OnePercent Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (187)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	142
sv	16
it	12
de	10
fr	6

Country

us	124
ir	22
sv	16
ru	8
it	8

Actors

OnePercent	6
RecordBreaker	1
Stantinko	1
Baldr	1
Dridex	1

Activities

Interest

Timeline

Type

Not Defined	30
Operating System	14
Content Management System	12
Web Server	6
Programming Language Software	6

Vendor

Not Defined	42
Microsoft	14
Cisco	4
Openshift	2
Sun	2

Product

Microsoft Windows	10
PHP	6
Microsoft IIS	4
WordPress	4
Wheatblog	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.02	CVE-2007-1192
2	Tiki TikiWiki tiki-editpage.php input validation	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01194	0.03	CVE-2004-1386
3	WPS Hide Login Plugin Secret Login Page options.php access control	6.9	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02933	0.07	CVE-2021-24917
4	Apple Mac OS X TCP/IP Stack denial of service	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03667	0.03	CVE-2004-0171
5	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	1.78	CVE-2007-0354
6	Zipato Zipabox Smart Home Controller information disclosure	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00423	0.00	CVE-2018-15125
7	Samsung SCX-6x55X Syncthru Web Service source code	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00145	0.01	CVE-2021-42913
8	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.19	CVE-2010-0966
9	OpenSSH Authentication Username information disclosure	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.10737	0.38	CVE-2016-6210
10	Microsoft IIS cross site scripting	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.16	CVE-2017-0055
11	Microsoft IIS IP/Domain Restriction access control	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.06	CVE-2014-4078
12	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02101	0.00	CVE-2007-1287
13	PHP phpinfo cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08985	0.04	CVE-2006-0996
14	Matt Martz & Andy Stratton Page Restrict Plugin cross-site request forgery	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00043	0.02	CVE-2024-24702
15	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	2.75	CVE-2020-12440
16	Google Android Linkify.java addLinks access control	7.5	7.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00098	0.00	CVE-2019-2003
17	Adobe Magento Mage-Messages Cookie cross site scripting	2.4	2.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00187	0.03	CVE-2021-28556
18	GitHub Enterprise Server GraphQL API authorization	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00183	0.03	CVE-2022-23739
19	Mitsubishi Electric Factory Automation path traversal	7.3	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01117	0.00	CVE-2020-14523
20	TP-Link WR886N httpd Service PingIframeRpm.htm buffer overflow	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00069	0.04	CVE-2021-44864

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	31.187.64.199	sophia.onebusinessdesign.info	OnePercent	08/26/2021	verified	High
2	80.82.67.221		OnePercent	08/26/2021	verified	High
3	XXX.XXX.XXX.XX		Xxxxxxxxxx	08/26/2021	verified	High
4	XXX.XXX.XXX.XXX		Xxxxxxxxxx	08/26/2021	verified	High
5	XXX.XXX.XXX.XXX		Xxxxxxxxxx	08/26/2021	verified	High
6	XXX.XX.XXX.XX		Xxxxxxxxxx	08/26/2021	verified	High
7	XXX.XXX.XXX.XXX		Xxxxxxxxxx	08/26/2021	verified	High

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
7	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
9	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
10	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (69)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/+CSCOE+/logon.html	predictive	High
2	File	/download	predictive	Medium
3	File	/forum/away.php	predictive	High
4	File	/port_3480/data_request	predictive	High
5	File	/uncpath/	predictive	Medium
6	File	/userRpm/PingIframeRpm.htm	predictive	High
7	File	/wp-admin/options.php	predictive	High
8	File	adclick.php	predictive	Medium
9	File	xxx_xxxxxxx.xxx	predictive	High
10	File	xxxxx/xxxxx.xxx?x=xx_xxx&x=xxxxx&x=xxxxx&x=xxxxx_xxxx_xxxxxxx&xxxxx=xxxx&xxxxx=x	predictive	High
11	File	xxx.xxx	predictive	Low
12	File	xxxxxxxxxxxxxxxxx.xxx	predictive	High
13	File	xxxx-xxxx.x	predictive	Medium
14	File	xxxxxxxxxxx.xxx	predictive	High
15	File	xxx.xxx	predictive	Low
16	File	xxxxxxxxx-xxxxxxx.xxx	predictive	High
17	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
18	File	xxxxx.x	predictive	Low
19	File	xxxxxxx/xxx/xxx/xxx_xxxx.x	predictive	High
20	File	xxxxx.xxx	predictive	Medium
21	File	xxxx.xxx	predictive	Medium
22	File	xxx/xxxxxx.xxx	predictive	High
23	File	xxxxxxx/xxxxxx/xxxxxxx/xxxxxx/xxx.xxx	predictive	High
24	File	xxxxxxx.xxxx	predictive	Medium
25	File	xxxxx.xxx	predictive	Medium
26	File	xxxx	predictive	Low
27	File	xxxx.xxx	predictive	Medium
28	File	xxxxxxx.xxx	predictive	Medium
29	File	xxxxxxx_xxxxxx.xxx	predictive	High
30	File	xxxxxxxx.xx	predictive	Medium
31	File	xxxxxxxx_xxxxxx.xxx	predictive	High
32	File	xxxxx.xxx	predictive	Medium
33	File	xxxxxx.xxx	predictive	Medium
34	File	xxxxxxxxxxxx.xxx	predictive	High
35	File	xxxx-xxxxxxxx.xxx	predictive	High
36	File	xxxxxx.xxx	predictive	Medium
37	File	xxxxxx.xxx	predictive	Medium
38	File	xxxxxx.xxx	predictive	Medium
39	File	xxxxx/xxxxxxxx	predictive	High
40	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
41	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxxx.xxx	predictive	High
42	File	xx-xxxxxxxxx.xxx	predictive	High
43	Library	xxxxxxxxxxxx.xxx	predictive	High
44	Library	xxx/xxx.x	predictive	Medium
45	Library	xxx/xxx.x	predictive	Medium
46	Library	xxxxxxx.xxx	predictive	Medium
47	Argument	xxxxx_xxxxxxxx	predictive	High
48	Argument	xxxxxxxx	predictive	Medium
49	Argument	xxxxx	predictive	Low
50	Argument	xxx	predictive	Low
51	Argument	xxxxxxxx	predictive	Medium
52	Argument	xxxxxxxxxxxxxxxxxxxxx	predictive	High
53	Argument	xxxx	predictive	Low
54	Argument	xxxxxxxxx xxxx	predictive	High
55	Argument	xxxxxx	predictive	Low
56	Argument	xxxx	predictive	Low
57	Argument	xxxxxxxxx	predictive	Medium
58	Argument	xx	predictive	Low
59	Argument	xxxx	predictive	Low
60	Argument	xxxxxxx	predictive	Low
61	Argument	xxxxxxxx	predictive	Medium
62	Argument	xxxx_xxxx	predictive	Medium
63	Argument	xxx	predictive	Low
64	Argument	xxxxxx_xxxx	predictive	Medium
65	Argument	xx_xx	predictive	Low
66	Argument	xxxxx_xx	predictive	Medium
67	Argument	xxxxxxxx/xxxx	predictive	High
68	Argument	xxxxx	predictive	Low
69	Network Port	xxx/xxx (xxx)	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!