Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-28 09:53:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
6731678265
cyber_threat_intelligence/APT10/README.md
Marc Ruef 5594bbe8c6 Update
2022-02-23 09:46:58 +01:00

6.4 KiB
Raw Blame History

APT10 - Cyber Threat Intelligence

These indicators were collected during the VulDB CTI analysis of the actor known as APT10. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model is able to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.apt10

Campaigns

The following campaigns are known and can be associated with APT10:

  • A41APT
  • Cloud Hopper

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with APT10:

  • US
  • RU
  • DE
  • ...

There are 8 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of APT10.

ID IP address Hostname Campaign Confidence
1 23.89.193.34 - Cloud Hopper High
2 23.110.64.147 - Cloud Hopper High
3 23.252.105.137 23.252.105.137.16clouds.com Cloud Hopper High
4 27.102.66.67 - - High
5 27.102.115.249 - - High
6 27.102.127.75 - - High
7 27.102.127.80 - - High
8 27.102.128.157 - - High
9 31.184.197.215 31-184-197-215.static.x5x-noc.ru Cloud Hopper High
10 31.184.197.227 31-184-197-227.static.x5x-noc.ru Cloud Hopper High
11 31.184.198.23 - Cloud Hopper High
12 31.184.198.38 - Cloud Hopper High
13 37.187.7.74 ns3372567.ip-37-187-7.eu Cloud Hopper High
14 37.235.52.18 18.52.235.37.in-addr.arpa Cloud Hopper High
15 38.72.112.45 - Cloud Hopper High
16 38.72.114.16 - Cloud Hopper High
17 38.72.115.9 - Cloud Hopper High
18 45.62.112.161 45.62.112.161.16clouds.com Cloud Hopper High
19 45.138.157.83 google.com.tm A41APT High
20 46.108.39.134 - Cloud Hopper High
21 50.2.160.104 - Cloud Hopper High
22 52.74.71.131 ec2-52-74-71-131.ap-southeast-1.compute.amazonaws.com Cloud Hopper Medium
23 52.74.213.16 ec2-52-74-213-16.ap-southeast-1.compute.amazonaws.com Cloud Hopper Medium
24 ... ... ... ...

There are 91 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected ATT&CK techniques used by APT10. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
2 T1068 CWE-264, CWE-284 Execution with Unnecessary Privileges High
3 T1110.001 CWE-798 Improper Restriction of Excessive Authentication Attempts High
4 ... ... ... ...

There are 4 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by APT10. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File .htpasswd Medium
2 File /../conf/config.properties High
3 File /drivers/infiniband/core/cm.c High
4 File /forum/away.php High
5 File /horde/util/go.php High
6 File /images/ Medium
7 File /inc/parser/xhtml.php High
8 File /login Low
9 File /mgmt/shared/authz/users/ High
10 File /modules/profile/index.php High
11 File /out.php Medium
12 File /public/plugins/ High
13 File /secure/admin/ViewInstrumentation.jspa High
14 File /SSOPOST/metaAlias/%realm%/idpv2 High
15 File /system/proxy High
16 File /tmp/phpglibccheck High
17 File /uncpath/ Medium
18 File adclick.php Medium
19 File add.php Low
20 File addentry.php Medium
21 File addressbookprovider.php High
22 File admin/htaccess/bpsunlock.php High
23 File admin/pageUploadCSV.php High
24 File ajax_udf.php Medium
25 File application.js.php High
26 File apply.cgi Medium
27 File arm/lithium-codegen-arm.cc High
28 File authenticate.c High
29 File Authenticate.class.php High
30 File base_maintenance.php High
31 File booking_details.php High
32 ... ... ...

There are 277 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2022 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!