MosaicRegressor Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (40)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

zh	22
en	18

Country

cn	34

Actors

MosaicRegressor	5
Cobalt Strike	3
Venom RAT	1

Activities

Interest

Timeline

Type

Not Defined	12
Groupware Software	4
Web Server	4
Content Management System	2
Enterprise Resource Planning Software	2

Vendor

Not Defined	8
Microsoft	4
Synacor	4
Kentico	2
Oracle	2

Product

Synacor Zimbra Collaboration	4
Kentico CMS	2
Oracle PeopleSoft Enterprise PeopleTools	2
OpenProject	2
Synology SSO Server	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00073	0.05	CVE-2023-3233
2	Synacor Zimbra Collaboration xml external entity reference	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00441	0.00	CVE-2016-9924
3	MikroTik RouterOS Resolver memory corruption	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00201	0.00	CVE-2020-20249
4	Oracle Secure Backup Remote Code Execution	9.8	9.8	$25k-$100k	$0-$5k	Not Defined	Not Defined	0.95519	0.00	CVE-2011-2261
5	Oracle Secure Backup improper authentication	5.3	5.3	$5k-$25k	$0-$5k	High	Not Defined	0.12570	0.00	CVE-2010-0904
6	OpenProject Public Project robots.txt information disclosure	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00086	0.06	CVE-2023-33960
7	Synology SSO Server WebAPI path traversal	4.7	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00068	0.00	CVE-2022-27620
8	All-in-One WP Migration Plugin class-ai1wm-backups.php path traversal	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00097	0.04	CVE-2022-1476
9	Joomla CMS sql injection	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.81423	0.06	CVE-2015-7857
10	CKeditor FCKeditor print_textinputs_var cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00467	0.00	CVE-2012-4000
11	webTareas New Profile cross-site request forgery	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00174	0.00	CVE-2021-41916
12	WordPress wp_crop_image path traversal	5.9	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.95564	0.03	CVE-2019-8943
13	Concrete CMS File Manager injection	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00979	0.03	CVE-2021-22968
14	WordPress WP_Query sql injection	6.3	6.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.93847	0.09	CVE-2022-21661
15	Linux Kernel msr access control	5.1	4.6	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00196	0.04	CVE-2013-0268
16	HP Printer/MFP cross-site request forgery	6.5	6.5	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00073	0.00	CVE-2018-5921
17	Plesk Obsidian Reflected cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00151	0.04	CVE-2020-11583
18	FreePBX index_amp.php cross site scripting	8.8	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00773	0.00	CVE-2012-4870
19	Thycotic Secret Server Remote Desktop Launcher Temporary credentials management	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00222	0.00	CVE-2014-4861
20	ZyXEL VMG3312-B10B default.cfg credentials management	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00201	0.05	CVE-2018-18754

IOC - Indicator of Compromise (16)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Identified	Type	Confidence
1	43.252.228.75	MosaicRegressor	08/10/2022	verified	High
2	43.252.228.84	MosaicRegressor	08/10/2022	verified	High
3	43.252.228.179	MosaicRegressor	08/10/2022	verified	High
4	43.252.228.252	MosaicRegressor	08/10/2022	verified	High
5	XX.XXX.XXX.XXX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
6	XX.XXX.XXX.XXX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
7	XXX.XX.XXX.XX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
8	XXX.XX.XX.XX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
9	XXX.XX.XX.XXX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
10	XXX.XXX.XX.XXX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
11	XXX.XX.X.X	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
12	XXX.XX.XX.XX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
13	XXX.XX.XXX.XX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
14	XXX.XX.XXX.XXX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
15	XXX.XXX.XX.XX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High
16	XXX.XXX.XXX.XX	Xxxxxxxxxxxxxxx	08/10/2022	verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	TXXXX	CAPEC-242	CWE-XX	Xxxxxxxx Xxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (14)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/dev/cpu/*/msr	predictive	High
2	File	/index_amp.php	predictive	High
3	File	/xxxxxx.xxx	predictive	Medium
4	File	/xxx/xxx/xxxxx	predictive	High
5	File	xxx/xxxxxxxxxx/xx/xxxxxxxxxxxxxxxx.xxx	predictive	High
6	File	xxxxxxxx/xxxxxxxxxx.xxxx	predictive	High
7	File	xxx/xxxxxxx.xxx	predictive	High
8	File	xxx/xxxx/xxx.x	predictive	High
9	Library	~/xxx/xxxxx/xxxxx-xxxxx-xxxxxxx.xxx	predictive	High
10	Argument	xxxxxxx	predictive	Low
11	Argument	xxxx	predictive	Low
12	Argument	xxxxxxxxx	predictive	Medium
13	Input Value	.xxx?/../../xxxx.xxx	predictive	High
14	Input Value	xxxx+x@!xxxx+	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!