OnionDog Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (54)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	52
ko	2

Country

kr	36
us	18

Actors

OnionDog	3

Activities

Interest

Timeline

Type

Not Defined	10
Smartphone Operating System	10
Operating System	8
Router Operating System	6
Chip Software	4

Vendor

Not Defined	10
Google	8
Microsoft	8
D-Link	6
Huawei	4

Product

D-Link DIR-850L	6
Google Android	6
Linux Kernel	4
Microsoft Windows	4
Mobile App Native Plugin	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Adobe Acrobat Reader Image Conversion out-of-bounds write	7.5	7.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01971	0.00	CVE-2018-4916
2	Huawei HG8245H URL information disclosure	7.4	7.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00167	0.04	CVE-2017-15328
3	Google Chrome v8 code injection	7.5	7.1	$25k-$100k	$0-$5k	Proof-of-Concept	Not Defined	0.23564	0.00	CVE-2016-9651
4	CPU Speculative Execution Meltdown information disclosure	6.1	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.97384	0.04	CVE-2017-5754
5	Mozilla Firefox WebRTC privileges management	5.3	4.6	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00461	0.00	CVE-2014-1586
6	Nexacro rename access control	7.7	7.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00073	0.04	CVE-2021-26613
7	Tobesoft NEXACRO17 execDefaultBrowser input validation	7.7	7.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00528	0.00	CVE-2021-26607
8	JetBrains IntelliJ IDEA Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00221	0.04	CVE-2021-45977
9	Oracle Communications Network Charging and Control Common denial of service	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00254	0.00	CVE-2022-35737
10	TeamViewer TVS File Parser out-of-bounds	7.0	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00184	0.00	CVE-2021-34858
11	logback Configuration File deserialization	5.3	5.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01555	0.00	CVE-2021-42550
12	Combodo iTop Configuration File input validation	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00644	0.09	CVE-2019-11215
13	Artifex MuPDF PDF File pdf-xref.c pdf_read_new_xref memory corruption	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00269	0.00	CVE-2018-6192
14	VMware ESXi/Workstation/Fusion SVGA out-of-bounds	7.5	7.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00077	0.05	CVE-2018-6974
15	PHP 404 Error Page phar_object.c Reflected cross site scripting	5.2	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03788	0.05	CVE-2018-10547
16	CPUID CPU-Z Kernel-Mode Driver out-of-bounds write	6.5	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.02	CVE-2017-15303
17	Microsoft Access memory corruption	7.0	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.29279	0.04	CVE-2018-0903
18	Wind River VxWorks TCP Initial Sequence Number input validation	5.6	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02370	0.05	CVE-2015-3963
19	Oracle VM VirtualBox access control	8.6	8.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00082	0.00	CVE-2018-2690
20	Adobe Flash Player out-of-bounds	6.9	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00569	0.05	CVE-2018-4871

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Identified	Type	Confidence
1	112.169.154.65	OnionDog	12/23/2020	verified	High
2	121.133.8.2	OnionDog	12/23/2020	verified	High
3	XXX.XXX.XXX.X	Xxxxxxxx	12/23/2020	verified	High
4	XXX.XXX.XXX.XXX	Xxxxxxxx	12/23/2020	verified	High
5	XXX.XXX.XXX.X	Xxxxxxxx	12/23/2020	verified	High
6	XXX.XXX.XXX.XX	Xxxxxxxx	12/23/2020	verified	High
7	XXX.XX.XXX.X	Xxxxxxxx	12/23/2020	verified	High
8	XXX.XXX.XX.XXX	Xxxxxxxx	12/23/2020	verified	High
9	XXX.XXX.XXX.X	Xxxxxxxx	12/23/2020	verified	High
10	XXX.XXX.XXX.XX	Xxxxxxxx	12/23/2020	verified	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (15)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/proc/<pid>/status	predictive	High
2	File	/var/passwd	predictive	Medium
3	File	ext/phar/phar_object.c	predictive	High
4	File	xxxxxx/xxx/xxxxxxx.xxx	predictive	High
5	File	xxxxxx/xxxxxx/xxxx.x	predictive	High
6	File	xxxx.xxx	predictive	Medium
7	File	xxxxxxxxx/xxxxx.xxx	predictive	High
8	File	xxx/xxx-xxxx.x	predictive	High
9	File	xxxx.xxx	predictive	Medium
10	Argument	xxxxxx	predictive	Low
11	Argument	xxxxxxx_x	predictive	Medium
12	Argument	xx	predictive	Low
13	Argument	xxxxxxxx	predictive	Medium
14	Input Value	xxxxxxx_xxxxx.xxxxxxx_xxxxxxx	predictive	High
15	Network Port	xxx/xx (xxxxxx)	predictive	High

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!