Water Hydra Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (13)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	12
zh	2

Country

us	4
cn	2
ru	2

Actors

Water Hydra	2

Activities

Interest

Timeline

Type

Not Defined	6
Connectivity Software	2
Web Browser	2
Bug Tracking Software	2

Vendor

Citrix	2
Allegro	2
GPAC	2
Google	2
GitLab	2

Product

Citrix NetScaler ADC	2
Citrix NetScaler Gateway	2
Allegro RomPager	2
GPAC Advanced Content	2
Google Chrome	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Ivanti Endpoint Manager Mobile File path traversal	7.2	7.1	$0-$5k	$0-$5k	High	Official Fix	0.67227	0.00	CVE-2023-35081
2	SolarWinds Orion Job Scheduler JobRouterService WCF Service permission assignment	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01171	0.00	CVE-2021-31475
3	Ivanti Connect Secure/Policy Secure Web command injection	8.6	8.6	$0-$5k	$0-$5k	High	Workaround	0.97334	0.04	CVE-2024-21887
4	Fortinet FortiManager/FortiAnalyzer server-side request forgery	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00065	0.00	CVE-2021-32603
5	Perl Regular Expression Compiler heap-based overflow	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2023-47038
6	Citrix NetScaler ADC/NetScaler Gateway code injection	9.8	9.6	$25k-$100k	$5k-$25k	High	Official Fix	0.91186	0.07	CVE-2023-3519
7	GitLab Community Edition/Enterprise Edition CI Variable information disclosure	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00091	0.00	CVE-2021-22252
8	Google Chrome WebRTC use after free	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00430	0.00	CVE-2021-30602
9	Geopython PyWPS/OWSLib XML xml external entity reference	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00175	0.05	CVE-2021-39371
10	GPAC Advanced Content MPEG-4 Decoding integer overflow	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00210	0.00	CVE-2021-21837
11	Current Book Plugin Title cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.00	CVE-2021-24538
12	Allegro RomPager Cookie code	7.3	6.4	$0-$5k	$0-$5k	High	Official Fix	0.97212	0.06	CVE-2014-9222

Campaigns (1)

These are the campaigns that can be associated with the actor:

CVE-2024-21412

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	64.31.63.70	70-63-31-64.static.reverse.lstn.net	Water Hydra	CVE-2024-21412	02/23/2024	verified	High
2	XX.XX.XX.XXX	xxx-xx-xx-xx.xxxxxx.xxxxxxx.xxxx.xxx	Xxxxx Xxxxx	Xxx-xxxx-xxxxx	02/23/2024	verified	High
3	XX.XX.XXX.XX		Xxxxx Xxxxx	Xxx-xxxx-xxxxx	02/23/2024	verified	High
4	XXX.XX.XXX.XXX	xxxxxxxxx	Xxxxx Xxxxx	Xxx-xxxx-xxxxx	02/23/2024	verified	High
5	XXX.XX.XXX.XXX	xxxxxxxx	Xxxxx Xxxxx	Xxx-xxxx-xxxxx	02/23/2024	verified	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	High
3	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!