PowerDuke Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (48)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	48

Country

tr	12
cn	10
hu	10
be	8
us	8

Actors

PowerDuke	2
APT29	2

Activities

Interest

Timeline

Type

Not Defined	10
Router Operating System	8
Firewall Software	6
Operating System	6
Content Management System	4

Vendor

Cisco	8
Juniper	8
Microsoft	8
easyii	4
Not Defined	4

Product

Juniper Junos	8
Microsoft Windows	6
Cisco FirePOWER Management Center	4
easyii CMS	4
Samsung Galaxy S9	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Microsoft Windows LSA Remote Code Execution	8.1	7.6	$25k-$100k	$5k-$25k	High	Official Fix	0.90617	0.00	CVE-2022-26925
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
3	Microsoft Windows Common Log File System Driver Privilege Escalation	8.1	7.7	$25k-$100k	$5k-$25k	High	Official Fix	0.00125	0.00	CVE-2022-37969
4	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.10	CVE-2010-0966
5	Softomi Advanced C2C Marketplace Software sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00076	0.00	CVE-2023-6145
6	Microsoft Windows HTTP Request HTTP.sys code injection	7.3	7.0	$25k-$100k	$0-$5k	High	Official Fix	0.97537	0.16	CVE-2015-1635
7	Lanap BotDetect Captcha Asp.net access control	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.03404	0.02	CVE-2006-2918
8	Microsoft ASP.NET Core Kestrel Web Application password recovery	8.0	7.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02783	0.03	CVE-2018-0787
9	Red Hat WildFly Blacklist Filter File information disclosure	7.5	7.1	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.09817	0.00	CVE-2016-0793
10	CKeditor4 Instance Destroying cross site scripting	5.0	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00315	0.02	CVE-2023-28439
11	SAP NetWeaver GetComputerSystem information disclosure	5.3	4.6	$5k-$25k	$0-$5k	High	Official Fix	0.03101	0.05	CVE-2013-3319
12	Microsoft Exchange Server Outlook Web Access logon.aspx server-side request forgery	7.9	7.9	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00379	0.00	CVE-2018-16793
13	easyii CMS out cross-site request forgery	4.3	3.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00102	0.00	CVE-2020-36534
14	easyii CMS File Upload Management Upload.php file unrestricted upload	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00198	0.04	CVE-2022-3771
15	Microsoft ASP.NET Security Feature improper authentication	7.4	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00424	0.06	CVE-2018-8171
16	Plesk Obsidian Login Page injection	5.8	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00174	0.04	CVE-2023-24044
17	Microsoft Windows Scripting Language Remote Code Execution	8.8	8.5	$25k-$100k	$5k-$25k	High	Official Fix	0.18647	0.00	CVE-2022-41128
18	QNAP QVR command injection	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00160	0.04	CVE-2022-27588
19	Microsoft Windows User Profile Service Privilege Escalation	7.2	6.9	$25k-$100k	$5k-$25k	High	Official Fix	0.00102	0.00	CVE-2022-26904
20	Microsoft Windows Remote Desktop Protocol Remote Code Execution	8.8	8.1	$100k and more	$5k-$25k	Unproven	Official Fix	0.01546	0.02	CVE-2022-21893

Campaigns (1)

These are the campaigns that can be associated with the actor:

PowerDuke

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	65.15.88.243	adsl-065-015-088-243.sip.asm.bellsouth.net	APT29	PowerDuke	12/12/2020	verified	High
2	81.82.196.162	d5152c4a2.static.telenet.be	APT29	PowerDuke	12/12/2020	verified	High
3	XX.XXX.XX.XXX	xxxxxxx.xxxx.xx	Xxxxx	Xxxxxxxxx	12/12/2020	verified	High
4	XXX.XXX.XX.X		Xxxxx	Xxxxxxxxx	12/12/2020	verified	High
5	XXX.XX.XX.XX	xxx-xx-xx-xx.xxxxxxxxxxx.xxxxx	Xxxxx	Xxxxxxxxx	12/12/2020	verified	High
6	XXX.XX.XXX.XXX	xxxxxx.xxxx.xxxxxxxxxxxx.xxx	Xxxxx	Xxxxxxxxx	12/12/2020	verified	High
7	XXX.XXX.XX.XXX	xxxxxx-xx.xxxxxxxxxxxx.xxx	Xxxxx	Xxxxxxxxx	12/12/2020	verified	High
8	XXX.XXX.XXX.XX	xxxxxx.xxxxx.xxx	Xxxxx	Xxxxxxxxx	12/12/2020	verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/sign/out	predictive	High
2	File	/owa/auth/logon.aspx	predictive	High
3	File	/setup.cgi	predictive	Medium
4	File	xxxxxxxxxxxxx/xxx_xxxxxxxx.xxx	predictive	High
5	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
6	File	xxxxxxx/xxxxxx.xxx	predictive	High
7	File	xxxx.xxx	predictive	Medium
8	File	xxx/xxxxxx.xxx	predictive	High
9	Argument	xxxxxxxx	predictive	Medium
10	Argument	xxxx	predictive	Low
11	Argument	xx	predictive	Low
12	Argument	xxxxx	predictive	Low
13	Argument	xxxxxxxx	predictive	Medium
14	Input Value	/../	predictive	Low
15	Network Port	xxx/xxxx	predictive	Medium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!