Konni Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (22)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	22

Country

us	6
gb	2
fi	2

Actors

Konni	4
Cobalt Strike	3
RecordBreaker	3
Raccoon	2
FAKEUPDATES	2

Activities

Interest

Timeline

Type

Not Defined	10
Web Browser	4
Firewall Software	2
Web Server	2
Customer Relationship Management System	2

Vendor

Not Defined	12
Microsoft	4
Google	4
Basti2web	2

Product

Google Chrome	4
PHProxy	2
Roku	2
Roku TV	2
Basti2web Book Panel	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Bitcoin wallet.dat AES Encryption Padding missing encryption	7.1	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.03
2	Google Chrome WebGL out-of-bounds write	7.5	7.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00115	0.04	CVE-2023-4072
3	MailEnable Enterprise Premium Stored cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00092	0.00	CVE-2019-12927
4	Smarty code injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05838	0.00	CVE-2014-8350
5	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.17	CVE-2017-0055
6	Google Chrome Index DB use after free	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00238	0.00	CVE-2022-1853
7	Citrix ShareFile Storage Zones Controller access control	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.01473	0.00	CVE-2021-22941
8	Microsoft Windows Remote Desktop Client Remote Code Execution	8.8	7.9	$100k and more	$5k-$25k	Proof-of-Concept	Official Fix	0.06417	0.02	CVE-2021-34535
9	OpenX File Upload banner-edit.php input validation	6.3	6.3	$0-$5k	$0-$5k	High	Not Defined	0.12830	0.02	CVE-2009-4098
10	D-Link DIR-600M C1 wan.htm improper authentication	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Workaround	0.00432	0.02	CVE-2019-7736
11	Apple iOS/iPadOS Kernel information disclosure	3.3	3.2	$5k-$25k	$0-$5k	High	Official Fix	0.00778	0.00	CVE-2020-27950
12	PHProxy Hotlinking Prevention privileges management	6.3	5.6	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.00
13	Linux Kernel blktrace.c __blk_add_trace use after free	7.4	7.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00968	0.00	CVE-2019-19768
14	Basti2web Book Panel books.php sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.00064	0.05	CVE-2009-4889
15	Microsoft .NET Framework Code Access Security cryptographic issues	9.8	9.8	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00163	0.11	CVE-2008-5100
16	Adobe Acrobat Reader use after free	8.0	7.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.01093	0.00	CVE-2019-8257
17	Sir GNUboard sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.00	CVE-2014-2339
18	Roku/Roku TV External Control API DNS Rebinding input validation	8.3	8.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00316	0.04	CVE-2018-11314
19	ThinkCMF ProfileController.class.php do_avatar path traversal	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00061	0.00	CVE-2018-16141
20	Cisco Linksys Router tmUnblock.cgi privileges management	9.8	9.2	$25k-$100k	$0-$5k	High	Workaround	0.00000	0.00

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	31.170.160.129		Konni	12/23/2020	verified	High
2	31.170.162.63		Konni	12/23/2020	verified	High
3	31.170.163.30	cpl07.main-hosting.eu	Konni	12/23/2020	verified	High
4	XX.XXX.XXX.XX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	09/05/2023	verified	High
5	XX.XXX.XXX.XX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	08/31/2023	verified	High
6	XX.XXX.XXX.XX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	09/05/2023	verified	High
7	XX.XXX.XXX.XXX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	07/17/2023	verified	High
8	XXX.XXX.XXX.XXX	xxxxxxxx.xxxxxxx.xx.xx	Xxxxx	12/22/2020	verified	High
9	XXX.XX.XXX.XX		Xxxxx	12/22/2020	verified	High
10	XXX.XX.XXX.XXX		Xxxxx	12/23/2020	verified	High
11	XXX.XXX.XXX.XX	xxxx.xxxxx.xx.xx	Xxxxx	12/22/2020	verified	High
12	XXX.XXX.XXX.XXX	xxxxx-xxxxx.xxxxxxx.xxxx	Xxxxx	06/30/2023	verified	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/uncpath/	predictive	Medium
2	File	application\User\Controller\ProfileController.class.php	predictive	High
3	File	banner-edit.php	predictive	High
4	File	xxxxx.xxx	predictive	Medium
5	File	xxxxxx/xxxxx/xxxxxxxx.x	predictive	High
6	File	xxxxxxxxx.xxx	predictive	High
7	File	xxxxxx.xxx	predictive	Medium
8	File	xxx.xxx	predictive	Low
9	Argument	xxxxxx	predictive	Low
10	Argument	xxxxxxx	predictive	Low
11	Argument	xxxxxx	predictive	Low
12	Argument	xxxxxxxx=xxx>	predictive	High
13	Argument	xxxx_xx	predictive	Low
14	Input Value	..\	predictive	Low
15	Network Port	xxx/xxxx	predictive	Medium

References (7)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!