Higaisa Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (8)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

zh	4
en	4

Country

cn	6
gb	2

Actors

Higaisa	2

Activities

Interest

Timeline

Type

Not Defined	4
Virtualization Software	2
Wireless LAN Software	2

Vendor

Apache	2
Not Defined	2
TP-LINK	2
Netgear	2

Product

Apache Jakarta Tomcat	2
containerd	2
TP-LINK WR940N	2
Netgear R6700	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Matrix Project Plugin REST API path traversal	5.3	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.03	CVE-2024-23900
2	Dahua IPC-HX3XXX Data Packet improper authentication	8.1	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.30359	0.03	CVE-2021-33044
3	XunRuiCMS cross-site request forgery	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00106	0.00	CVE-2022-36224
4	Apache Jakarta Tomcat AJP12 Protocol denial of service	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.83176	0.04	CVE-2005-0808
5	Tenda AC15/AC1900 setUsbUnload injection	8.5	8.5	$0-$5k	$0-$5k	High	Not Defined	0.96183	0.04	CVE-2020-10987
6	Netgear R6700 Service Port 5000 stack-based overflow	8.8	8.8	$25k-$100k	$5k-$25k	Not Defined	Not Defined	0.00300	0.05	CVE-2020-10924
7	TP-LINK WR940N memory corruption	7.5	6.7	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.69677	0.00	CVE-2017-13772
8	containerd containerd-shim API resource transfer	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.00	CVE-2020-15257

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	3.4.1.6		Higaisa	06/08/2020	verified	High
2	XX.XXX.XXX.XX		Xxxxxxx	04/03/2024	verified	High
3	XX.XX.X.XXX	xx.xx.x.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	06/08/2020	verified	High

TTP - Tactics, Techniques, Procedures (2)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX	CAPEC-10	CWE-XX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxx Xxxxxx Xxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	goform/setUsbUnload	predictive	High
2	Argument	xxxxxxxxxx	predictive	Medium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!