Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-28 09:53:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
4357a66095
cyber_threat_intelligence/actors/Deimos
History
Marc Ruef 4357a66095 Update June 2023
2023-06-06 10:26:07 +02:00
..
README.md Update June 2023 2023-06-06 10:26:07 +02:00

README.md

Deimos - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Deimos. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.deimos

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Deimos:

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Deimos.

ID IP address Hostname Campaign Confidence
1 3.139.182.36 ec2-3-139-182-36.us-east-2.compute.amazonaws.com - Medium
2 3.140.170.199 ec2-3-140-170-199.us-east-2.compute.amazonaws.com - Medium
3 3.209.12.178 ec2-3-209-12-178.compute-1.amazonaws.com - Medium
4 8.218.26.114 - - High
5 14.29.118.239 - - High
6 18.162.155.202 ec2-18-162-155-202.ap-east-1.compute.amazonaws.com - Medium
7 18.162.193.120 ec2-18-162-193-120.ap-east-1.compute.amazonaws.com - Medium
8 34.91.254.205 205.254.91.34.bc.googleusercontent.com - Medium
9 34.147.114.77 77.114.147.34.bc.googleusercontent.com - Medium
10 36.95.131.171 - - High
11 39.106.36.96 - - High
12 43.198.73.212 ec2-43-198-73-212.ap-east-1.compute.amazonaws.com - Medium
13 44.230.201.248 ec2-44-230-201-248.us-west-2.compute.amazonaws.com - Medium
14 45.77.7.58 45.77.7.58.vultrusercontent.com - High
15 54.151.143.251 ec2-54-151-143-251.ap-southeast-1.compute.amazonaws.com - Medium
16 58.250.32.16 - - High
17 59.46.210.116 - - High
18 61.216.149.32 61-216-149-32.hinet-ip.hinet.net - High
19 64.254.19.142 142-19-254-64.cognicase.net - High
20 64.254.28.121 121-28-254-64.cgitmsmdc.ca - High
21 64.254.28.122 122-28-254-64.cgitmsmdc.ca - High
22 79.137.203.70 Fuck-strot.aeza.network - High
23 81.70.24.179 - - High
24 88.99.17.2 ns20.mizbandp.com - High
25 88.99.17.3 static.3.17.99.88.clients.your-server.de - High
26 88.99.17.5 static.5.17.99.88.clients.your-server.de - High
27 92.116.24.76 i5C74184C.versanet.de - High
28 103.44.253.115 - - High
29 104.196.56.239 239.56.196.104.bc.googleusercontent.com - Medium
30 106.75.229.132 - - High
31 112.29.177.3 - - High
32 112.29.177.4 - - High
33 112.29.177.5 - - High
34 112.29.177.6 - - High
35 112.29.177.7 - - High
36 112.29.177.8 - - High
37 112.29.177.9 - - High
38 112.29.177.10 - - High
39 112.29.177.11 - - High
40 ... ... ... ...

There are 156 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Deimos. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-22 Pathname Traversal High

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Deimos. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File ftp.pl Low

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!