Sandworm Team Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	278
de	84
it	80
ar	80
es	78

Country

de	82
it	80
ar	80
es	78
cn	70

Actors

Rhadamanthys	1
Raccoon	1
LaplasClipper	1
Mirai	1
TrickBot	1

Activities

Interest

Timeline

Type

Not Defined	84
E-Commerce Management Software	8
Content Management System	6
Operating System	4
Appointment Software	4

Vendor

Tenda	46
Not Defined	26
Kashipara	8
Linux	4
PHPGurukul	4

Product

Tenda W15E	10
Tenda i21	10
Kashipara Online Furniture Shopping Ecommerce Webs ...	8
Tenda AX1806	6
Tenda 4G300	6

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	SourceCodester Simple Subscription Website view_application.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	1.20	CVE-2024-4093
2	Tenda W15E formQOSRuleDel stack-based overflow	8.8	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	1.03	CVE-2024-4121
3	EZVIZ CS-C6-21WFR-8 Davinci Application certificate validation	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	1.03	CVE-2024-4063
4	Tenda 4G300 sub_4279CC stack-based overflow	8.8	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	1.20	CVE-2024-4169
5	PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php cross site scripting	3.5	3.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	1.23	CVE-2024-4293
6	Techkshetra Info Solutions Savsoft Quiz Category Page editCategory cross site scripting	2.4	2.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.94	CVE-2024-4256
7	Tenda AX1806 execCommand R7WebsSecurityHandler stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.94	CVE-2024-4237
8	Tenda W15E DelPortMapping formDelPortMapping stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.82	CVE-2024-4117
9	idcCMS cross-site request forgery	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.70	CVE-2024-4172
10	Tenda i22 formSetUrlFilterRule stack-based overflow	8.8	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	0.70	CVE-2024-4252
11	Ruijie RG-UAC gre_edit_commit.php os command injection	4.7	4.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00046	0.94	CVE-2024-4255
12	Tenda AC8 SetRebootTimer formSetRebootTimer stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.73	CVE-2024-4065
13	Tenda W15E SetSysTimeCfg formSetSysTime stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.85	CVE-2024-4126
14	PHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.82	CVE-2024-4294
15	Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure	5.3	4.9	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00045	0.74	CVE-2024-4022
16	Tenda 4G300 sub_41E858 stack-based overflow	8.8	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	1.00	CVE-2024-4166
17	Tenda W15E SetPortMapping formSetPortMapping stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.73	CVE-2024-4123
18	Tenda AX1806 SetRebootTimer formSetRebootTimer stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.58	CVE-2024-4239
19	Tenda W9 DhcpSetSer fromDhcpSetSer stack-based overflow	8.8	8.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.62	CVE-2024-4244

Campaigns (2)

These are the campaigns that can be associated with the actor:

BlackEnergy
Xxxxxxx

IOC - Indicator of Compromise (43)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	5.9.32.230	static.230.32.9.5.clients.your-server.de	Sandworm Team	BlackEnergy	12/20/2020	verified	High
2	5.61.38.31		Sandworm Team	BlackEnergy	01/01/2021	verified	High
3	5.79.80.166		Sandworm Team	BlackEnergy	01/01/2021	verified	High
4	5.133.8.46	d8046.artnet.gda.pl	Sandworm Team		12/20/2020	verified	High
5	5.149.254.114	mail1.auditoriavanzada.info	Sandworm Team	BlackEnergy	12/20/2020	verified	High
6	5.255.87.39		Sandworm Team	BlackEnergy	01/01/2021	verified	High
7	31.210.111.154	.	Sandworm Team	BlackEnergy	12/20/2020	verified	High
8	37.220.34.56		Sandworm Team	BlackEnergy	01/01/2021	verified	High
9	45.56.93.83	li895-83.members.linode.com	Sandworm Team	Ukraine	04/20/2023	verified	High
10	XX.XX.XX.XXX	xx-xx.xxx.xx.xx.xxxxxx.xxxxx	Xxxxxxxx Xxxx	Xxxxxxx	04/20/2023	verified	High
11	XX.XXX.XX.XX	xx-xxxxx.xxxx.xx	Xxxxxxxx Xxxx	Xxxxxxx	04/20/2023	verified	High
12	XX.X.XX.XXX	xxxxxx.xxx.xx.x.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
13	XX.XXX.XXX.X		Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
14	XX.XXX.XXX.XX	xxxx.xxxxxx-xxxxx.xxx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
15	XX.XX.XXX.XXX	xxx-xx-xx-xxx-xxx.xxxxxxx-x.xxxxxxxxx.xxx	Xxxxxxxx Xxxx		06/27/2022	verified	Medium
16	XX.XX.XX.XXX	xxxxxx.xxx.xx.xx.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
17	XX.XXX.XXX.XXX	xxxxxxxxxxx.xxx	Xxxxxxxx Xxxx		12/20/2020	verified	High
18	XX.XXX.XXX.XX		Xxxxxxxx Xxxx		12/20/2020	verified	High
19	XX.XXX.XXX.XX	xxxxxxxxx.xx	Xxxxxxxx Xxxx		12/20/2020	verified	High
20	XX.XX.XXX.XXX	x-xx.xx.xxx.xxx.xxxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
21	XX.XX.XX.XXX		Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
22	XX.XXX.XX.XX	xxxxx.xxxxxxxxxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	12/20/2020	verified	High
23	XX.XXX.XXX.XXX		Xxxxxxxx Xxxx	Xxxxxxx	04/15/2022	verified	High
24	XX.XXX.XXX.XXX	xxx.xxxx-xxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
25	XX.XXX.XXX.XXX	xx-xxx-xxx-xxx.xxxxxx-xx-xxxxxxxxxxx.xxx	Xxxxxxxx Xxxx		12/20/2020	verified	High
26	XX.XXX.XX.XXX	xxx-xx-xxx-xx-xxx.xxxx.xxxxxxxxxx.xxx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
27	XX.XXX.XX.X	xxxxxx-x.xx.xxx.xx.xxxxxx.xxx	Xxxxxxxx Xxxx		12/20/2020	verified	High
28	XX.XXX.XXX.XXX	xxxxxx-xxx-xxx-xxx-xx.xxxxxxxxxxxx.xxx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
29	XX.XXX.XXX.XX		Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
30	XX.XXX.XX.XXX	xxxxx.xxxxxxx.xx	Xxxxxxxx Xxxx		03/31/2022	verified	High
31	XXX.XX.XXX.X		Xxxxxxxx Xxxx		03/31/2022	verified	High
32	XXX.XXX.XXX.XXX		Xxxxxxxx Xxxx	Xxxxxxx	04/20/2023	verified	High
33	XXX.XXX.XXX.XX	xxxxxxx.xxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
34	XXX.XXX.XXX.XXX		Xxxxxxxx Xxxx		12/20/2020	verified	High
35	XXX.X.XX.X		Xxxxxxxx Xxxx	Xxxxxxxxxxx	12/20/2020	verified	High
36	XXX.XX.XXX.XXX	xxxxxxxx.xx-xxx-xx-xxx.xx	Xxxxxxxx Xxxx		12/20/2020	verified	High
37	XXX.XXX.XX.XX	xx.xxxxxxxxxxxxxx.xxx	Xxxxxxxx Xxxx	Xxxxxxx	04/20/2023	verified	High
38	XXX.XX.X.XX	xxxxxx.xx.x.xx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	12/20/2020	verified	High
39	XXX.XXX.XXX.XX	xxxxx.xxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
40	XXX.XXX.XXX.XX	xxxxxx.xxxxxxxxxxxxxxx.xx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
41	XXX.XX.XXX.XX	xxxxx.xx.xxxxxxxxxxx.xx	Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High
42	XXX.XXX.XX.XX		Xxxxxxxx Xxxx	Xxxxxxx	04/15/2022	verified	High
43	XXX.XXX.XXX.XX		Xxxxxxxx Xxxx	Xxxxxxxxxxx	01/01/2021	verified	High

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-24	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-150	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
11	TXXXX	CAPEC-37	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
12	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
13	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
14	TXXXX.XXX	CAPEC-	CWE-XX	Xxxxxxxxxxxxx	predictive	High
15	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (121)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/admin_cl.php?mudi=revPwd	predictive	High
2	File	/adminPage/conf/reload	predictive	High
3	File	/cgi-bin/koha/opac-MARCdetail.pl	predictive	High
4	File	/debug/pprof	predictive	Medium
5	File	/Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=	predictive	High
6	File	/doctor/view-appointment-detail.php	predictive	High
7	File	/goform/AddDnsForward	predictive	High
8	File	/goform/addIpMacBind	predictive	High
9	File	/goform/AdvSetMacMtuWan	predictive	High
10	File	/goform/DelDhcpRule	predictive	High
11	File	/goform/delIpMacBind	predictive	High
12	File	/goform/DelPortMapping	predictive	High
13	File	/goform/DhcpSetSe	predictive	High
14	File	/goform/DhcpSetSer	predictive	High
15	File	/goform/execCommand	predictive	High
16	File	/goform/modifyDhcpRule	predictive	High
17	File	/xxxxxx/xxxxxxxxxxxxxxx	predictive	High
18	File	/xxxxxx/xxxxxxxxxxxxxxxxxxxxx	predictive	High
19	File	/xxxxxx/xxxxxxxxxxxx	predictive	High
20	File	/xxxxxx/xxxxxxxxxxxx	predictive	High
21	File	/xxxxxx/xxxxxxxxxx	predictive	High
22	File	/xxxxxx/xxxxxxxxxxx	predictive	High
23	File	/xxxxxx/xxxxxxxxx	predictive	High
24	File	/xxxxxx/xxxxxxxxxxxxxxxx	predictive	High
25	File	/xxxxxx/xxxxxxxxxxxxxx	predictive	High
26	File	/xxxxxx/xxxxxxxxxxxxxx	predictive	High
27	File	/xxxxxx/xxxxxxxxxxxxxxxxxx	predictive	High
28	File	/xxxxxx/xxxxxxxxxxxxxx	predictive	High
29	File	/xxxxxx/xxxxxxxxxxxxx	predictive	High
30	File	/xxxxxx/xxxxxxxxxxxxxxxxxxx	predictive	High
31	File	/xxxxxx/xxxxxxxxxxx	predictive	High
32	File	/xxxxxx/xxxxxxxxxxx	predictive	High
33	File	/xxxxxx/xxxxxxxxxxxx	predictive	High
34	File	/xxxxx.xxx?x=xxxxx&x=xxxxx&x=xxxxxxx_xxxx	predictive	High
35	File	/xxxxxxxxx/xxxx	predictive	High
36	File	/xxxxxxxxxxxxx.xx	predictive	High
37	File	/xxxxxx/xxxxx.xxx/xxxxx/xxxxxxxxxxxx	predictive	High
38	File	/xxxxxxx.xx	predictive	Medium
39	File	/xxxx/xxxxxxx xxxxxx/xxx/xxx_xxxx_xxxxxx.xxx	predictive	High
40	File	/xxx/xxxxxxxxxxx.xxx	predictive	High
41	File	/x_xxxxxx_xxxxxxxx_xxxxxxx/xxxxx/xxxxxx/xxxx?x=x.x.x-x-xxxxxxx	predictive	High
42	File	xxx/xxxxxxxx/xxx	predictive	High
43	File	xxx/xxxx/xxxxxxxxx/xxxxxxx.xxx	predictive	High
44	File	xxxxxxxxxxx-xxxxxxx-xxxxxxx-xxxxxxx.xxx	predictive	High
45	File	xxxxxx.xxx	predictive	Medium
46	File	xxxxx/xxxxxxx/xxxxxxxxxxxxx.xx	predictive	High
47	File	xxxxx.xxx	predictive	Medium
48	File	xxxxx.xxx	predictive	Medium
49	File	xxxx.xxxx	predictive	Medium
50	File	xxxxxxxx.xxx	predictive	Medium
51	File	xxxxxxxx.xxx	predictive	Medium
52	File	xxxxxx.xxx	predictive	Medium
53	File	xxxxxxxxxxxx.xxx	predictive	High
54	File	xxxxxxxxxx_xxxx.xxx	predictive	High
55	File	xxxxxx_xxxxx.xxx	predictive	High
56	File	xxxx_xxxxxxxxxxx.xxx	predictive	High
57	Argument	xxxxxxxxxxxx	predictive	Medium
58	Argument	xxxxxxxxxxxxx	predictive	High
59	Argument	xxxxxxxx_xxxx	predictive	High
60	Argument	xxxxx	predictive	Low
61	Argument	xxxxxxx_xx	predictive	Medium
62	Argument	xxxxxxxxxxxx	predictive	Medium
63	Argument	xxxxxxxxxx	predictive	Medium
64	Argument	xxxxxxx	predictive	Low
65	Argument	xxxxxxxxxxx/xxxxxxxxx/xxxxxx/xxxxxxxx/xxxxxxxxxxxxx/xxxxxxxx/xxxxxxxx	predictive	High
66	Argument	xxxxxxxxxxxxxx	predictive	High
67	Argument	xxxxxxxxxxxxxxxx	predictive	High
68	Argument	xxxxxx	predictive	Low
69	Argument	xxxxxx/xxxxx/xxxxxx	predictive	High
70	Argument	xxxx	predictive	Low
71	Argument	xxxxx	predictive	Low
72	Argument	xxxxxxxx/xxxxxx	predictive	High
73	Argument	xx/xxxx	predictive	Low
74	Argument	xxxxxxx	predictive	Low
75	Argument	xxxxxxxxxx	predictive	Medium
76	Argument	xxxxxx	predictive	Low
77	Argument	xx	predictive	Low
78	Argument	xxx	predictive	Low
79	Argument	xxxxxxxxxxxxxx	predictive	High
80	Argument	xxxxxxxxxxxxx	predictive	High
81	Argument	xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx	predictive	High
82	Argument	xxxx	predictive	Low
83	Argument	xxxx	predictive	Low
84	Argument	xxxxx	predictive	Low
85	Argument	xxxxxxxxxx	predictive	Medium
86	Argument	xx_xxxxxx_xxxxxxxxxxxx	predictive	High
87	Argument	xxxx	predictive	Low
88	Argument	xxx xxxxxxxx/xxxxxxx xxxxxxxx	predictive	High
89	Argument	xxxxxxxx	predictive	Medium
90	Argument	xxxx	predictive	Low
91	Argument	xxxxxxxx	predictive	Medium
92	Argument	xxxxx	predictive	Low
93	Argument	xxxxxxxxxxxxxxxx	predictive	High
94	Argument	xxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxx	predictive	High
95	Argument	xxxxxxxxxxxxxxxxxxxxxxxx	predictive	High
96	Argument	xxx	predictive	Low
97	Argument	xxxxxx	predictive	Low
98	Argument	xxxxxxxx	predictive	Medium
99	Argument	xxxxxxx	predictive	Low
100	Argument	xxxxxxxxxxxxxxxxxx	predictive	High
101	Argument	xxxxxxxx	predictive	Medium
102	Argument	xxxxxxxxxx	predictive	Medium
103	Argument	xxxxxxxx	predictive	Medium
104	Argument	xxxxxxxxxx/xxxxxxxx/xxxxxxx/xxxxxxxxxx	predictive	High
105	Argument	xxxxxxxxxxxx	predictive	Medium
106	Argument	xxx	predictive	Low
107	Argument	xxxxxxxxx	predictive	Medium
108	Argument	xxxxxxxxxxxxxxxx	predictive	High
109	Argument	xxxxxx	predictive	Low
110	Argument	xxxx	predictive	Low
111	Argument	xxxxxxxxxx	predictive	Medium
112	Argument	xxxxxxxxx	predictive	Medium
113	Argument	xxxxxxx	predictive	Low
114	Argument	xxxxxx/xxxxxxxx/xxxxxxxxx/xxx/xxxxxxxxxxx/xxxxxxxxxx	predictive	High
115	Argument	xxxx/xxxxx/xxx/xxxx/xxxxxx/xxxxxx	predictive	High
116	Input Value	../	predictive	Low
117	Input Value	x"><xxxx>	predictive	Medium
118	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	High
119	Input Value	><xxxxxx>xxxxx('xxx')</xxxxxx>	predictive	High
120	Input Value	xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	predictive	High
121	Network Port	xxxxx	predictive	Low

References (10)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!