Mirrors
/
cyber_threat_intelligence
mirror of https://github.com/vuldb/cyber_threat_intelligence
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
cyber_threat_intelligence/actors/Remcos/README.md

11 KiB
Raw Blame History

Remcos - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Remcos. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.remcos

Campaigns

The following campaigns are known and can be associated with Remcos:

  • Ukraine

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Remcos:

There are 3 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Remcos.

ID IP address Hostname Campaign Confidence
1 3.94.41.167 ec2-3-94-41-167.compute-1.amazonaws.com - Medium
2 5.61.37.41 - - High
3 5.181.234.139 - - High
4 5.181.234.145 - - High
5 5.249.226.166 uw19.uniweb.no - High
6 8.253.139.120 - - High
7 13.107.42.12 1drv.ms - High
8 13.107.43.12 - - High
9 13.107.43.13 - - High
10 13.225.230.20 server-13-225-230-20.jfk51.r.cloudfront.net - High
11 13.250.255.10 ec2-13-250-255-10.ap-southeast-1.compute.amazonaws.com - Medium
12 15.197.142.173 a4ec4c6ea1c92e2e6.awsglobalaccelerator.com - High
13 20.36.253.92 - - High
14 20.42.73.27 - - High
15 20.190.151.7 - - High
16 20.190.151.8 - - High
17 20.190.151.68 - - High
18 20.190.151.70 - - High
19 20.190.151.131 - - High
20 20.190.151.132 - - High
21 20.190.151.133 - - High
22 20.190.152.21 - - High
23 20.190.154.139 - - High
24 23.3.13.88 a23-3-13-88.deploy.static.akamaitechnologies.com - High
25 23.21.27.29 ec2-23-21-27-29.compute-1.amazonaws.com - Medium
26 23.21.205.229 ec2-23-21-205-229.compute-1.amazonaws.com - Medium
27 23.38.131.139 a23-38-131-139.deploy.static.akamaitechnologies.com - High
28 23.56.9.181 a23-56-9-181.deploy.static.akamaitechnologies.com - High
29 23.78.173.83 a23-78-173-83.deploy.static.akamaitechnologies.com - High
30 23.82.12.29 - - High
31 23.196.74.222 a23-196-74-222.deploy.static.akamaitechnologies.com - High
32 23.199.63.11 a23-199-63-11.deploy.static.akamaitechnologies.com - High
33 23.199.63.83 a23-199-63-83.deploy.static.akamaitechnologies.com - High
34 23.223.37.181 a23-223-37-181.deploy.static.akamaitechnologies.com - High
35 23.227.38.74 - - High
36 34.96.116.138 138.116.96.34.bc.googleusercontent.com - Medium
37 34.102.136.180 180.136.102.34.bc.googleusercontent.com - Medium
38 34.117.168.233 233.168.117.34.bc.googleusercontent.com - Medium
39 34.202.33.33 ec2-34-202-33-33.compute-1.amazonaws.com - Medium
40 35.205.61.67 67.61.205.35.bc.googleusercontent.com - Medium
41 35.214.144.124 124.144.214.35.bc.googleusercontent.com - Medium
42 37.1.206.16 free.ispiria.net - High
43 37.19.193.217 unn-37-19-193-217.cdn77.com - High
44 37.120.138.222 - - High
45 37.123.118.150 - - High
46 ... ... ... ...

There are 179 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Remcos. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
2 T1068 CWE-264, CWE-284 Execution with Unnecessary Privileges High
3 T1110.001 CWE-798 Improper Restriction of Excessive Authentication Attempts High
4 ... ... ... ...

There are 4 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Remcos. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File .htaccess Medium
2 File .htpasswd Medium
3 File /../conf/config.properties High
4 File /drivers/infiniband/core/cm.c High
5 File /ext/phar/phar_object.c High
6 File /forum/away.php High
7 File /horde/util/go.php High
8 File /images/ Medium
9 File /inc/parser/xhtml.php High
10 File /index.php?page=signup High
11 File /login Low
12 File /modules/profile/index.php High
13 File /one_church/userregister.php High
14 File /out.php Medium
15 File /public/plugins/ High
16 File /SAP_Information_System/controllers/add_admin.php High
17 File /SASWebReportStudio/logonAndRender.do High
18 File /secure/admin/InsightDefaultCustomFieldConfig.jspa High
19 File /secure/admin/ViewInstrumentation.jspa High
20 File /system/proxy High
21 File /tmp/phpglibccheck High
22 File adclick.php Medium
23 File add.php Low
24 File addentry.php Medium
25 File addressbookprovider.php High
26 File admin.jcomments.php High
27 File admin/pageUploadCSV.php High
28 File ajax_udf.php Medium
29 File AppCompatCache.exe High
30 File application.js.php High
31 File arm/lithium-codegen-arm.cc High
32 ... ... ...

There are 268 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2022 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!