Oto Gonderici Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (70)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	64
ru	2
de	2
fr	2

Country

us	26
ir	2
ru	2
fr	2

Actors

Oto Gonderici	3
Havoc	1
Alien	1

Activities

Interest

Timeline

Type

Not Defined	34
Programming Language Software	6
Content Management System	4
Web Browser	4
Operating System	4

Vendor

Not Defined	16
Microsoft	8
Dell EMC	6
Huawei	4
Mambo	2

Product

Dell EMC iDRAC9	4
PHP	4
Microsoft IIS	4
Huawei ACXXXX	2
Huawei SXXXX	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	ABUS TVIP 20000-21150 Metacharacter wireless_mft os command injection	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01034	0.05	CVE-2023-26609
2	Free5gc NAS Message resource consumption	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00070	0.00	CVE-2022-38871
3	Qualcomm Snapdragon Consumer IOT Meta Image buffer overflow	4.6	4.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.00	CVE-2021-1899
4	Qualcomm Snapdragon Auto Display use after free	7.8	7.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2021-1900
5	IBM Cognos Analytics cross-site request forgery	4.3	4.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00153	0.00	CVE-2021-38886
6	Huawei ACXXXX/SXXXX SSH Packet input validation	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00246	0.07	CVE-2014-8572
7	Mambo CMS thumbs.php Path path traversal	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00120	0.02	CVE-2013-2565
8	Mutare Voice getfile.asp file inclusion	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00616	0.00	CVE-2021-27236
9	Dell EMC Unity/UnityVSA/Unity XT Upgrade Readiness Utility cleartext storage	1.9	1.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2021-21547
10	Parallels Desktop Toolgate stack-based overflow	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.00	CVE-2021-31420
11	Dell EMC iDRAC9 Configuration stack-based overflow	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00158	0.00	CVE-2021-21540
12	Samsung SmartThings Port denial of service	3.3	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00104	0.00	CVE-2021-25378
13	Cisco Small Business RV Series Router Link Layer Discovery Protocol memory corruption	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00070	0.00	CVE-2021-1251
14	Kagemai cross site scripting	4.8	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00115	0.00	CVE-2021-20685
15	Qualcomm Snapdragon Auto RTCP Packet denial of service	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00103	0.00	CVE-2020-11255
16	RTA 499ES EtherNet-IP Adaptor Source Code stack-based overflow	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00489	0.00	CVE-2020-25159
17	Apple iOS/iPadOS CoreText out-of-bounds	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.01679	0.00	CVE-2021-1792
18	Apple iOS/iPadOS denial of service	6.3	6.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00062	0.00	CVE-2021-1773
19	arenavec Crate default uninitialized pointer	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00162	0.00	CVE-2021-29930
20	Synology DiskStation Manager SYNO.Core.Network.PPPoE os command injection	7.2	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00072	0.02	CVE-2021-29083

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	51.15.225.63	63-225-15-51.instances.scw.cloud	Oto Gonderici	05/31/2021	verified	High
2	XX.XXX.XXX.XX	xx-xxx-xxx-xx.xxxxxxxxx.xxx.xxxxx	Xxx Xxxxxxxxx	05/31/2021	verified	High
3	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxx Xxxxxxxxx	05/31/2021	verified	High
4	XX.XX.XXX.XXX	xxxxx.xx-xx-xx-xxx.xx	Xxx Xxxxxxxxx	05/31/2021	verified	High

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
3	T1068	CAPEC-122	CWE-269	Execution with Unnecessary Privileges	predictive	High
4	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
10	TXXXX	CAPEC-37	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
13	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
14	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (25)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cgi-bin/mft/wireless_mft	predictive	High
2	File	/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php	predictive	High
3	File	audiohd.exe	predictive	Medium
4	File	C:\Windupdt	predictive	Medium
5	File	x:\x_xxxxxxx	predictive	Medium
6	File	xxx-xxx/xxxxxxx	predictive	High
7	File	xxxxxxxx.xxx/xxxxxxx_xxxxxx.xxx	predictive	High
8	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
9	File	xxx/xxxxxxxx/xxxx_xxxxx.x	predictive	High
10	File	xxxxxxx.xxx	predictive	Medium
11	File	xxxxxx	predictive	Low
12	File	xxxxxx.xxx	predictive	Medium
13	File	xxx.x	predictive	Low
14	Library	xxxxxxxxx.xxx	predictive	High
15	Library	xxxxxxxxxx.xxx	predictive	High
16	Argument	xx	predictive	Low
17	Argument	xx	predictive	Low
18	Argument	xxxxxxx	predictive	Low
19	Argument	xxxx_xxxx	predictive	Medium
20	Argument	xxxxxxxx	predictive	Medium
21	Argument	xxxxxx	predictive	Low
22	Input Value	%xxx%xxxxxxxxx%xxxxxxx(x)>%xx	predictive	High
23	Input Value	.x./	predictive	Low
24	Input Value	::$xxxxx_xxxxxxxxxx	predictive	High
25	Network Port	xxx xxxxxx xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!