Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-07-05 18:01:41 +00:00
Code Issues Packages Projects Releases Wiki Activity
2d4f99a727
cyber_threat_intelligence/actors/New Zealand Unknown/README.md
Marc Ruef 2d4f99a727 Update February 2023
2023-02-20 20:18:09 +01:00

26 KiB
Raw Blame History

New Zealand Unknown - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as New Zealand Unknown. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.new_zealand_unknown

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with New Zealand Unknown:

There are 21 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of New Zealand Unknown.

ID IP address Hostname Campaign Confidence
1 5.181.67.0 - - High
2 8.39.204.0 - - High
3 14.1.32.0 14.1.32.0.host.layer2.co.nz - High
4 14.1.64.0 - - High
5 14.128.4.0 - - High
6 14.137.0.0 ip-14-137-0-0.kinect.net.nz - High
7 17.86.216.0 - - High
8 23.46.209.4 a23-46-209-4.deploy.static.akamaitechnologies.com - High
9 23.46.209.12 a23-46-209-12.deploy.static.akamaitechnologies.com - High
10 23.46.209.20 a23-46-209-20.deploy.static.akamaitechnologies.com - High
11 23.46.209.28 a23-46-209-28.deploy.static.akamaitechnologies.com - High
12 23.46.209.36 a23-46-209-36.deploy.static.akamaitechnologies.com - High
13 23.46.209.45 a23-46-209-45.deploy.static.akamaitechnologies.com - High
14 23.46.209.46 a23-46-209-46.deploy.static.akamaitechnologies.com - High
15 23.46.209.52 a23-46-209-52.deploy.static.akamaitechnologies.com - High
16 23.46.209.60 a23-46-209-60.deploy.static.akamaitechnologies.com - High
17 23.46.209.68 a23-46-209-68.deploy.static.akamaitechnologies.com - High
18 23.216.54.4 a23-216-54-4.deploy.static.akamaitechnologies.com - High
19 23.216.54.12 a23-216-54-12.deploy.static.akamaitechnologies.com - High
20 23.216.54.20 a23-216-54-20.deploy.static.akamaitechnologies.com - High
21 23.216.54.28 a23-216-54-28.deploy.static.akamaitechnologies.com - High
22 23.254.104.104 - - High
23 23.254.104.112 - - High
24 23.254.104.160 - - High
25 23.254.104.192 - - High
26 23.254.106.4 - - High
27 23.254.106.11 - - High
28 23.254.106.12 - - High
29 23.254.106.16 - - High
30 23.254.106.32 - - High
31 23.254.106.64 - - High
32 23.254.106.128 - - High
33 27.0.233.0 - - High
34 27.0.234.0 0-234-0-27.static.webhorizon.net - High
35 27.96.64.0 - - High
36 27.110.120.0 - - High
37 27.111.12.0 us0.2talk.com - High
38 27.121.96.0 - - High
39 27.123.20.0 - - High
40 27.252.0.0 0.0.252.27.dyn.cust.vf.net.nz - High
41 32.42.177.84 - - High
42 34.99.12.0 0.12.99.34.bc.googleusercontent.com - Medium
43 34.99.26.0 0.26.99.34.bc.googleusercontent.com - Medium
44 37.35.105.226 pac8.meridin.net - High
45 37.35.105.228 plnuk3.plenacom.com - High
46 43.224.120.0 43-224-120-0.ip.cis.gen.nz - High
47 43.224.250.0 - - High
48 43.225.49.0 - - High
49 43.225.200.0 - - High
50 43.226.8.0 - - High
51 43.226.216.0 - - High
52 43.228.156.0 - - High
53 43.228.156.128 - - High
54 43.228.156.144 - - High
55 43.228.156.148 - - High
56 43.228.156.150 - - High
57 43.228.156.152 - - High
58 43.228.156.156 - - High
59 43.228.156.160 - - High
60 43.228.156.164 - - High
61 43.228.156.166 - - High
62 43.228.156.168 - - High
63 43.228.156.173 - - High
64 43.228.156.174 - - High
65 43.228.156.176 - - High
66 43.228.156.192 - - High
67 43.231.192.0 43-231-192-0.primowireless.co.nz - High
68 43.239.92.0 - - High
69 43.239.96.0 - - High
70 43.239.180.0 - - High
71 43.239.248.0 - - High
72 43.240.32.0 - - High
73 43.243.21.0 - - High
74 43.243.22.0 - - High
75 43.243.56.0 - - High
76 43.243.196.0 - - High
77 43.245.52.0 server-0-fpr17.ipv4.syd02.ds.network - High
78 43.245.80.0 - - High
79 43.245.172.0 - - High
80 43.245.240.0 - - High
81 43.247.172.0 43-247-172-0.dynamic.lightwire.co.nz - High
82 43.249.72.0 - - High
83 43.249.196.0 - - High
84 43.249.200.0 - - High
85 43.251.155.0 - - High
86 43.252.64.0 - - High
87 43.254.20.0 - - High
88 43.255.24.0 43-255-24-0.acsdataglobal.net - High
89 43.255.160.0 - - High
90 45.8.70.0 - - High
91 45.12.70.172 that-vi-xarpa.alltieinc.com - High
92 45.12.71.172 - - High
93 45.40.192.0 - - High
94 45.41.0.0 - - High
95 45.41.215.0 - - High
96 45.42.166.0 - - High
97 45.64.48.0 - - High
98 45.64.60.0 - - High
99 45.64.116.0 - - High
100 45.64.200.0 - - High
101 45.65.4.0 - - High
102 45.112.60.0 - - High
103 45.113.8.0 rdns.45.113.8.0.sth.nz - High
104 45.117.36.0 45-117-36-0.dynamic.lightwire.co.nz - High
105 45.118.188.0 - - High
106 45.119.100.0 - - High
107 45.120.116.0 - - High
108 45.123.208.0 - - High
109 45.125.168.0 - - High
110 45.125.244.0 - - High
111 45.126.128.0 - - High
112 45.252.191.0 - - High
113 45.253.124.0 - - High
114 45.254.254.0 - - High
115 47.72.0.0 47-72-0-0.dsl.dyn.ihug.co.nz - High
116 49.0.28.0 - - High
117 49.50.192.0 - - High
118 49.50.224.0 - - High
119 49.50.240.0 - - High
120 49.143.228.0 0.228.143.49.static.amuri.net - High
121 49.156.50.0 - - High
122 49.224.0.0 0.0.224.49.dyn.cust.vf.net.nz - High
123 49.255.72.0 static-0.72.255.49.in-addr.VOCUS.net.au - High
124 49.255.75.0 static-0.75.255.49.in-addr.VOCUS.net.au - High
125 49.255.159.0 - - High
126 49.255.210.0 ip-0.210.255.49.in-addr.VOCUS.net.au - High
127 57.70.128.0 - - High
128 58.28.0.0 ip-58-28-0-0.wxnz.net - High
129 58.84.36.0 rdns.58.84.36.0.sth.nz - High
130 58.84.48.0 - - High
131 58.84.224.0 58-84-224-0.nzwireless.co.nz - High
132 59.153.20.0 59-153-20-0.static.cello.co.nz - High
133 60.234.0.0 default-rdns.vocus.co.nz - High
134 64.252.174.0 server-64-252-174-0.syd4.r.cloudfront.net - High
135 64.252.184.0 server-64-252-184-0.syd4.r.cloudfront.net - High
136 65.170.37.24 - - High
137 66.102.40.192 - - High
138 70.132.28.0 server-70-132-28-0.cdg50.r.cloudfront.net - High
139 74.80.124.0 - - High
140 85.190.253.0 - - High
141 101.53.192.0 ip-101-53-192-0.kinect.net.nz - High
142 101.98.0.0 default-rdns.vocus.co.nz - High
143 101.100.0.0 101-100-0-0.vectorcommunications.net.nz - High
144 101.100.128.0 - - High
145 101.110.112.0 - - High
146 103.2.120.0 - - High
147 103.2.140.0 net-e2.smtp2go.com - High
148 103.3.232.0 - - High
149 103.4.121.0 - - High
150 103.4.136.0 - - High
151 103.4.152.0 0.152.4.103.ip.2degrees.nz - High
152 103.5.28.0 static.vista.co - High
153 103.5.71.0 - - High
154 103.5.72.0 - - High
155 103.5.80.0 - - High
156 103.5.108.0 - - High
157 103.5.156.0 - - High
158 103.5.224.0 - - High
159 103.6.28.0 - - High
160 103.6.64.0 - - High
161 103.6.89.0 - - High
162 103.6.144.0 - - High
163 103.6.212.0 - - High
164 103.7.96.0 - - High
165 103.7.168.0 - - High
166 103.8.16.0 - - High
167 103.8.72.0 - - High
168 103.8.80.0 - - High
169 103.8.140.0 - - High
170 103.8.232.0 103-8-232-0.primowireless.co.nz - High
171 103.8.252.0 - - High
172 103.9.40.0 103-9-40-0.flip.co.nz - High
173 103.9.106.0 - - High
174 103.9.216.0 0.host-103-9-216.compassnet.co.nz - High
175 103.9.236.0 - - High
176 103.10.233.0 - - High
177 103.11.124.0 - - High
178 103.11.178.0 - - High
179 103.11.240.0 103-11-240-0.xtreme.net.nz - High
180 103.13.8.0 - - High
181 103.13.39.0 - - High
182 103.13.116.0 - - High
183 103.14.3.0 - - High
184 103.14.40.0 - - High
185 103.14.68.0 ip-103-14-68-0.static.vorco.net - High
186 103.14.140.0 103-14-140-0.ip.cis.gen.nz - High
187 103.14.216.0 - - High
188 103.15.75.0 103-15-75-0.eid.co.nz - High
189 103.15.126.0 - - High
190 103.15.152.0 - - High
191 103.16.20.0 103-16-20-0.static.ccl.net.nz - High
192 103.16.172.0 - - High
193 103.16.180.0 - - High
194 103.18.56.0 - - High
195 103.18.58.0 - - High
196 103.18.118.0 103-18-118-0.dynamic.lightwire.co.nz - High
197 103.18.136.0 - - High
198 103.18.200.0 - - High
199 103.19.4.0 - - High
200 103.19.10.0 103-19-10-0.static.2talk.co.nz - High
201 103.19.100.0 - - High
202 103.20.136.0 - - High
203 103.20.255.0 - - High
204 103.21.172.0 - - High
205 103.21.193.0 - - High
206 103.21.194.0 - - High
207 103.22.202.0 - - High
208 103.22.234.0 103-22-234-0.unison.co.nz.234.22.103.in-addr.arpa - High
209 103.22.244.0 103-22-244-0.static.tq.net.nz - High
210 103.23.16.0 103-23-16-0.citylink.co.nz - High
211 103.23.71.0 103-23-71-0.eggs.school.nz - High
212 103.23.142.0 - - High
213 103.23.212.0 - - High
214 103.24.28.0 - - High
215 103.24.40.0 - - High
216 103.24.136.0 - - High
217 103.25.116.0 - - High
218 103.25.188.0 - - High
219 103.25.244.0 - - High
220 103.26.16.0 103.26.16.0.static.netspeed.net.nz - High
221 103.27.37.0 - - High
222 103.27.52.0 - - High
223 103.27.88.0 - - High
224 103.27.121.0 - - High
225 103.27.216.0 - - High
226 103.27.227.0 - - High
227 103.28.251.0 103.28.251.0.ip.incapdns.net - High
228 103.29.30.0 103-29-3-0.static.2talk.co.nz - High
229 103.29.244.0 - - High
230 103.35.88.0 103-35-88-0.voffice.net.nz - High
231 103.36.108.0 - - High
232 103.36.128.0 - - High
233 103.37.204.0 - - High
234 103.38.164.0 default-rdns.vocus.co.nz - High
235 103.39.20.0 - - High
236 103.39.44.0 103.39.44.0.3t.nz - High
237 103.39.114.0 - - High
238 103.40.81.0 - - High
239 103.42.190.0 - - High
240 103.43.206.0 - - High
241 103.43.212.0 103-43-212-0.static.rise.as - High
242 103.44.45.0 - - High
243 103.44.110.0 - - High
244 103.44.164.0 - - High
245 103.44.222.0 - - High
246 103.45.240.0 - - High
247 103.46.231.0 0-231-46-103.nz.as58511.net - High
248 103.47.3.0 103-47-3-0.static.cello.co.nz - High
249 103.48.8.0 - - High
250 103.48.118.0 - - High
251 ... ... ... ...

There are 999 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by New Zealand Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23, CWE-425 Pathname Traversal High
2 T1055 CWE-74 Injection High
3 T1059 CWE-88, CWE-94, CWE-1321 Cross Site Scripting High
4 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
5 T1068 CWE-264, CWE-269, CWE-274, CWE-284 Execution with Unnecessary Privileges High
6 ... ... ... ...

There are 22 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by New Zealand Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File %PROGRAMFILES(X86)%\Steam High
2 File .github/workflows/combine-prs.yml High
3 File /Admin/add-student.php High
4 File /admin/api/admin/articles/ High
5 File /Admin/login.php High
6 File /apilog.php Medium
7 File /auth/session High
8 File /cgi-bin/wlogin.cgi High
9 File /connectors/index.php High
10 File /dev/block/mmcblk0rpmb High
11 File /DocSystem/Repos/getReposAllUsers.do High
12 File /DXR.axd Medium
13 File /etc/tomcat8/Catalina/attack High
14 File /face-recognition-php/facepay-master/camera.php High
15 File /filemanager/upload.php High
16 File /forum/away.php High
17 File /fos/admin/ajax.php?action=login High
18 File /fos/admin/index.php?page=menu High
19 File /home/masterConsole High
20 File /home/sendBroadcast High
21 File /hrm/employeeadd.php High
22 File /hrm/employeeview.php High
23 File /index.php Medium
24 File /items/view_item.php High
25 File /jsoa/hntdCustomDesktopActionContent High
26 File /login/index.php High
27 File /lookin/info Medium
28 File /manager/index.php High
29 File /medical/inventories.php High
30 File /modules/profile/index.php High
31 File /modules/projects/vw_files.php High
32 File /modules/public/calendar.php High
33 File /newsDia.php Medium
34 File /out.php Medium
35 File /proxy Low
36 File /Redcock-Farm/farm/category.php High
37 File /reports/rwservlet High
38 File /sacco_shield/manage_user.php High
39 File /see_more_details.php High
40 File /spip.php Medium
41 File /sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2072 High
42 File /staff/bookdetails.php High
43 File /uncpath/ Medium
44 File /user/update_booking.php High
45 File /webssh Low
46 File /Wedding-Management-PHP/admin/photos_add.php High
47 File /wireless/security.asp High
48 File /wordpress/wp-admin/options-general.php High
49 File /_vti_pvt/access.cnf High
50 File 01article.php High
51 File AbstractScheduleJob.java High
52 File actionphp/download.File.php High
53 File adclick.php Medium
54 File addtocart.asp High
55 File admin.php Medium
56 File admin/abc.php High
57 ... ... ...

There are 495 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!