cyber_threat_intelligence/actors/Congo Republic Unknown/README.md

80 lines
5.0 KiB
Markdown
Raw Normal View History

2022-11-26 11:43:44 +00:00
# Congo Republic Unknown - Cyber Threat Intelligence
These _indicators_ were reported, collected, and generated during the [VulDB CTI analysis](https://vuldb.com/?kb.cti) of the actor known as [Congo Republic Unknown](https://vuldb.com/?actor.congo_republic_unknown). The _activity monitoring_ correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique _predictive model_ uses _big data_ to forecast activities and their characteristics.
_Live data_ and more _analysis capabilities_ are available at [https://vuldb.com/?actor.congo_republic_unknown](https://vuldb.com/?actor.congo_republic_unknown)
## Countries
These _countries_ are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Congo Republic Unknown:
* [FR](https://vuldb.com/?country.fr)
2023-03-31 07:30:34 +00:00
* [US](https://vuldb.com/?country.us)
2022-11-26 11:43:44 +00:00
## IOC - Indicator of Compromise
These _indicators of compromise_ (IOC) indicate associated network resources which are known to be part of research and attack activities of Congo Republic Unknown.
ID | IP address | Hostname | Campaign | Confidence
-- | ---------- | -------- | -------- | ----------
1 | [5.62.61.100](https://vuldb.com/?ip.5.62.61.100) | r-100-61-62-5.consumer-pool.prcdn.net | - | High
2 | [5.62.63.76](https://vuldb.com/?ip.5.62.63.76) | r-76-63-62-5.consumer-pool.prcdn.net | - | High
2023-03-31 07:30:34 +00:00
3 | [5.175.77.0](https://vuldb.com/?ip.5.175.77.0) | - | - | High
4 | [31.209.128.0](https://vuldb.com/?ip.31.209.128.0) | 0.128.209.31.as43256.net | - | High
5 | [31.209.130.0](https://vuldb.com/?ip.31.209.130.0) | 0.130.209.31.as43256.net | - | High
6 | [31.209.132.0](https://vuldb.com/?ip.31.209.132.0) | 0.132.209.31.as43256.net | - | High
7 | [41.60.24.0](https://vuldb.com/?ip.41.60.24.0) | - | - | High
8 | [41.60.212.0](https://vuldb.com/?ip.41.60.212.0) | - | - | High
9 | [41.75.64.0](https://vuldb.com/?ip.41.75.64.0) | - | - | High
10 | [41.77.220.0](https://vuldb.com/?ip.41.77.220.0) | - | - | High
11 | [41.78.192.0](https://vuldb.com/?ip.41.78.192.0) | - | - | High
12 | [41.79.232.0](https://vuldb.com/?ip.41.79.232.0) | - | - | High
13 | [41.79.234.0](https://vuldb.com/?ip.41.79.234.0) | - | - | High
14 | [41.189.192.0](https://vuldb.com/?ip.41.189.192.0) | - | - | High
15 | [41.190.72.0](https://vuldb.com/?ip.41.190.72.0) | - | - | High
16 | [41.190.80.0](https://vuldb.com/?ip.41.190.80.0) | - | - | High
17 | [41.190.232.0](https://vuldb.com/?ip.41.190.232.0) | - | - | High
18 | [41.194.60.0](https://vuldb.com/?ip.41.194.60.0) | - | - | High
19 | [41.194.71.0](https://vuldb.com/?ip.41.194.71.0) | - | - | High
20 | [41.194.74.0](https://vuldb.com/?ip.41.194.74.0) | - | - | High
21 | [41.197.47.0](https://vuldb.com/?ip.41.197.47.0) | - | - | High
22 | [41.207.115.0](https://vuldb.com/?ip.41.207.115.0) | - | - | High
23 | [41.207.121.0](https://vuldb.com/?ip.41.207.121.0) | - | - | High
24 | [41.207.125.0](https://vuldb.com/?ip.41.207.125.0) | - | - | High
25 | [41.215.252.0](https://vuldb.com/?ip.41.215.252.0) | - | - | High
26 | [41.218.109.0](https://vuldb.com/?ip.41.218.109.0) | - | - | High
27 | [41.221.218.0](https://vuldb.com/?ip.41.221.218.0) | - | - | High
28 | [41.222.196.0](https://vuldb.com/?ip.41.222.196.0) | 0-196-222-41.r.airtel.cd | - | High
29 | [41.222.216.0](https://vuldb.com/?ip.41.222.216.0) | - | - | High
30 | ... | ... | ... | ...
There are 117 more IOC items available. Please use our online service to access the data.
2022-11-26 11:43:44 +00:00
## TTP - Tactics, Techniques, Procedures
_Tactics, techniques, and procedures_ (TTP) summarize the suspected MITRE ATT&CK techniques used by _Congo Republic Unknown_. This data is unique as it uses our predictive model for actor profiling.
ID | Technique | Weakness | Description | Confidence
-- | --------- | -------- | ----------- | ----------
2023-03-31 07:30:34 +00:00
1 | T1068 | CWE-264 | Execution with Unnecessary Privileges | High
2 | T1552 | CWE-640 | ASP.NET Misconfiguration: Password in Configuration File | High
3 | T1592 | CWE-200 | Configuration | High
2022-11-26 11:43:44 +00:00
## References
The following list contains _external sources_ which discuss the actor and the associated activities:
* https://github.com/firehol/blocklist-ipsets/blob/master/geolite2_country/country_cg.netset
2023-03-31 07:30:34 +00:00
* https://github.com/firehol/blocklist-ipsets/blob/master/ip2location_country/ip2location_country_cd.netset
2022-11-26 11:43:44 +00:00
## Literature
The following _articles_ explain our unique predictive cyber threat intelligence:
* [VulDB Cyber Threat Intelligence Documentation](https://vuldb.com/?kb.cti)
* [Cyber Threat Intelligence - Early Anticipation of Attacks](https://www.scip.ch/en/?labs.20201022)
## License
2023-01-30 12:54:37 +00:00
(c) [1997-2023](https://vuldb.com/?kb.changelog) by [vuldb.com](https://vuldb.com/?kb.about). All data on this page is shared under the license [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/). Questions? Check the [FAQ](https://vuldb.com/?kb.faq), read the [documentation](https://vuldb.com/?kb) or [contact us](https://vuldb.com/?contact)!