Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-28 09:53:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
5e84854492
cyber_threat_intelligence/actors/Republic of Lithuania Unknown
History
Marc Ruef 5e84854492 Update October 2023
2023-10-27 13:52:44 +02:00
..
README.md Update October 2023 2023-10-27 13:52:44 +02:00

README.md

Republic of Lithuania Unknown - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Republic of Lithuania Unknown. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.republic_of_lithuania_unknown

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Republic of Lithuania Unknown:

There are 20 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Republic of Lithuania Unknown.

ID IP address Hostname Campaign Confidence
1 2.56.11.143 - - High
2 2.56.192.0 - - High
3 2.56.200.0 - - High
4 2.56.250.0 2.56.250.0.static.quadranet.com - High
5 2.57.176.0 - - High
6 2.59.16.0 host002059016000.static.fidoka.tech - High
7 2.59.150.0 - - High
8 5.20.0.0 - - High
9 5.39.11.112 - - High
10 5.39.31.64 ip64.ip-5-39-31.eu - High
11 5.39.61.112 mta2.pronto-tel.net - High
12 5.39.99.196 a1.wseup.com - High
13 5.39.127.248 quivers-direct.empiretap.com - High
14 5.45.144.0 - - High
15 5.62.60.236 r-236-60-62-5.consumer-pool.prcdn.net - High
16 5.62.62.228 r-228-62-62-5.consumer-pool.prcdn.net - High
17 5.133.64.0 - - High
18 5.135.106.64 ip64.ip-5-135-106.eu - High
19 5.135.200.32 ip32.ip-5-135-200.eu - High
20 5.135.225.240 vpnout102-114-1-lt.ciberprotector.com - High
21 5.135.253.48 ip48.ip-5-135-253.eu - High
22 5.180.148.0 5.180.148.0.svinternet.net.br - High
23 5.180.236.0 host005180236000.static.fidoka.tech - High
24 5.181.36.0 - - High
25 5.181.86.0 - - High
26 5.181.132.0 - - High
27 5.182.16.0 - - High
28 5.196.39.232 ip232.ip-5-196-39.eu - High
29 5.196.57.96 auto-winolap16.orders-historychecking.com - High
30 5.196.122.96 ip96.ip-5-196-122.eu - High
31 5.196.129.48 - - High
32 5.196.131.160 - - High
33 5.196.140.64 service.minehosting.ru - High
34 5.196.169.240 - - High
35 5.196.190.160 ip160.ip-5-196-190.eu - High
36 5.196.202.64 ip64.ip-5-196-202.eu - High
37 5.196.222.32 ip32.ip-5-196-222.eu - High
38 5.199.160.0 - - High
39 5.252.140.0 - - High
40 5.252.184.0 undefined.hostname.localhost - High
41 5.253.232.0 - - High
42 5.253.240.0 - - High
43 8.39.207.0 - - High
44 16.166.163.90 - - High
45 23.254.71.0 - - High
46 31.6.54.0 - - High
47 31.14.176.0 31-14.network.serveriai.lt - High
48 31.40.232.0 - - High
49 31.44.96.0 lan-31-44-96-0.vln.penki.lt - High
50 31.135.216.0 - - High
51 31.172.224.0 cl-31-172-224-0.fastlink.lt.224.172.31.in-addr.arpa - High
52 31.177.8.0 31-177-8-0.roventa.lt - High
53 31.187.65.0 - - High
54 31.193.192.0 - - High
55 31.209.64.0 data3-64-0.cgates.lt - High
56 31.220.28.0 - - High
57 31.220.46.0 - - High
58 34.99.40.0 0.40.99.34.bc.googleusercontent.com - Medium
59 34.103.34.0 0.34.103.34.bc.googleusercontent.com - Medium
60 37.0.208.0 - - High
61 37.0.216.0 m37-0-216-0.cust.tele2.lt - High
62 37.0.224.0 m37-0-224-0.cust.tele2.lt - High
63 37.44.212.0 - - High
64 37.44.215.0 37.44.215.0.static.quadranet.com - High
65 37.59.69.96 ip96.ip-37-59-69.eu - High
66 37.59.75.0 ip0.ip-37-59-75.eu - High
67 37.59.91.0 ip0.ip-37-59-91.eu - High
68 37.59.136.128 smtp.gateway122.key10-marketing.com - High
69 37.59.142.8 ip8.ip-37-59-142.eu - High
70 37.59.207.192 - - High
71 37.59.229.128 ip128.ip-37-59-229.eu - High
72 37.59.240.112 - - High
73 37.153.134.0 - - High
74 37.156.6.0 - - High
75 37.156.216.0 - - High
76 37.157.144.0 client-37-157-144-0.cgates.lt - High
77 37.187.197.192 ip192.ip-37-187-197.eu - High
78 37.221.124.0 - - High
79 43.229.8.0 - - High
80 45.8.172.0 - - High
81 45.9.124.0 - - High
82 45.11.152.0 - - High
83 45.11.192.0 45-11-192-0.netnamas.com - High
84 45.12.70.134 drag-abrogate.alltieinc.com - High
85 45.12.71.134 - - High
86 45.12.104.0 - - High
87 45.13.52.0 - - High
88 45.13.132.0 - - High
89 45.13.252.0 - - High
90 45.14.144.0 - - High
91 45.66.136.0 - - High
92 45.66.148.0 - - High
93 45.66.196.0 45.66.196.0.aji.lt - High
94 45.72.0.0 - - High
95 45.72.3.0 - - High
96 45.81.56.0 - - High
97 45.81.252.0 - - High
98 45.81.254.0 0.i02.rfox.cloud - High
99 45.82.32.0 - - High
100 45.82.35.0 - - High
101 45.82.52.0 - - High
102 45.82.100.0 - - High
103 45.82.160.0 - - High
104 45.84.108.0 - - High
105 45.84.204.0 - - High
106 45.84.244.0 cl-45-84-244-0.fastlink.lt.244.84.45.in-addr.arpa - High
107 45.85.4.0 - - High
108 45.86.189.0 - - High
109 45.87.44.0 - - High
110 45.87.80.0 - - High
111 45.87.172.0 - - High
112 45.88.196.0 - - High
113 45.90.248.0 - - High
114 45.91.32.0 - - High
115 45.91.136.0 - - High
116 45.92.188.0 - - High
117 45.93.136.0 - - High
118 45.93.224.0 - - High
119 45.94.236.0 - - High
120 45.95.32.0 - - High
121 45.95.34.0 - - High
122 45.95.80.0 0.80.95.45.quadite.com - High
123 45.95.144.0 - - High
124 45.113.238.0 - - High
125 45.123.190.0 - - High
126 45.125.65.0 - - High
127 45.125.66.0 - - High
128 45.128.160.0 - - High
129 45.129.206.0 - - High
130 45.130.76.0 network-addr - High
131 45.131.168.0 - - High
132 45.132.194.0 - - High
133 45.133.108.0 - - High
134 45.134.72.0 - - High
135 45.135.248.0 - - High
136 45.137.96.0 - - High
137 45.137.106.0 - - High
138 45.137.248.0 0.248.137.45.in-addr.arpa.broadband.mtnet.hr - High
139 45.138.12.0 - - High
140 45.140.236.0 - - High
141 45.142.236.0 - - High
142 45.143.216.0 45-143-216-0.broadband.mtnet.hr - High
143 45.145.32.0 - - High
144 45.146.80.0 - - High
145 45.146.160.0 undefined.hostname.localhost - High
146 45.146.200.0 - - High
147 45.147.132.0 - - High
148 45.147.152.0 unknown - High
149 45.148.36.0 - - High
150 45.149.100.0 - - High
151 45.149.184.0 - - High
152 45.151.44.0 - - High
153 45.152.240.0 - - High
154 45.153.4.0 - - High
155 45.154.104.0 - - High
156 45.155.16.0 mx2-16-0.taskmanson.eu - High
157 45.157.16.0 - - High
158 45.157.180.0 - - High
159 45.158.8.0 - - High
160 45.158.168.0 - - High
161 45.227.254.0 - - High
162 45.249.104.0 - - High
163 45.251.60.0 - - High
164 45.252.56.0 - - High
165 46.17.174.0 - - High
166 46.36.64.0 - - High
167 46.102.251.0 - - High
168 46.105.68.32 ip32.ip-46-105-68.eu - High
169 46.105.85.216 - - High
170 46.105.91.240 - - High
171 46.105.130.96 ip96.ip-46-105-130.eu - High
172 46.105.208.80 - - High
173 46.105.241.208 ip208.ip-46-105-241.eu - High
174 46.105.245.56 - - High
175 46.148.16.0 ip-46-148-16-0.infiumhost.net - High
176 46.148.24.0 ip-46-148-24-0.infiumhost.net - High
177 46.148.28.0 ip-46-148-28-0.infiumhost.net - High
178 46.148.40.0 - - High
179 46.166.160.0 - - High
180 46.166.168.0 - - High
181 46.166.168.24 - - High
182 46.166.168.32 - - High
183 46.166.168.64 - - High
184 46.166.168.128 - - High
185 46.166.169.0 - - High
186 46.166.170.0 - - High
187 46.166.170.16 - - High
188 46.166.170.32 - - High
189 46.166.170.64 - - High
190 46.166.170.128 - - High
191 46.166.171.0 - - High
192 46.166.172.0 - - High
193 46.166.172.32 - - High
194 46.166.172.64 - - High
195 46.166.172.128 - - High
196 46.166.173.0 - - High
197 46.166.174.0 rdns.cherryservers.com - High
198 46.183.184.0 - - High
199 46.249.160.0 th-160-0.splius.lt - High
200 46.251.32.0 data3-32-0.cgates.lt - High
201 46.255.208.0 - - High
202 51.38.96.160 ip160.ip-51-38-96.eu - High
203 51.38.107.112 ip112.ip-51-38-107.eu - High
204 51.38.107.128 ip128.ip-51-38-107.eu - High
205 51.38.110.96 ip96.ip-51-38-110.eu - High
206 51.38.118.112 ip112.ip-51-38-118.eu - High
207 51.38.166.192 - - High
208 51.68.61.176 ip176.ip-51-68-61.eu - High
209 51.68.170.112 ip112.ip-51-68-170.eu - High
210 51.68.170.192 billyberc.gcisac.com - High
211 51.75.108.224 ip224.ip-51-75-108.eu - High
212 51.75.156.160 cloud3.boerradio.com - High
213 51.75.235.176 ip176.ip-51-75-235.eu - High
214 51.77.11.112 ip112.ip-51-77-11.eu - High
215 51.77.25.0 ip0.ip-51-77-25.eu - High
216 51.77.176.80 - - High
217 51.83.29.128 ip128.ip-51-83-29.eu - High
218 51.89.15.112 - - High
219 51.89.32.176 cloud5.belkins-mail.com - High
220 51.89.33.48 irc.ro - High
221 51.89.105.64 - - High
222 51.89.105.176 ip176.ip-51-89-105.eu - High
223 51.89.106.224 ip224.ip-51-89-106.eu - High
224 51.91.178.224 - - High
225 51.91.179.0 ip0.ip-51-91-179.eu - High
226 51.91.194.160 auto-winolap6.d2ki.in - High
227 51.91.203.0 - - High
228 51.91.228.128 - - High
229 51.178.0.32 - - High
230 51.178.11.224 - - High
231 51.254.55.144 mx4.notify.baselinker.com - High
232 51.254.70.224 ajp.indusdomo.top - High
233 51.254.148.32 ip32.ip-51-254-148.eu - High
234 51.254.156.144 ip144.ip-51-254-156.eu - High
235 51.254.164.160 ip160.ip-51-254-164.eu - High
236 51.255.6.208 - - High
237 51.255.58.128 ip128.ip-51-255-58.eu - High
238 51.255.63.32 - - High
239 51.255.97.16 ircop.ga - High
240 51.255.123.32 service.minehosting.ru - High
241 51.255.130.80 ip80.ip-51-255-130.eu - High
242 51.255.138.128 ip128.ip-51-255-138.eu - High
243 51.255.144.32 - - High
244 51.255.208.80 ip80.ip-51-255-208.eu - High
245 51.255.210.112 ip112.ip-51-255-210.eu - High
246 51.255.230.16 vitcas.ru - High
247 54.36.15.48 - - High
248 54.36.43.112 ip112.ip-54-36-43.eu - High
249 54.36.47.16 - - High
250 54.36.64.240 ip240.ip-54-36-64.eu - High
251 54.36.67.176 - - High
252 54.36.74.240 ip240.ip-54-36-74.eu - High
253 54.36.80.64 ip64.ip-54-36-80.eu - High
254 54.36.136.112 dm112.ciscofreak.com - High
255 54.36.152.144 ip144.ip-54-36-152.eu - High
256 54.36.159.80 service.minehosting.ru - High
257 54.36.159.96 service.minehosting.ru - High
258 54.36.193.16 - - High
259 54.36.194.160 - - High
260 54.36.196.0 - - High
261 54.36.199.48 mx02.go2gate.net - High
262 54.36.200.96 - - High
263 54.36.220.128 ip128.ip-54-36-220.eu - High
264 54.36.238.240 ip240.ip-54-36-238.eu - High
265 54.36.249.160 ip160.ip-54-36-249.eu - High
266 54.37.55.224 ip224.ip-54-37-55.eu - High
267 54.37.63.240 ip240.ip-54-37-63.eu - High
268 54.37.99.160 ip160.ip-54-37-99.eu - High
269 54.37.117.64 - - High
270 54.37.124.192 ip192.ip-54-37-124.eu - High
271 54.37.170.80 - - High
272 54.37.179.128 ip128.ip-54-37-179.eu - High
273 54.37.199.192 ip192.ip-54-37-199.eu - High
274 54.38.169.80 service.minehosting.ru - High
275 57.87.160.0 - - High
276 62.4.117.0 - - High
277 62.77.152.0 62-77.network.serveriai.lt - High
278 62.80.224.0 - - High
279 62.122.76.0 62-122-76-0.static.zebra.lt - High
280 62.128.113.0 - - High
281 62.128.113.17 - - High
282 62.128.113.64 - - High
283 62.128.113.192 - - High
284 62.140.239.142 vilnius-sk-b1-ae1-3603.fiord.net - High
285 62.192.180.0 - - High
286 62.197.149.0 - - High
287 62.212.192.0 - - High
288 63.141.34.0 - - High
289 64.64.104.120 ausportsbetting.org - High
290 66.102.9.30 google-proxy-66-102-9-30.google.com - High
291 66.102.9.133 google-proxy-66-102-9-133.google.com - High
292 66.102.37.192 - - High
293 77.75.40.0 - - High
294 77.79.0.0 hst-0-0.splius.lt - High
295 77.83.196.0 - - High
296 77.83.252.0 - - High
297 77.87.8.0 - - High
298 77.90.64.0 - - High
299 77.94.32.0 77.94.32.0.satgate.net - High
300 77.94.38.24 77.94.38.24.satgate.net - High
301 ... ... ... ...

There are 1198 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Republic of Lithuania Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23, CWE-24, CWE-36 Pathname Traversal High
2 T1040 CWE-294, CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-88, CWE-94, CWE-1321 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 T1068 CWE-264, CWE-269, CWE-284 J2EE Misconfiguration: Weak Access Permissions for EJB Methods High
7 ... ... ... ...

There are 23 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Republic of Lithuania Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File //WEB-INF Medium
2 File /?p=products Medium
3 File /about.php Medium
4 File /admin/?page=maintenance/brand High
5 File /admin/save.php High
6 File /admin/sys_sql_query.php High
7 File /api/baskets/{name} High
8 File /api/download High
9 File /api/stl/actions/search High
10 File /api/v1/alerts High
11 File /api/v1/terminal/sessions/?limit=1 High
12 File /bin/ate Medium
13 File /bitrix/admin/ldap_server_edit.php High
14 File /booking/show_bookings/ High
15 File /category.php High
16 File /categorypage.php High
17 File /cgi-bin Medium
18 File /cgi-bin/luci/api/wireless High
19 File /cgi-bin/vitogate.cgi High
20 File /company/store High
21 File /Content/Template/root/reverse-shell.aspx High
22 File /Controller/Ajaxfileupload.ashx High
23 File /core/conditions/AbstractWrapper.java High
24 File /dashboard/add-blog.php High
25 File /debug/pprof Medium
26 File /E-mobile/App/System/File/downfile.php High
27 File /Electron/download High
28 File /env Low
29 File /etc/passwd Medium
30 File /fcgi/scrut_fcgi.fcgi High
31 File /forum/away.php High
32 File /group1/uploa High
33 File /h/ Low
34 File /HNAP1 Low
35 File /inc/jquery/uploadify/uploadify.php High
36 File /index.php?app=main&func=passport&action=login High
37 File /index.php?page=category_list High
38 File /jeecg-boot/sys/common/upload High
39 File /jobinfo/ Medium
40 File /Moosikay/order.php High
41 File /OA_HTML/cabo/jsps/a.jsp High
42 File /php-sms/admin/?page=user/manage_user High
43 File /PreviewHandler.ashx High
44 File /process/aprocess.php High
45 File /recipe-result High
46 File /register.do Medium
47 ... ... ...

There are 411 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!