Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-07-05 18:01:41 +00:00
Code Issues Packages Projects Releases Wiki Activity
2d4f99a727
cyber_threat_intelligence/actors/Lebanon Unknown/README.md
Marc Ruef 2d4f99a727 Update February 2023
2023-02-20 20:18:09 +01:00

10 KiB
Raw Blame History

Lebanon Unknown - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Lebanon Unknown. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.lebanon_unknown

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Lebanon Unknown:

There are 22 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Lebanon Unknown.

ID IP address Hostname Campaign Confidence
1 5.1.43.0 - - High
2 5.8.128.0 - - High
3 5.45.184.0 subnet.gcore.lu - High
4 5.57.0.0 - - High
5 5.62.60.216 r-216-60-62-5.consumer-pool.prcdn.net - High
6 5.62.62.208 r-208-62-62-5.consumer-pool.prcdn.net - High
7 5.100.240.0 - - High
8 5.181.52.0 - - High
9 31.170.96.0 - - High
10 37.209.248.0 - - High
11 37.230.134.0 - - High
12 45.12.70.128 spineless.yourbandinc.com - High
13 45.12.71.128 - - High
14 45.63.98.97 45.63.98.97.vultrusercontent.com - High
15 45.84.36.0 - - High
16 45.88.224.0 - - High
17 45.94.52.0 - - High
18 45.129.136.0 - - High
19 45.131.20.0 - - High
20 45.142.84.0 - - High
21 45.142.136.0 - - High
22 45.145.60.0 - - High
23 45.155.132.0 - - High
24 45.159.184.0 2pc45-0.rconx.com - High
25 46.17.72.0 - - High
26 46.19.192.0 - - High
27 46.20.96.0 mta0.mail.gdmlservice.com - High
28 46.36.202.31 - - High
29 46.36.202.32 - - High
30 46.227.248.0 - - High
31 46.243.146.0 - - High
32 57.188.5.0 - - High
33 62.84.64.0 - - High
34 63.216.96.0 - - High
35 65.171.14.76 - - High
36 66.96.122.192 - - High
37 66.102.33.64 - - High
38 77.42.128.0 - - High
39 77.75.88.0 - - High
40 77.235.128.0 - - High
41 77.246.64.0 - - High
42 78.40.176.0 - - High
43 78.41.56.0 - - High
44 78.108.160.0 - - High
45 80.77.176.0 - - High
46 80.78.26.40 504e1a28.host.njalla.net - High
47 80.79.144.0 - - High
48 80.81.144.0 - - High
49 80.83.16.0 - - High
50 80.89.176.0 - - High
51 82.112.160.0 - - High
52 82.146.160.0 - - High
53 82.198.25.0 82.198.25.0.satgate.net - High
54 83.171.192.0 - - High
55 83.222.162.0 - - High
56 83.222.164.0 - - High
57 ... ... ... ...

There are 224 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Lebanon Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-22, CWE-23, CWE-425 Pathname Traversal High
2 T1055 CWE-74 Injection High
3 T1059 CWE-94, CWE-1321 Cross Site Scripting High
4 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
5 T1068 CWE-264, CWE-269, CWE-284 Execution with Unnecessary Privileges High
6 ... ... ... ...

There are 20 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Lebanon Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File .php.gif Medium
2 File /Admin/login.php High
3 File /admin/submit-articles High
4 File /aux Low
5 File /cgi-bin/supervisor/PwdGrp.cgi High
6 File /cgi-bin/system_mgr.cgi High
7 File /coreframe/app/order/admin/index.php High
8 File /Default/Bd Medium
9 File /employeeview.php High
10 File /etc/quantum/quantum.conf High
11 File /etc/sudoers Medium
12 File /EXCU_SHELL Medium
13 File /filemanager/php/connector.php High
14 File /forum/away.php High
15 File /forum/PostPrivateMessage High
16 File /hrm/controller/employee.php High
17 File /hrm/employeeadd.php High
18 File /hrm/employeeview.php High
19 File /inc/extensions.php High
20 File /includes/event-management/index.php High
21 File /index.php Medium
22 File /Items/*/RemoteImages/Download High
23 File /KeepAlive.jsp High
24 File /mc Low
25 File /member/index/login.html High
26 File /mkshop/Men/profile.php High
27 File /modules/profile/index.php High
28 File /opt/zimbra/jetty/webapps/zimbra/public High
29 File /phppath/php Medium
30 File /php_action/editProductImage.php High
31 File /product/savenewproduct.php?flag=1 High
32 File /products/details.asp High
33 File /rest/api/1.0/issues/{id}/ActionsAndOperations High
34 File /secure/admin/RestoreDefaults.jspa High
35 File /secure/EditSubscription.jspa High
36 File /secure/QueryComponent!Default.jspa High
37 File /services/Card/findUser High
38 File /services/details.asp High
39 File /spip.php Medium
40 File /uncpath/ Medium
41 File /usr/bin/pkexec High
42 File /var/log/qualys/qualys-cloud-agent-scan.log High
43 File /view-property.php High
44 File /wp-content/plugins/updraftplus/admin.php High
45 File 4.edu.php Medium
46 File account.asp Medium
47 File adclick.php Medium
48 File add.exe Low
49 File admin.php Medium
50 File admin/adminlien.php3 High
51 File admin/conf_users_edit.php High
52 File admin/import/class-import-settings.php High
53 File admin/index.php High
54 File admin/login.asp High
55 File admin/login.php High
56 File admin/panels/uploader/admin.uploader.php High
57 File admin/vqmods.app/vqmods.inc.php High
58 File admin/_cmdstat.jsp High
59 File admin_class.php High
60 File admin_view_image.php High
61 File Advance/Premium/Standard High
62 File advsearch_h.asp High
63 File ajax_invoice.php High
64 File akocomments.php High
65 ... ... ...

There are 566 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!