Dfni Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (31)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	26
ru	4
es	2

Country

us	18
ua	10
ru	4

Actors

BEAR	1
GreyEnergy	1
Dfni	1
Dridex	1
Clop	1

Activities

Interest

Timeline

Type

Not Defined	12
Bug Tracking Software	2
Photo Gallery Software	2
WordPress Plugin	2
Router Operating System	2

Vendor

Not Defined	16
IBM	2
D-Link	2
Oracle	2
APC	2

Product

IBM Security AppScan Enterprise	2
D-Link DCS-930L	2
D-Link DCS-932L	2
Oracle Primavera Contract Management	2
GitLab	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	IBM Security AppScan Enterprise Enterprise Source Database cryptographic issues	9.8	8.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00082	0.00	CVE-2013-3989
2	raspap-webgui activate_ovpncfg.php command injection	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.88069	0.00	CVE-2022-39986
3	PHP Everywhere Plugin Shortcode Privilege Escalation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00108	0.00	CVE-2022-24663
4	Add Link to Facebook Plugin profile.php cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00057	0.03	CVE-2018-5214
5	openmosix libmosix.c this memory corruption	4.0	4.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00042	0.00	CVE-2008-1865
6	User Post Gallery Plugin authorization	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05192	0.00	CVE-2022-4060
7	eSST Monitoring unrestricted upload	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00116	0.00	CVE-2023-41631
8	Boa Web Server HEAD Method improper authorization	6.3	6.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00112	0.09	CVE-2022-45956
9	GitLab Privilege Escalation	5.1	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00118	0.00	CVE-2021-22263
10	ThinkPHP unrestricted upload	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.06	CVE-2022-44289
11	SuiteCRM Accounts/Contacts/Opportunities/Leads csv injection	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00063	0.00	CVE-2020-15301
12	cocoapods-downloader argument injection	6.8	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00131	0.00	CVE-2022-21223
13	PHP Everywhere Plugin Metabox Privilege Escalation	8.8	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00108	0.03	CVE-2022-24664
14	APC UPS Network Management Card 2 AOS Remote Monitoring Credentials insufficiently protected credentials	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00222	0.00	CVE-2018-7820
15	APC Switched Rack Pdu improper authentication	7.5	6.6	$0-$5k	$0-$5k	Unproven	Unavailable	0.01355	0.00	CVE-2007-6226
16	Dropbear SSH dropbearconvert input validation	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00956	0.04	CVE-2016-7407
17	Dropbear SSH input validation	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02911	0.04	CVE-2016-7406
18	Supermicro H8dgu-f Intelligent Platform Management Interface PrivilegeCallBack input validation	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01615	0.00	CVE-2013-3609
19	Drupal permission assignment	5.8	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00088	0.00	CVE-2017-6928
20	D-Link DCS-930L/DCS-932L Authentication information disclosure	5.3	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00000	0.05

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	5.149.248.134		Dfni		04/08/2022	verified	High
2	XXX.XXX.XXX.XX	xxxxxx.xx.xxx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxx		04/08/2022	verified	High

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-137	CWE-88	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-102	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/ajax/openvpn/activate_ovpncfg.php	predictive	High
2	File	FlexCell.ocx	predictive	Medium
3	File	xxxxxxxx.x	predictive	Medium
4	File	xxxxx-xxxxxxx.xxx	predictive	High
5	File	xx-xxxxx/xxxxxxx.xxx	predictive	High
6	Library	xxx/xxxxxxx-xxxxxxxxx-x.x.x.xxx	predictive	High
7	Argument	xxxxx_xxxxxxxx_xx	predictive	High
8	Argument	xxx_xx	predictive	Low
9	Argument	xx	predictive	Low
10	Argument	xxxx	predictive	Low
11	Argument	xxx_xx	predictive	Low
12	Argument	xxxx	predictive	Low
13	Argument	xxxxxxxx/xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!