX.XXX.XXX.XX		Xxxxx Xxx	02/19/2024	verified	High
3	XXX.XX.XX.XX	xxxxx.xxxxxxxxxxxx.xxx	Xxxxx Xxx	02/19/2024	verified	High

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
7	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
9	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
10	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
11	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
12	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (24)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/churchcrm/WhyCameEditor.php	predictive	High
2	File	/new	predictive	Low
3	File	/upload/localhost	predictive	High
4	File	xxxx_xxxxxxxx.xxx	predictive	High
5	File	xxxxxx.xxx	predictive	Medium
6	File	xxxxx/	predictive	Low
7	File	xxx/xxxxxxx.xxx	predictive	High
8	File	xxxxxxx/xxxxxxxxx.xxx	predictive	High
9	File	xxxxx/xxxxxxx/x	predictive	High
10	File	xxxxxxx_xxxxx.xxx	predictive	High
11	File	xxxxx.xxx	predictive	Medium
12	File	xxxxxx\xxxxxxx\xxxxx\xxxxxxx.xxx	predictive	High
13	File	xxxxxxx_xxxx/xxx/xxxxxx/xxxxxxxxxx.xxx	predictive	High
14	File	xx/xxxxxx.xxx	predictive	High
15	Argument	xxx=xxxx/xxx=xxxx	predictive	High
16	Argument	xxxx_xxxxxxx_xx	predictive	High
17	Argument	xxxxxx	predictive	Low
18	Argument	xxxxxxxxx	predictive	Medium
19	Argument	xxxx/xxxxx/xx	predictive	High
20	Argument	xxxx	predictive	Low
21	Argument	xxxxxxxx	predictive	Medium
22	Argument	xxxxxx	predictive	Low
23	Argument	xxxxxxxx	predictive	Medium
24	Input Value	xxxx+x@!xxxx+	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!