Mirrors
/
cyber_threat_intelligence
mirror of https://github.com/vuldb/cyber_threat_intelligence
6
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
cyber_threat_intelligence/campaigns/COVID-19/README.md

19 KiB
Raw Blame History

COVID-19 - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the campaign known as COVID-19. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with COVID-19:

There are 4 more country items available. Please use our online service to access the data.

Actors

These actors are associated with COVID-19 or other actors linked to the campaign.

ID Actor Confidence
1 APT29 High
2 Unknown High
3 Vicious Panda High
4 ... ...

There are 1 more actor items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of COVID-19.

ID IP address Hostname Actor Confidence
1 2.47.112.152 net-2-47-112-152.cust.vodafonedsl.it Unknown High
2 2.56.214.178 - Unknown High
3 5.75.75.75 - Unknown High
4 5.101.0.209 - Unknown High
5 5.157.87.204 redirect.yourhosting.nl Unknown High
6 5.181.156.14 no-rdns.mivocloud.com Unknown High
7 5.182.210.2 server30.flaunt7.com Unknown High
8 5.182.210.84 - Unknown High
9 5.188.60.131 sk.s5.ans1.ns148.ztomy.com Unknown High
10 5.189.132.254 vmi429632.contaboserver.net Unknown High
11 5.255.96.187 - Unknown High
12 8.208.15.85 - Unknown High
13 8.208.78.192 - Unknown High
14 8.209.69.101 - Unknown High
15 8.209.70.110 - Unknown High
16 8.250.169.254 - Unknown High
17 8.250.183.254 - Unknown High
18 8.251.5.254 - Unknown High
19 8.251.15.254 - Unknown High
20 8.251.31.254 - Unknown High
21 12.162.84.2 - Unknown High
22 14.161.6.60 static.vnpt.vn Unknown High
23 23.19.227.235 - Unknown High
24 23.227.38.64 shops.myshopify.com Unknown High
25 23.254.215.229 hwsrv-869108.hostwindsdns.com Unknown High
26 24.94.237.248 cpe-24-94-237-248.sw.res.rr.com Unknown High
27 24.196.13.216 024-196-013-216.res.spectrum.com Unknown High
28 24.247.182.167 024-247-182-167.res.spectrum.com Unknown High
29 24.247.182.240 024-247-182-240.res.spectrum.com Unknown High
30 31.31.77.83 - Unknown High
31 31.146.61.34 31-146-61-34.dsl.utg.ge Unknown High
32 31.202.128.80 31-202-128-80-kh.maxnet.ua Unknown High
33 35.242.251.130 130.251.242.35.bc.googleusercontent.com Unknown Medium
34 37.1.209.51 - Unknown High
35 37.1.212.70 surprisefoun.reveltip.com Unknown High
36 37.1.221.65 - Unknown High
37 37.49.226.13 - Unknown High
38 37.49.226.21 - Unknown High
39 37.49.226.142 - Unknown High
40 37.49.226.182 - Unknown High
41 37.70.131.107 107.131.70.37.rev.sfr.net Unknown High
42 37.152.88.55 - Unknown High
43 37.208.106.146 mail.joerrens.com Unknown High
44 38.132.124.233 - Unknown High
45 41.60.200.34 41.60.200.34.liquidtelecom.net Unknown High
46 41.185.29.128 abp79-nix01.wadns.net Unknown High
47 41.221.164.77 - Unknown High
48 42.51.192.231 - Unknown High
49 45.55.49.33 - Unknown High
50 45.55.179.121 - Unknown High
51 45.56.64.36 li914-36.members.linode.com Unknown High
52 45.76.218.232 45.76.218.232.vultrusercontent.com Unknown High
53 45.81.226.17 vm3471381.43ssd.had.wf Unknown High
54 45.95.168.85 maxko-hosting.com Unknown High
55 45.95.168.98 maxko-hosting.com Unknown High
56 45.118.136.92 - Unknown High
57 45.123.190.167 - APT29 High
58 45.128.132.55 - Unknown High
59 45.128.134.14 - Unknown High
60 45.128.134.20 - Unknown High
61 45.129.229.48 - APT29 High
62 45.138.72.143 uziel.example.com Unknown High
63 45.138.72.155 sp200177.example.com Unknown High
64 45.142.212.126 ivan.temporary Unknown High
65 45.142.212.192 blackswan95.example1.com Unknown High
66 45.142.212.209 augenweide.com Unknown High
67 45.142.213.59 vm423520.stark-industries.solutions Unknown High
68 45.143.138.47 - Unknown High
69 45.148.120.13 - Unknown High
70 45.148.120.153 - Unknown High
71 45.153.40.105 - Unknown High
72 45.153.184.67 - Unknown High
73 45.161.242.102 45-161-242-102.megalink.com.br Unknown High
74 46.4.157.37 static.37.157.4.46.clients.your-server.de Unknown High
75 46.17.6.116 116-6-17-46.static.fxw.nl Unknown High
76 46.17.107.65 ulasiuk21.example.com Unknown High
77 46.19.143.155 growthinside.net Unknown High
78 46.20.1.226 ns1.ceyhunsezer.com Unknown High
79 46.28.111.142 enkindu.jsuchy.net Unknown High
80 46.101.202.66 grafana.jagu.dev Transparent Tribe High
81 46.105.131.87 pop.adven.fr Unknown High
82 46.166.187.223 . Unknown High
83 46.214.11.172 46-214-11-172.next-gen.ro Unknown High
84 47.150.248.161 - Unknown High
85 50.28.51.143 - Unknown High
86 50.87.253.50 box2161.bluehost.com Unknown High
87 50.116.78.109 intersearchmedia.com Unknown High
88 51.38.93.190 ip190.ip-51-38-93.eu Unknown High
89 51.79.129.4 ip4.ip-51-79-129.net Unknown High
90 51.89.73.158 ip158.ip-51-89-73.eu Unknown High
91 51.159.23.217 jambold.co.uk Unknown High
92 51.254.164.244 y9gs.gaurented.com Unknown High
93 51.254.164.245 ip245.ip-51-254-164.eu Unknown High
94 54.39.139.67 ip67.ip-54-39-139.net Unknown High
95 58.171.38.26 - Unknown High
96 58.177.172.160 058177172160.ctinets.com Unknown High
97 59.20.65.102 - Unknown High
98 59.120.5.154 59-120-5-154.hinet-ip.hinet.net Unknown High
99 60.130.173.117 softbank060130173117.bbtec.net Unknown High
100 60.250.78.22 60-250-78-22.hinet-ip.hinet.net Unknown High
101 61.92.159.208 061092159208.ctinets.com Unknown High
102 63.142.252.21 - Unknown High
103 63.250.38.195 business61-5.web-hosting.com Unknown High
104 63.250.38.240 anakmas.org Unknown High
105 63.250.47.83 - Unknown High
106 64.44.51.113 srv44.pahlmeyer.life Unknown High
107 64.188.25.205 64.188.25.205.static.quadranet.com Unknown High
108 ... ... ... ...

There are 426 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used within COVID-19. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
2 T1068 CWE-264, CWE-266, CWE-284 Execution with Unnecessary Privileges High
3 T1110.001 CWE-798 Improper Restriction of Excessive Authentication Attempts High
4 ... ... ... ...

There are 8 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration during COVID-19. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File // Low
2 File /admin/index.php?slides High
3 File /apply.cgi Medium
4 File /config/getuser High
5 File /domains/list High
6 File /form/index.php?module=getjson High
7 File /ghost/preview High
8 File /include/chart_generator.php High
9 File /nova/bin/detnet High
10 File /ptms/classes/Users.php High
11 File /public/admin.php High
12 File /public/login.htm High
13 File /public/login.htm?errormsg=&loginurl=%22%3E%3Csvg%20onload=prompt%28/XSS/%29%3E High
14 File /rest/api/latest/user/avatar/temporary High
15 File /s/ Low
16 File /SAP_Information_System/controllers/add_admin.php High
17 File /scripts/unlock_tasks.php High
18 File /tmp/app/.env High
19 File /uncpath/ Medium
20 File /user-utils/users/md5.json High
21 File /userfs/bin/tcapi High
22 File /usr/bin/pkexec High
23 File /wp-admin/admin-ajax.php High
24 File 14all.cgi/14all-1.1.cgi/traffic.cgi/mrtg.cgi High
25 File 500page.jsp Medium
26 File accountrecoveryendpoint/recoverpassword.do High
27 File admin.php Medium
28 File admin/conf_users_edit.php High
29 File afr.php Low
30 ... ... ...

There are 253 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the campaign and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2022 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!