# UAC-0027 - Cyber Threat Intelligence

These _indicators_ were reported, collected, and generated during the [VulDB CTI analysis](https://vuldb.com/?kb.cti) of the actor known as [UAC-0027](https://vuldb.com/?actor.uac-0027). The _activity monitoring_ correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique _predictive model_ uses _big data_ to forecast activities and their characteristics.

_Live data_ and more _analysis capabilities_ are available at [https://vuldb.com/?actor.uac-0027](https://vuldb.com/?actor.uac-0027)

## Countries

These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with UAC-0027:

* [VN](https://vuldb.com/?country.vn)
* [CN](https://vuldb.com/?country.cn)
* [US](https://vuldb.com/?country.us)
* ...

There are 1 more country items available. Please use our online service to access the data.

## IOC - Indicator of Compromise

These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of UAC-0027.

ID | IP address | Hostname | Campaign | Confidence
-- | ---------- | -------- | -------- | ----------
1 | [1.14.140.47](https://vuldb.com/?ip.1.14.140.47) | - | - | High
2 | [1.197.79.9](https://vuldb.com/?ip.1.197.79.9) | 197.1.broad.ha.dynamic.163data.com.cn | - | High
3 | [1.240.81.27](https://vuldb.com/?ip.1.240.81.27) | - | - | High
4 | [2.32.162.61](https://vuldb.com/?ip.2.32.162.61) | net-2-32-162-61.cust.dsl.teletu.it | - | High
5 | [2.57.19.149](https://vuldb.com/?ip.2.57.19.149) | - | - | High
6 | [3.249.36.102](https://vuldb.com/?ip.3.249.36.102) | ec2-3-249-36-102.eu-west-1.compute.amazonaws.com | - | Medium
7 | [5.201.163.11](https://vuldb.com/?ip.5.201.163.11) | - | - | High
8 | [5.201.191.235](https://vuldb.com/?ip.5.201.191.235) | 235.mobinnet.net | - | High
9 | [8.137.17.159](https://vuldb.com/?ip.8.137.17.159) | - | - | High
10 | [8.137.23.237](https://vuldb.com/?ip.8.137.23.237) | - | - | High
11 | [8.142.71.135](https://vuldb.com/?ip.8.142.71.135) | - | - | High
12 | [12.24.187.179](https://vuldb.com/?ip.12.24.187.179) | - | - | High
13 | [14.17.76.133](https://vuldb.com/?ip.14.17.76.133) | - | - | High
14 | [14.17.76.202](https://vuldb.com/?ip.14.17.76.202) | - | - | High
15 | [14.139.245.95](https://vuldb.com/?ip.14.139.245.95) | - | - | High
16 | [14.176.231.58](https://vuldb.com/?ip.14.176.231.58) | static.vnpt.vn | - | High
17 | [14.194.76.98](https://vuldb.com/?ip.14.194.76.98) | static-98.76.194.14-tataidc.co.in | - | High
18 | [14.241.97.145](https://vuldb.com/?ip.14.241.97.145) | static.vnpt.vn | - | High
19 | [23.225.98.34](https://vuldb.com/?ip.23.225.98.34) | - | - | High
20 | [27.123.249.22](https://vuldb.com/?ip.27.123.249.22) | - | - | High
21 | [27.151.0.68](https://vuldb.com/?ip.27.151.0.68) | - | - | High
22 | [27.223.74.74](https://vuldb.com/?ip.27.223.74.74) | - | - | High
23 | [34.92.241.209](https://vuldb.com/?ip.34.92.241.209) | 209.241.92.34.bc.googleusercontent.com | - | Medium
24 | [35.228.174.104](https://vuldb.com/?ip.35.228.174.104) | 104.174.228.35.bc.googleusercontent.com | - | Medium
25 | [36.7.105.104](https://vuldb.com/?ip.36.7.105.104) | - | - | High
26 | [36.7.175.92](https://vuldb.com/?ip.36.7.175.92) | - | - | High
27 | [36.129.152.17](https://vuldb.com/?ip.36.129.152.17) | - | - | High
28 | [36.129.204.121](https://vuldb.com/?ip.36.129.204.121) | - | - | High
29 | [36.135.78.19](https://vuldb.com/?ip.36.135.78.19) | - | - | High
30 | [36.154.186.147](https://vuldb.com/?ip.36.154.186.147) | - | - | High
31 | [36.158.133.177](https://vuldb.com/?ip.36.158.133.177) | - | - | High
32 | [39.77.20.4](https://vuldb.com/?ip.39.77.20.4) | - | - | High
33 | [39.77.236.66](https://vuldb.com/?ip.39.77.236.66) | - | - | High
34 | [39.89.199.82](https://vuldb.com/?ip.39.89.199.82) | - | - | High
35 | [39.109.88.38](https://vuldb.com/?ip.39.109.88.38) | - | - | High
36 | [39.155.249.143](https://vuldb.com/?ip.39.155.249.143) | - | - | High
37 | [39.170.71.90](https://vuldb.com/?ip.39.170.71.90) | - | - | High
38 | [41.32.227.82](https://vuldb.com/?ip.41.32.227.82) | host-41.32.227.82.tedata.net | - | High
39 | [41.32.245.167](https://vuldb.com/?ip.41.32.245.167) | host-41.32.245.167.tedata.net | - | High
40 | [41.33.183.69](https://vuldb.com/?ip.41.33.183.69) | host-41.33.183.69.tedata.net | - | High
41 | [41.38.60.12](https://vuldb.com/?ip.41.38.60.12) | host-41.38.60.12.tedata.net | - | High
42 | [41.111.165.18](https://vuldb.com/?ip.41.111.165.18) | - | - | High
43 | [41.111.188.14](https://vuldb.com/?ip.41.111.188.14) | - | - | High
44 | [41.111.188.21](https://vuldb.com/?ip.41.111.188.21) | - | - | High
45 | [41.174.104.229](https://vuldb.com/?ip.41.174.104.229) | - | - | High
46 | [41.203.223.149](https://vuldb.com/?ip.41.203.223.149) | 41-203-223-149.safaricombusiness.co.ke | - | High
47 | [41.207.250.110](https://vuldb.com/?ip.41.207.250.110) | - | - | High
48 | [42.62.11.218](https://vuldb.com/?ip.42.62.11.218) | - | - | High
49 | [43.224.0.108](https://vuldb.com/?ip.43.224.0.108) | - | - | High
50 | [43.248.137.87](https://vuldb.com/?ip.43.248.137.87) | - | - | High
51 | [45.7.228.51](https://vuldb.com/?ip.45.7.228.51) | siawin1.cl | - | High
52 | [45.66.8.143](https://vuldb.com/?ip.45.66.8.143) | vm3171540.43ssd.had.wf | - | High
53 | [45.125.47.204](https://vuldb.com/?ip.45.125.47.204) | - | - | High
54 | [45.207.27.5](https://vuldb.com/?ip.45.207.27.5) | - | - | High
55 | [45.207.27.18](https://vuldb.com/?ip.45.207.27.18) | - | - | High
56 | [45.232.214.129](https://vuldb.com/?ip.45.232.214.129) | 45-232-214-129.67telecom.net.br | - | High
57 | [46.185.128.213](https://vuldb.com/?ip.46.185.128.213) | - | - | High
58 | [47.104.66.145](https://vuldb.com/?ip.47.104.66.145) | - | - | High
59 | [47.108.31.207](https://vuldb.com/?ip.47.108.31.207) | - | - | High
60 | [47.108.71.71](https://vuldb.com/?ip.47.108.71.71) | - | - | High
61 | [47.108.169.104](https://vuldb.com/?ip.47.108.169.104) | - | - | High
62 | [47.109.70.125](https://vuldb.com/?ip.47.109.70.125) | - | - | High
63 | [47.109.94.20](https://vuldb.com/?ip.47.109.94.20) | - | - | High
64 | [47.109.105.41](https://vuldb.com/?ip.47.109.105.41) | - | - | High
65 | [47.109.106.251](https://vuldb.com/?ip.47.109.106.251) | - | - | High
66 | [47.190.115.94](https://vuldb.com/?ip.47.190.115.94) | static-47-190-115-94.dlls.tx.frontiernet.net | - | High
67 | [49.156.148.22](https://vuldb.com/?ip.49.156.148.22) | - | - | High
68 | [58.18.132.105](https://vuldb.com/?ip.58.18.132.105) | - | - | High
69 | [58.27.195.92](https://vuldb.com/?ip.58.27.195.92) | 58-27-195-92.wateen.net | - | High
70 | [58.33.95.52](https://vuldb.com/?ip.58.33.95.52) | 52.95.33.58.broad.xw.sh.dynamic.163data.com.cn | - | High
71 | [58.56.164.82](https://vuldb.com/?ip.58.56.164.82) | - | - | High
72 | [58.64.186.47](https://vuldb.com/?ip.58.64.186.47) | 058064186047.ctinets.com | - | High
73 | [58.216.234.58](https://vuldb.com/?ip.58.216.234.58) | - | - | High
74 | [58.217.104.137](https://vuldb.com/?ip.58.217.104.137) | - | - | High
75 | [58.220.41.126](https://vuldb.com/?ip.58.220.41.126) | - | - | High
76 | [58.221.101.138](https://vuldb.com/?ip.58.221.101.138) | - | - | High
77 | [58.221.252.210](https://vuldb.com/?ip.58.221.252.210) | - | - | High
78 | [58.240.33.194](https://vuldb.com/?ip.58.240.33.194) | - | - | High
79 | [58.240.123.42](https://vuldb.com/?ip.58.240.123.42) | - | - | High
80 | [58.255.77.21](https://vuldb.com/?ip.58.255.77.21) | - | - | High
81 | [59.11.209.222](https://vuldb.com/?ip.59.11.209.222) | - | - | High
82 | [59.44.198.162](https://vuldb.com/?ip.59.44.198.162) | 162.198.44.59.broad.ly.ln.dynamic.163data.com.cn | - | High
83 | [59.95.101.125](https://vuldb.com/?ip.59.95.101.125) | - | - | High
84 | [59.175.137.34](https://vuldb.com/?ip.59.175.137.34) | - | - | High
85 | [59.188.3.135](https://vuldb.com/?ip.59.188.3.135) | fce135.satnw.com | - | High
86 | [60.3.123.17](https://vuldb.com/?ip.60.3.123.17) | - | - | High
87 | [60.10.1.45](https://vuldb.com/?ip.60.10.1.45) | hebei.10.60.in-addr.arpa | - | High
88 | [60.10.60.167](https://vuldb.com/?ip.60.10.60.167) | hebei.10.60.in-addr.arpa | - | High
89 | [60.10.64.51](https://vuldb.com/?ip.60.10.64.51) | hebei.10.60.in-addr.arpa | - | High
90 | [60.15.204.34](https://vuldb.com/?ip.60.15.204.34) | - | - | High
91 | [60.167.184.160](https://vuldb.com/?ip.60.167.184.160) | - | - | High
92 | [60.170.59.138](https://vuldb.com/?ip.60.170.59.138) | - | - | High
93 | [60.170.183.101](https://vuldb.com/?ip.60.170.183.101) | - | - | High
94 | [60.172.55.213](https://vuldb.com/?ip.60.172.55.213) | - | - | High
95 | [60.190.243.74](https://vuldb.com/?ip.60.190.243.74) | - | - | High
96 | [60.212.216.10](https://vuldb.com/?ip.60.212.216.10) | - | - | High
97 | [60.216.100.210](https://vuldb.com/?ip.60.216.100.210) | - | - | High
98 | [60.223.244.12](https://vuldb.com/?ip.60.223.244.12) | 12.244.223.60.adsl-pool.sx.cn | - | High
99 | [61.136.101.37](https://vuldb.com/?ip.61.136.101.37) | 37.101.136.61.ha.cnc | - | High
100 | [61.139.155.237](https://vuldb.com/?ip.61.139.155.237) | 237.155.139.61.adsl-pool.jlccptt.net.cn | - | High
101 | [61.146.235.242](https://vuldb.com/?ip.61.146.235.242) | - | - | High
102 | ... | ... | ... | ...

There are 403 more IOC items available. Please use our online service to access the data.

## TTP - Tactics, Techniques, Procedures

_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _UAC-0027_. This data is unique as it uses our predictive model for actor profiling.

ID | Technique | Weakness | Description | Confidence
-- | --------- | -------- | ----------- | ----------
1 | T1006 | CWE-21, CWE-22, CWE-23, CWE-24, CWE-29, CWE-36 | Path Traversal | High
2 | T1040 | CWE-319 | Authentication Bypass by Capture-replay | High
3 | T1055 | CWE-74, CWE-643 | Improper Neutralization of Data within XPath Expressions | High
4 | T1059 | CWE-94, CWE-1321 | Argument Injection | High
5 | T1059.007 | CWE-79, CWE-80 | Cross Site Scripting | High
6 | ... | ... | ... | ...

There are 18 more TTP items available. Please use our online service to access the data.

## IOA - Indicator of Attack

These _indicators of attack_ (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by UAC-0027. This data is unique as it uses our predictive model for actor profiling.

ID | Type | Indicator | Confidence
-- | ---- | --------- | ----------
1 | File | `/?p=products` | Medium
2 | File | `/?r=recruit/resume/edit&op=status` | High
3 | File | `/Account/login.php` | High
4 | File | `/add_classes.php` | High
5 | File | `/add_members.php` | High
6 | File | `/admin-manage-user.php` | High
7 | File | `/admin/` | Low
8 | File | `/admin/?page=maintenance/brand` | High
9 | File | `/admin/?page=system_info` | High
10 | File | `/admin/?page=user` | High
11 | File | `/admin/action/add_con.php` | High
12 | File | `/admin/action/delete-vaccine.php` | High
13 | File | `/admin/action/new-father.php` | High
14 | File | `/admin/action/update-deworm.php` | High
15 | File | `/Admin/add-admin.php` | High
16 | File | `/admin/admin-profile.php` | High
17 | File | `/admin/admin.php` | High
18 | File | `/admin/app/login_crud.php` | High
19 | File | `/admin/app/product.php` | High
20 | File | `/admin/app/profile_crud.php` | High
21 | File | `/admin/app/service_crud.php` | High
22 | File | `/admin/applicants/controller.php` | High
23 | File | `/admin/applicants/index.php` | High
24 | File | `/admin/bookdate.php` | High
25 | File | `/admin/booking-bwdates-reports-details.php` | High
26 | File | `/admin/booktime.php` | High
27 | File | `/admin/budget/manage_budget.php` | High
28 | File | `/admin/category/controller.php` | High
29 | File | `/admin/category/index.php` | High
30 | File | `/admin/company/controller.php` | High
31 | File | `/admin/company/index.php` | High
32 | File | `/admin/div_data/delete?divId=9` | High
33 | File | `/admin/edit-admin.php` | High
34 | File | `/admin/edit_categories.php` | High
35 | File | `/admin/edit_supplier.php` | High
36 | File | `/admin/employee/controller.php` | High
37 | File | `/admin/employee/index.php` | High
38 | File | `/admin/index.php` | High
39 | File | `/admin/list_ipAddressPolicy.php` | High
40 | File | `/admin/list_localuser.php` | High
41 | File | `/admin/list_resource_icon.php?action=delete` | High
42 | File | `/admin/login.php` | High
43 | File | `/Admin/login.php` | High
44 | File | `/admin/maintenance/brand.php` | High
45 | File | `/admin/maintenance/manage_category.php` | High
46 | File | `/admin/manage-students.php` | High
47 | File | `/admin/menu/toEdit` | High
48 | File | `/admin/operations/expense_category.php` | High
49 | File | `/admin/orders/update_status.php` | High
50 | File | `/admin/orders/view_order.php` | High
51 | File | `/admin/pages/edit_chicken.php` | High
52 | File | `/admin/pages/student-print.php` | High
53 | File | `/admin/pages/update_go.php` | High
54 | File | `/admin/product/manage.php` | High
55 | File | `/admin/product/manage_product.php` | High
56 | File | `/admin/read.php?mudi=announContent` | High
57 | File | `/admin/read.php?mudi=getSignal` | High
58 | File | `/admin/receipt.php` | High
59 | File | `/admin/rooms.php` | High
60 | File | `/admin/sales/index.php` | High
61 | File | `/admin/singlelogin.php` | High
62 | File | `/admin/sys_sql_query.php` | High
63 | File | `/admin/update-rooms.php` | High
64 | File | `/admin/update-users.php` | High
65 | File | `/admin/user/controller.php` | High
66 | File | `/admin/user/index.php` | High
67 | File | `/admin/users.php` | High
68 | File | `/admin/vacancy/controller.php` | High
69 | File | `/admin/vacancy/index.php` | High
70 | File | `/admin/vote_edit.php` | High
71 | File | `/adminapi/system/crud` | High
72 | File | `/adminapi/system/file/openfile` | High
73 | File | `/admin_route/dec_service_credits.php` | High
74 | File | `/admin_route/inc_service_credits.php` | High
75 | File | `/admin_system/api.php` | High
76 | File | `/ajax-api.php` | High
77 | File | `/ajax.php?action=save_company` | High
78 | File | `/analysisProject/pagingQueryData` | High
79 | File | `/api.php` | Medium
80 | File | `/api/client/editemedia.php` | High
81 | File | `/api/controllers/admin/app/AppController.php` | High
82 | File | `/api/controllers/admin/app/ComboController.php` | High
83 | File | `/api/controllers/common/UploadsController.php` | High
84 | File | `/api/controllers/merchant/app/ComboController.php` | High
85 | File | `/api/controllers/merchant/design/MaterialController.php` | High
86 | File | `/api/controllers/merchant/shop/PosterController.php` | High
87 | File | `/api/sys/login` | High
88 | File | `/api/sys/set_passwd` | High
89 | File | `/api/v1/toolbox/device/update/swap` | High
90 | File | `/app/admin/controller/Upload.php` | High
91 | File | `/app/ajax/search_sales_report.php` | High
92 | File | `/app/api/controller/caiji.php` | High
93 | File | `/app/api/controller/collect.php` | High
94 | File | `/app/api/controller/default/File.php` | High
95 | File | `/app/controller/Setup.php` | High
96 | File | `/app/Http/Controllers/ImageController.php` | High
97 | File | `/app/index/controller/Common.php` | High
98 | File | `/app/middleware/TokenVerify.php` | High
99 | File | `/application/index/common.php` | High
100 | File | `/application/index/controller/Databasesource.php` | High
101 | File | `/application/index/controller/Datament.php` | High
102 | File | `/application/index/controller/File.php` | High
103 | File | `/application/index/controller/Icon.php` | High
104 | File | `/application/index/controller/Screen.php` | High
105 | File | `/application/index/controller/Service.php` | High
106 | File | `/application/index/controller/Unity.php` | High
107 | File | `/application/pay/controller/Api.php` | High
108 | File | `/application/plugins/controller/Upload.php` | High
109 | File | `/application/websocket/controller/Setting.php` | High
110 | File | `/apply/index.php` | High
111 | File | `/apps/login_auth.php` | High
112 | File | `/apps/reg_go.php` | High
113 | File | `/apps/system/api/user.go` | High
114 | File | `/apps/system/router/upload.go` | High
115 | File | `/apps/system/services/role_menu.go` | High
116 | File | `/att_add.php` | Medium
117 | File | `/billing/bill/edit/` | High
118 | ... | ... | ...

There are 1045 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

## References

The following list contains _external sources_ which discuss the actor and the associated activities:

* https://cert.gov.ua/article/6277422

## Literature

The following _articles_ explain our unique predictive cyber threat intelligence:

* [VulDB Cyber Threat Intelligence Documentation](https://vuldb.com/?kb.cti)
* [Cyber Threat Intelligence - Early Anticipation of Attacks](https://www.scip.ch/en/?labs.20201022)

## License

(c) [1997-2024](https://vuldb.com/?kb.changelog) by [vuldb.com](https://vuldb.com/?kb.about). All data on this page is shared under the license [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/). Questions? Check the [FAQ](https://vuldb.com/?kb.faq), read the [documentation](https://vuldb.com/?kb) or [contact us](https://vuldb.com/?contact)!
