# CVE-2022-21587 - Cyber Threat Intelligence

These _indicators_ were reported, collected, and generated during the [VulDB CTI analysis](https://vuldb.com/?kb.cti) of the campaign known as _CVE-2022-21587_. The _activity monitoring_ correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique _predictive model_ uses _big data_ to forecast activities and their characteristics.

_Live data_ and more _analysis capabilities_ are available at [https://vuldb.com/?actor](https://vuldb.com/?actor)

## Countries

These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with CVE-2022-21587:

* [US](https://vuldb.com/?country.us)
* [CN](https://vuldb.com/?country.cn)
* [DE](https://vuldb.com/?country.de)
* ...

There are 9 more country items available. Please use our online service to access the data.

## Actors

These _actors_ are associated with CVE-2022-21587 or other actors linked to the campaign.

ID | Actor | Confidence
-- | ----- | ----------
1 | [Prophet Spider](https://vuldb.com/?actor.prophet_spider) | High

## IOC - Indicator of Compromise

These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of CVE-2022-21587.

ID | IP address | Hostname | Actor | Confidence
-- | ---------- | -------- | ----- | ----------
1 | [23.95.44.214](https://vuldb.com/?ip.23.95.44.214) | 23-95-44-214-host.colocrossing.com | [Prophet Spider](https://vuldb.com/?actor.prophet_spider) | High
2 | [45.61.136.188](https://vuldb.com/?ip.45.61.136.188) | - | [Prophet Spider](https://vuldb.com/?actor.prophet_spider) | High
3 | [195.123.240.183](https://vuldb.com/?ip.195.123.240.183) | vds1094676.hosted-by-itldc.com | [Prophet Spider](https://vuldb.com/?actor.prophet_spider) | High

## TTP - Tactics, Techniques, Procedures

_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used within CVE-2022-21587. This data is unique as it uses our predictive model for actor profiling.

ID | Technique | Weakness | Description | Confidence
-- | --------- | -------- | ----------- | ----------
1 | T1006 | CWE-21, CWE-22, CWE-24 | Path Traversal | High
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
3 | T1055 | CWE-74 | Injection | High
4 | T1059 | CWE-94 | Argument Injection | High
5 | ... | ... | ... | ...

There are 17 more TTP items available. Please use our online service to access the data.

## IOA - Indicator of Attack

These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration during CVE-2022-21587. This data is unique as it uses our predictive model for actor profiling.

ID | Type | Indicator | Confidence
-- | ---- | --------- | ----------
1 | File | `/.dbus-keyrings` | High
2 | File | `/?p=products` | Medium
3 | File | `/?r=recruit/resume/edit&op=status` | High
4 | File | `/account/delivery` | High
5 | File | `/addQuestion.php` | High
6 | File | `/admin/` | Low
7 | File | `/admin/?page=user/list` | High
8 | File | `/admin/about-us.php` | High
9 | File | `/admin/action/add_con.php` | High
10 | File | `/admin/action/edit_chicken.php` | High
11 | File | `/admin/action/new-feed.php` | High
12 | File | `/admin/add-category.php` | High
13 | File | `/admin/addemployee.php` | High
14 | File | `/admin/admin-profile.php` | High
15 | File | `/admin/api/theme-edit/` | High
16 | File | `/admin/article/article-edit-run.php` | High
17 | File | `/admin/attendance_row.php` | High
18 | File | `/admin/cashadvance_row.php` | High
19 | File | `/admin/clientview.php` | High
20 | File | `/admin/cms.php` | High
21 | File | `/admin/deduction_row.php` | High
22 | File | `/admin/del_feedback.php` | High
23 | File | `/admin/edit-accepted-appointment.php` | High
24 | File | `/admin/edit-services.php` | High
25 | File | `/admin/employee_row.php` | High
26 | File | `/admin/featured.php` | High
27 | File | `/admin/invoice.php` | High
28 | File | `/admin/login.php` | High
29 | File | `/admin/maintenance/brand.php` | High
30 | File | `/admin/makehtml_freelist_action.php` | High
31 | File | `/admin/manage-users.php` | High
32 | File | `/admin/pages/student-print.php` | High
33 | File | `/admin/payment.php` | High
34 | File | `/admin/photo.php` | High
35 | File | `/admin/read.php?mudi=getSignal` | High
36 | File | `/admin/regester.php` | High
37 | File | `/admin/searchview.php` | High
38 | File | `/admin/students/manage.php` | High
39 | File | `/admin/sys_sql_query.php` | High
40 | File | `/admin_route/inc_service_credits.php` | High
41 | File | `/ajax.php?action=read_msg` | High
42 | File | `/api.php` | Medium
43 | File | `/api/wechat/app_auth` | High
44 | File | `/app/api/controller/default/Sqlite.php` | High
45 | File | `/application/index/controller/Databasesource.php` | High
46 | File | `/application/index/controller/File.php` | High
47 | File | `/application/index/controller/Icon.php` | High
48 | File | `/application/index/controller/Screen.php` | High
49 | File | `/application/index/controller/Unity.php` | High
50 | File | `/application/pay/controller/Api.php` | High
51 | File | `/application/plugins/controller/Upload.php` | High
52 | File | `/application/websocket/controller/Setting.php` | High
53 | File | `/apply/index.php` | High
54 | File | `/apps/login_auth.php` | High
55 | File | `/App_Resource/UEditor/server/upload.aspx` | High
56 | File | `/artist-display.php` | High
57 | File | `/assets/php/upload.php` | High
58 | File | `/auth/auth.php?user=1` | High
59 | File | `/author/list?limit=10&offset=0&order=desc` | High
60 | File | `/b2b-supermarket/shopping-cart` | High
61 | File | `/bin/boa` | Medium
62 | File | `/blog` | Low
63 | ... | ... | ...

There are 547 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

## References

The following list contains _external sources_ which discuss the campaign and the associated activities:

* https://exchange.xforce.ibmcloud.com/report/details/guid:83252d980b8ff3736f528d0afbea7eba

## Literature

The following _articles_ explain our unique predictive cyber threat intelligence:

* [VulDB Cyber Threat Intelligence Documentation](https://vuldb.com/?kb.cti)
* [Cyber Threat Intelligence - Early Anticipation of Attacks](https://www.scip.ch/en/?labs.20201022)

## License

(c) [1997-2024](https://vuldb.com/?kb.changelog) by [vuldb.com](https://vuldb.com/?kb.about). All data on this page is shared under the license [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/). Questions? Check the [FAQ](https://vuldb.com/?kb.faq), read the [documentation](https://vuldb.com/?kb) or [contact us](https://vuldb.com/?contact)!
