TAG-53 Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (6)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	4
zh	2

Country

cn	2

Actors

TAG-53	2
RedLine Stealer	2
Cobalt Strike	2
TA551	1
Lumma Stealer	1

Activities

Interest

Timeline

Type

Not Defined	2
Project Management Software	2
Product Lifecycle Management Software	2

Vendor

Not Defined	2
Zephyr	2
Oracle	2

Product

XXL-Job	2
Zephyr Project Manager	2
Oracle Agile PLM	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Atlassian JIRA Server/Data Center QueryComponent!Default.jspa information disclosure	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00628	0.03	CVE-2020-14179
2	ThinkPHP System Environment Parameter index.php information disclosure	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01261	0.05	CVE-2022-25481
3	XXL-Job jobinfo cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.03	CVE-2022-29770
4	Oracle Agile PLM Security request smuggling	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00347	0.00	CVE-2022-42252
5	ForumHulp searchresults listener.php list_keywords sql injection	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01182	0.05	CVE-2016-15013
6	Zephyr Project Manager REST Call cross site scripting	4.1	4.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00053	0.10	CVE-2022-3333

IOC - Indicator of Compromise (124)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.61.63.19		TAG-53	08/10/2023	verified	High
2	23.94.96.12	23-94-96-12-host.colocrossing.com	TAG-53	08/10/2023	verified	High
3	23.94.99.19	23-94-99-19-host.colocrossing.com	TAG-53	08/10/2023	verified	High
4	23.94.99.22	23-94-99-22-host.colocrossing.com	TAG-53	08/10/2023	verified	High
5	23.94.99.26	23-94-99-26-host.colocrossing.com	TAG-53	08/10/2023	verified	High
6	23.94.99.30	23-94-99-30-host.colocrossing.com	TAG-53	08/10/2023	verified	High
7	23.94.152.50	23-94-152-50-host.colocrossing.com	TAG-53	08/10/2023	verified	High
8	23.94.231.161	23-94-231-161-host.colocrossing.com	TAG-53	08/10/2023	verified	High
9	23.94.236.80	23-94-236-80-host.colocrossing.com	TAG-53	08/10/2023	verified	High
10	23.254.201.243	hwsrv-1007024.hostwindsdns.com	TAG-53	12/17/2022	verified	High
11	23.254.253.127	client-23-254-253-127.hostwindsdns.com	TAG-53	08/10/2023	verified	High
12	45.8.146.119	vm1538642.stark-industries.solutions	TAG-53	08/10/2023	verified	High
13	45.8.146.213	jbreak.com	TAG-53	08/10/2023	verified	High
14	45.8.146.227	vm1562338.stark-industries.solutions	TAG-53	08/10/2023	verified	High
15	45.66.248.9		TAG-53	12/17/2022	verified	High
16	45.66.249.83		TAG-53	08/10/2023	verified	High
17	45.66.249.101	mta0.containers-xchange.com	TAG-53	08/10/2023	verified	High
18	45.86.230.61		TAG-53	08/10/2023	verified	High
19	45.86.230.104	rtgfv6j8k5.seafood24x7here.info	TAG-53	08/10/2023	verified	High
20	45.86.230.171	6qd0xg42xj.alantrislifecoaching.com	TAG-53	08/10/2023	verified	High
21	45.86.230.198		TAG-53	12/17/2022	verified	High
22	45.137.155.33	son.hfcegytp.com	TAG-53	08/10/2023	verified	High
23	45.144.30.160	vm1241811.stark-industries.solutions	TAG-53	08/10/2023	verified	High
24	45.144.31.92	vm854909.stark-industries.solutions	TAG-53	08/10/2023	verified	High
25	45.153.229.79	vm726095.stark-industries.solutions	TAG-53	12/17/2022	verified	High
26	XX.XX.XXX.XX	xx-xxx-xx-xx.xxxxxxx-xxx	Xxx-xx	12/17/2022	verified	High
27	XX.XX.XX.XXX	xxxxxx.xxx.xx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
28	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
29	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
30	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
31	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
32	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
33	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
34	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
35	XX.XX.XXX.XX	xxxxxx.xx.xxx.xx.xx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
36	XX.XXX.XX.XX	xxxxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
37	XX.XXX.XX.XXX		Xxx-xx	08/10/2023	verified	High
38	XX.XXX.XX.XX	xxxxxxxxxx.xxxx-xxxxxx-xxxx.xxx	Xxx-xx	08/10/2023	verified	High
39	XX.XXX.XX.XX	xxxxxxxxxx.xxxxxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
40	XX.XXX.XX.XX	xxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
41	XX.XXX.XX.XXX	xxxxx-x.xxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
42	XX.XXX.XX.XXX	xxx-xxx.xxxxxxxxxxxxxxx.xxxx	Xxx-xx	12/17/2022	verified	High
43	XX.XXX.XX.XX	xxxx.xxxxxxx.xxxx	Xxx-xx	08/10/2023	verified	High
44	XX.XXX.XX.XX	xxxxxx.xx-xxxxxxxxxxxx.xx	Xxx-xx	08/10/2023	verified	High
45	XX.XXX.XX.XXX	xxxx.xxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
46	XX.XXX.XX.XXX	xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
47	XX.XXX.XX.XXX	xxxxxxxxxx.xxxxxx.xxxx	Xxx-xx	08/10/2023	verified	High
48	XX.XXX.XX.XXX	xxxx.xxxxxxxxxxxxxx.xx	Xxx-xx	08/10/2023	verified	High
49	XX.XXX.XX.XX	xxxxx.xxxxxxxxx.xx	Xxx-xx	12/17/2022	verified	High
50	XX.XXX.XX.XX	xxxxxxx.xxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
51	XX.XXX.XX.XXX		Xxx-xx	08/10/2023	verified	High
52	XX.XXX.XX.XXX		Xxx-xx	08/10/2023	verified	High
53	XX.XXX.XX.XX		Xxx-xx	12/17/2022	verified	High
54	XX.XXX.XX.XX		Xxx-xx	08/10/2023	verified	High
55	XX.XXX.XX.XX	xx-xx.xx.xxxxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
56	XX.XXX.XXX.XX	xxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
57	XX.XXX.XX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxx-xx	08/10/2023	verified	High
58	XX.XXX.XXX.XX		Xxx-xx	08/10/2023	verified	High
59	XX.XXX.XXX.XXX		Xxx-xx	08/10/2023	verified	High
60	XX.XXX.X.XXX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxx-xx	08/10/2023	verified	High
61	XX.XXX.XX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxx-xx	08/10/2023	verified	High
62	XXX.XXX.XXX.XXX	xxxxxx.xxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
63	XXX.XXX.XXX.XXX	xxxxxx.xxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
64	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
65	XXX.XXX.XX.XX	xxx-xxx-xx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
66	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
67	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
68	XXX.XXX.XX.XX	xxx-xxx-xx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
69	XXX.XXX.XXX.XXX	xxxxx.xx	Xxx-xx	08/10/2023	verified	High
70	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
71	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
72	XXX.XX.XXX.XXX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
73	XXX.XX.XXX.XXX	xxxxxx-xxx-xx-xxx-xxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
74	XXX.XX.XXX.XX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
75	XXX.XX.XXX.XX	xxxxxxxxxxxxxxxxxx.xxxxx.xxx	Xxx-xx	08/10/2023	verified	High
76	XXX.XX.XXX.XXX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
77	XXX.XX.XXX.XXX	xxxxxx.xxxxxx-xxxxxxxx.xx	Xxx-xx	12/17/2022	verified	High
78	XXX.XX.XXX.XX	xxxxxx-xxx-xx-xxx-xx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
79	XXX.XX.XXX.XXX		Xxx-xx	08/10/2023	verified	High
80	XXX.XX.XXX.XXX		Xxx-xx	08/10/2023	verified	High
81	XXX.XX.XXX.XXX		Xxx-xx	12/17/2022	verified	High
82	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xx	Xxx-xx	12/17/2022	verified	High
83	XXX.XX.XXX.XX	xxxx.xx-xxx-xx-xxx.xx	Xxx-xx	08/10/2023	verified	High
84	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
85	XXX.XXX.XX.XXX	xxx-xxx-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
86	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
87	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
88	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
89	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
90	XXX.XXX.XXX.XXX		Xxx-xx	08/10/2023	verified	High
91	XXX.XXX.XXX.XXX	xxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxx-xx	08/10/2023	verified	High
92	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
93	XXX.XXX.XXX.XXX	xxxxxx.xxx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
94	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
95	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
96	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
97	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xx.xxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
98	XXX.XXX.XXX.XX	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxx-xx	08/10/2023	verified	High
99	XXX.X.XX.XXX	xxx-x-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
100	XXX.X.XX.XXX	xxx-x-xx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
101	XXX.X.XXX.XXX	xxx-x-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
102	XXX.X.XXX.XXX	xxx-x-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
103	XXX.X.XXX.XXX	xxx-x-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
104	XXX.X.XXX.XX	xxx-x-xxx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
105	XXX.X.XXX.XXX	xxx-x-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
106	XXX.X.XXX.XXX	xxx-x-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
107	XXX.XXX.XX.XXX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
108	XXX.XXX.XX.XXX	xxxxxx-xxx-xxx-xx-xxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
109	XXX.XXX.XXX.XXX	xxxxxx-xxx-xxx-xxx-xxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
110	XXX.XXX.XXX.XXX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
111	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
112	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
113	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
114	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
115	XXX.XXX.XXX.XX	xxxxxx-xxx-xxx-xxx-xx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
116	XXX.XXX.XXX.XXX	xxxxxx-xxx-xxx-xxx-xxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
117	XXX.XXX.XXX.XXX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	12/17/2022	verified	High
118	XXX.XXX.XXX.XXX	xxxxx-xxxxxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
119	XXX.XXX.XX.XXX		Xxx-xx	12/17/2022	verified	High
120	XXX.XXX.XX.XX		Xxx-xx	08/10/2023	verified	High
121	XXX.XXX.XX.XX	xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
122	XXX.XXX.XXX.XX	xxxx.xxxxxxxxxxx.xx	Xxx-xx	12/17/2022	verified	High
123	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High
124	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxx-xx	08/10/2023	verified	High

TTP - Tactics, Techniques, Procedures (3)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
2	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
3	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (8)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/secure/QueryComponent!Default.jspa	predictive	High
2	File	/v1/tasks/create/	predictive	High
3	File	/xxx-xxx-xxxxx/xxxxxxx	predictive	High
4	File	xxxxx/xxxxxxxx.xxx	predictive	High
5	File	xxxxx.xxx	predictive	Medium
6	Argument	xxxxxxxxxxxxxxxx	predictive	High
7	Argument	xxxxxxxx	predictive	Medium
8	Argument	xxxx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!