CosmicDuke Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (5)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

de2
ru2
lu2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

CosmicDuke3
Potao1

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

File Transfer Software2
Firewall Software2
Web Server2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

Not Defined4
FileZilla2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

FileZilla FileZilla Server Terminal2
HAProxy2
nginx2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1nginx Range Filter integer overflow6.46.3$0-$5k$0-$5kNot DefinedWorkaround0.962830.04CVE-2017-7529
2HAProxy memory corruption7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.101550.02CVE-2012-2942
3Microsoft IIS IP/Domain Restriction access control6.55.7$25k-$100k$0-$5kUnprovenOfficial Fix0.008170.29CVE-2014-4078
4FileZilla FileZilla Server Terminal FTP Command memory corruption7.57.5$0-$5k$0-$5kHighNot Defined0.558650.04CVE-2005-3589
5Microsoft IIS FTP Server memory corruption7.57.2$25k-$100k$0-$5kHighOfficial Fix0.968430.08CVE-2010-3972

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
146.246.120.178CosmicDuke01/01/2021verifiedHigh
291.224.141.235CosmicDuke01/01/2021verifiedHigh
3XX.XXX.XXX.XXxx-xxxxxx-xx-xxx-xxx-xx.xxxxxx.xxXxxxxxxxxx01/01/2021verifiedHigh
4XXX.XX.XXX.XXxxxxxxx-xxxx-xxx.xxxx-xxxxxxx.xxxXxxxxxxxxx01/01/2021verifiedHigh
5XXX.XX.XXX.XXXXxxxxxxxxx01/01/2021verifiedHigh
6XXX.XX.XXX.XXXxxxxxx.xxx.xxx.xx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxxxx01/01/2021verifiedHigh
7XXX.XXX.XXX.XXxxx.xxxxxxxxxxxx.xxXxxxxxxxxx01/01/2021verifiedHigh
8XXX.XXX.XX.XXXXxxxxxxxxx01/01/2021verifiedHigh
9XXX.XXX.XXX.XXxxx-xxx-xxx-xx.xxxxxx.xxxxxxx.xxxXxxxxxxxxx01/01/2021verifiedHigh
10XXX.XX.XXX.XXXXxxxxxxxxx01/01/2021verifiedHigh

TTP - Tactics, Techniques, Procedures (1)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1068CWE-264Execution with Unnecessary PrivilegespredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!