DazzleSpy Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (13)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

zh	10
en	4

Country

cn	14

Actors

DazzleSpy	1
Cobalt Strike	1
ShadowPad	1

Activities

Interest

Timeline

Type

Not Defined	4
Network Encryption Software	2
Router Operating System	2
E-Commerce Management Software	2
Jenkins Plugin	2

Vendor

DPTech	2
Ubiquiti	2
SourceCodester	2
osCommerce	2
TrueConf	2

Product

DPTech VPN	2
Ubiquiti EdgeMAX EdgeRouter	2
SourceCodester Guest Management System	2
osCommerce Online Merchant	2
TrueConf Server	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	TrueConf Server sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00656	0.04	CVE-2022-46764
2	NotificationX Plugin SQL Statement sql injection	5.6	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02414	0.04	CVE-2022-0349
3	AddToAny Share Buttons Plugin Image Button Setting cross site scripting	2.4	2.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00053	0.03	CVE-2021-24616
4	DPTech VPN information disclosure	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00150	0.02	CVE-2022-34593
5	Apache Tomcat Request Header information disclosure	5.6	5.6	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00300	0.04	CVE-2020-17527
6	Ganglia Ganglia-web Remote Code Execution	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.21470	0.03	CVE-2012-3448
7	Openfind Mail2000 Access Control privileges management	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.02	CVE-2020-12776
8	SourceCodester Guest Management System myform.php cross site scripting	4.4	4.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00138	0.00	CVE-2022-2811
9	osCommerce Online Merchant unknown vulnerability	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00214	0.00	CVE-2012-2991
10	Oracle Database Oracle Application Express unknown vulnerability	5.4	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00054	0.00	CVE-2020-2973
11	Minio Console Operator Console missing authentication	8.6	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05383	0.00	CVE-2021-41266
12	Ubiquiti EdgeMAX EdgeRouter Firmware Update channel accessible	8.1	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00315	0.04	CVE-2021-22909
13	Active Choices Plugin cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.00	CVE-2021-21616

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	88.218.192.128	88.218.192.128.static.xtom.com	DazzleSpy		03/05/2022	verified	High

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
2	TXXXX	CAPEC-122	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-466	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxx	predictive	High
5	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (3)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	myform.php	predictive	Medium
2	Argument	xxxx	predictive	Low
3	Argument	xx_xx	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!