LANDFALL Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (10)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	8
es	2

Country

us	6
co	2
hu	2

Actors

LANDFALL	2

Activities

Interest

Timeline

Type

Not Defined	2
Network Camera Software	2
Mail Server Software	2
Programming Language Software	2
Firewall Software	2

Vendor

Not Defined	4
AVTECH	2
Exim	2
F5	2

Product

PHPUnit	2
AVTECH IP Camera	2
AVTECH NVR	2
AVTECH DVR	2
Exim libspf2	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Apache Tomcat HTTP/2 Execution resource consumption	6.4	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.72665	0.05	CVE-2019-0199
2	F5 BIG-IP APM Virtual Server vdesk redirect	6.6	6.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00128	0.02	CVE-2018-5548
3	Exim libspf2 integer underflow	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00065	0.03	CVE-2023-42118
4	Exim AUTH out-of-bounds write	9.8	9.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00075	0.04	CVE-2023-42115
5	PHP SOAP HTTP Digest Authentication php_http.c php_random_bytes_throw small space of random values	2.6	2.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00045	0.02	CVE-2023-3247
6	PHPUnit HTTP POST eval-stdin.php code injection	8.5	8.4	$0-$5k	$0-$5k	High	Official Fix	0.97487	0.19	CVE-2017-9841
7	Microsoft Windows LDAP Privilege Escalation	7.5	6.8	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00854	0.03	CVE-2022-30139
8	Cisco Unified Intelligence Center Dashboard resource injection	5.7	5.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00170	0.00	CVE-2019-1860
9	AVTECH IP Camera/NVR/DVR Captcha VerifyCode.cgi improper authentication	7.3	7.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	0.04

IOC - Indicator of Compromise (14)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	2.20.142.202	a2-20-142-202.deploy.static.akamaitechnologies.com	LANDFALL	07/05/2018	verified	High
2	2.21.242.227	a2-21-242-227.deploy.static.akamaitechnologies.com	LANDFALL	07/05/2018	verified	High
3	31.13.91.52		LANDFALL	07/05/2018	verified	High
4	XX.XXX.XXX.XXX	xxxx.xx-xxxxxxxx.xxxxxxxx.xxx	Xxxxxxxx	07/05/2018	verified	High
5	XX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxxxx	07/05/2018	verified	High
6	XXX.XXX.XXX.XX	xxxxxx.xxxxx.xxxxxxxxx.xxx	Xxxxxxxx	07/05/2018	verified	High
7	XXX.XXX.XXX.XX	xxxxxx.xxxxx.xxxxxxxxx.xxx	Xxxxxxxx	07/05/2018	verified	High
8	XXX.XXX.XXX.XXX	xxxxxxx.xxxxx.xxxxxxxxx.xxx	Xxxxxxxx	07/05/2018	verified	High
9	XXX.XXX.XXX.XXX	xxxxxxx.xxxxx.xxxxxxxxx.xxx	Xxxxxxxx	07/05/2018	verified	High
10	XXX.XX.XXX.XXX		Xxxxxxxx	07/05/2018	verified	High
11	XXX.XX.XXX.XX		Xxxxxxxx	07/05/2018	verified	High
12	XXX.XX.XXX.XXX		Xxxxxxxx	07/05/2018	verified	High
13	XXX.XXX.XXX.XX	xxx.xxxxxxxxx.xx	Xxxxxxxx	07/05/2018	verified	High
14	XXX.XXX.XXX.XXX		Xxxxxxxx	07/05/2018	verified	High

TTP - Tactics, Techniques, Procedures (3)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
3	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cgi-bin/nobody/VerifyCode.cgi	predictive	High
2	File	/vdesk	predictive	Low
3	File	xxx/xxxx/xxx_xxxx.x	predictive	High
4	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	High
5	Argument	xxxxx	predictive	Low
6	Argument	xxxx_xxx	predictive	Medium
7	Input Value	xxxxx	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!