PAPERWALL Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (10)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

zh	6
en	4

Country

cn	6
us	4

Actors

PAPERWALL	3
Cobalt Strike	1

Activities

Interest

Timeline

Type

Not Defined	4
Content Management System	2
Smartphone Operating System	2
Web Server	2

Vendor

Not Defined	4
Joomla	2
Google	2
0xJacky	2

Product

Elasticsearch	2
Joomla CMS	2
Google Android	2
0xJacky nginx-ui	2
FLDS	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	0xJacky nginx-ui Certificate Import write_file.go path traversal	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00165	0.00	CVE-2024-23827
2	Clash Proxies Name Column injection	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00274	0.00	CVE-2022-26255
3	Hashicorp Terraform path traversal	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2023-4782
4	Google Android ShannonRcs information disclosure	4.4	4.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.04	CVE-2023-20923
5	Google Android ActivityManagerService.java openContentUri information disclosure	3.3	3.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2023-21292
6	Elasticsearch Searchable Snapshot permission assignment	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00112	0.00	CVE-2021-22147
7	Elasticsearch Grok Parser infinite loop	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00138	0.00	CVE-2021-22144
8	Elasticsearch Error Report information exposure	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96291	0.03	CVE-2021-22145
9	Joomla CMS com_easyblog sql injection	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.35
10	FLDS redir.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.21	CVE-2008-5928

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Identified	Type	Confidence
1	43.153.75.48	PAPERWALL	02/08/2024	verified	High
2	43.155.173.104	PAPERWALL	02/08/2024	verified	High
3	XX.XXX.XX.XXX	Xxxxxxxxx	02/08/2024	verified	High
4	XX.XXX.XX.XXX	Xxxxxxxxx	02/08/2024	verified	High
5	XX.XXX.XXX.XXX	Xxxxxxxxx	02/08/2024	verified	High
6	XX.XX.XX.XX	Xxxxxxxxx	02/08/2024	verified	High
7	XXX.XX.XXX.XX	Xxxxxxxxx	02/08/2024	verified	High
8	XXX.XXX.XXX.XX	Xxxxxxxxx	02/08/2024	verified	High

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX	CAPEC-10	CWE-XX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxx Xxxxxx Xxxxx Xxxxxxxxxxx	predictive	High
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	ActivityManagerService.java	predictive	High
2	File	redir.php	predictive	Medium
3	File	xxxxx_xxxx.xx	predictive	High
4	Argument	xx	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!