RomCom Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (18)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	14
ru	2
zh	2

Country

us	10
ru	6
cn	2

Actors

Vidar	1
RomCom	1
ShadowPad	1
FIN7	1

Activities

Interest

Timeline

Type

Not Defined	14
Database Software	2

Vendor

Not Defined	8
APSystems	2
Microsoft	2
Fortinet	2
Fortra	2

Product

KeePass	2
ampleShop	2
APSystems ECU-R	2
Microsoft SQL Server	2
rgb2hex	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Booked Scheduler reservation_save.php access control	4.9	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00169	0.00	CVE-2023-24058
2	Communigate Pro Pronto! Mail Composer Stored cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00165	0.00	CVE-2018-18621
3	Bitcoin Core dumpwallet RPC Call .bitcoin path traversal	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00102	0.00	CVE-2021-3195
4	ampleShop category.cfm sql injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00621	0.03	CVE-2006-2038
5	Microsoft SQL Server FILESTREAM Path information disclosure	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00353	0.00	CVE-2016-7252
6	Fortra GoAnywhere MFT License Response Servlet deserialization	6.7	6.6	$0-$5k	$0-$5k	High	Official Fix	0.96969	0.05	CVE-2023-0669
7	Advanced Electron Forum Private Message Module Persistent cross site scripting	3.7	3.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00067	0.03	CVE-2018-13000
8	Fortinet FortiWeb HTTP Request stack-based overflow	8.3	8.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00084	0.00	CVE-2023-23780
9	APSystems ECU-R Administration Interface command injection	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00198	0.00	CVE-2022-45699
10	rgb2hex redos	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00117	0.07	CVE-2018-25061
11	KeePass XML Configuration File missing encryption	4.5	4.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00056	0.04	CVE-2023-24055
12	Signal Desktop Attachment information disclosure	3.4	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.00	CVE-2023-24069
13	Fortinet FortiTester os command injection	8.5	8.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00136	0.00	CVE-2022-35845
14	Apache Tomcat access control	7.3	7.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.01225	0.04	CVE-2011-3190
15	IBM Lotus Notes information disclosure	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00180	0.04	CVE-2016-3674
16	Microsoft Exchange Server information disclosure	5.3	4.8	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00112	0.04	CVE-2022-34692

Campaigns (2)

These are the campaigns that can be associated with the actor:

RomCom
Xxxxxxx

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	46.246.98.15	46-246-98-15.static.glesys.net	RomCom	Ukraine	06/08/2023	verified	High
2	XX.XXX.XX.XXX	xxxxx.xx-xx-xxx-xx.xx	Xxxx Xxxxxx	Xxxxxx	06/02/2023	verified	High
3	XX.XXX.XXX.XXX		Xxxx Xxxxxx	Xxxxxx	06/02/2023	verified	High
4	XXX.XXX.XX.XXX		Xxxxxx	Xxxxxxx	06/08/2023	verified	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-19	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-492	CWE-XXXX	Xxxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-157	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/MIME/INBOX-MM-1/	predictive	High
2	File	category.cfm	predictive	Medium
3	File	xxxxxxxxxxx_xxxx.xxx	predictive	High
4	File	~/.xxxxxxx	predictive	Medium
5	Argument	xxx	predictive	Low
6	Argument	xxxxxxxx	predictive	Medium
7	Argument	xxxxxx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!