Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-30 19:03:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
86c2daab23
cyber_threat_intelligence/actors/Norway Unknown
History
Marc Ruef 2d4f99a727 Update February 2023
2023-02-20 20:18:09 +01:00
..
README.md Update February 2023 2023-02-20 20:18:09 +01:00

README.md

Norway Unknown - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Norway Unknown. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.norway_unknown

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Norway Unknown:

There are 31 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Norway Unknown.

ID IP address Hostname Campaign Confidence
1 2.58.24.0 - - High
2 2.148.0.0 2.148.0.0.tmi.telenormobil.no - High
3 5.22.236.0 - - High
4 5.23.18.0 - - High
5 5.23.18.42 - - High
6 5.44.64.0 - - High
7 5.45.152.0 - - High
8 5.83.224.0 - - High
9 5.100.176.0 - - High
10 5.145.152.0 - - High
11 5.153.104.0 - - High
12 5.157.49.0 - - High
13 5.158.192.0 - - High
14 5.181.232.0 - - High
15 5.226.160.0 - - High
16 5.249.224.0 - - High
17 5.252.244.0 - - High
18 8.41.36.0 - - High
19 13.104.138.0 - - High
20 13.104.153.48 - - High
21 13.104.153.96 - - High
22 13.104.155.0 - - High
23 13.104.158.0 - - High
24 13.104.158.32 - - High
25 13.104.170.0 - - High
26 13.104.217.128 - - High
27 13.104.218.0 - - High
28 13.107.194.76 - - High
29 13.107.194.80 - - High
30 17.72.97.0 - - High
31 17.77.132.0 - - High
32 20.38.120.0 - - High
33 20.150.0.0 - - High
34 20.150.53.0 - - High
35 20.150.56.0 - - High
36 20.190.185.0 - - High
37 20.190.186.0 - - High
38 21.89.11.139 - - High
39 23.103.135.136 - - High
40 23.103.135.152 - - High
41 23.236.228.40 - - High
42 23.250.26.104 - - High
43 31.6.57.0 - - High
44 31.24.66.240 240.66.24.31.in-addr.zone - High
45 31.24.128.0 - - High
46 31.25.216.0 - - High
47 31.45.0.0 - - High
48 31.129.112.0 - - High
49 31.169.48.0 - - High
50 31.185.24.0 - - High
51 31.186.88.0 - - High
52 31.204.72.0 31-204-72-0.bb.cust.telefiber.no - High
53 31.211.168.0 - - High
54 32.42.29.144 - - High
55 32.106.116.0 bb.32-106-116-0.osl.no.prserv.net - High
56 32.106.156.0 - - High
57 32.106.165.0 bb32-106-165-0.cop.dk.prserv.net - High
58 34.99.44.0 0.44.99.34.bc.googleusercontent.com - Medium
59 34.103.36.0 0.36.103.34.bc.googleusercontent.com - Medium
60 37.18.48.0 - - High
61 37.18.64.0 - - High
62 37.26.208.0 - - High
63 37.28.128.0 - - High
64 37.32.48.0 - - High
65 37.44.128.0 - - High
66 37.72.187.0 - - High
67 37.120.149.0 fhu0.startouch.us - High
68 37.120.203.0 - - High
69 37.123.131.31 bc90.A498.priv.bahnhof.se - High
70 37.123.131.34 h-37-123-131-34.A498.priv.bahnhof.se - High
71 37.143.48.0 - - High
72 37.148.144.0 - - High
73 37.191.128.0 net.d1-r2.fiber.lynet.no - High
74 37.200.0.0 - - High
75 37.202.24.0 - - High
76 37.202.56.0 - - High
77 37.202.62.0 - - High
78 37.230.184.0 - - High
79 37.252.112.0 - - High
80 37.252.210.0 - - High
81 37.252.212.0 - - High
82 37.252.215.0 - - High
83 37.253.0.0 37.253.0.0.tmi.telenormobil.no - High
84 40.82.84.0 - - High
85 40.82.112.0 - - High
86 40.92.86.0 - - High
87 40.93.88.0 - - High
88 40.95.85.0 - - High
89 40.119.104.0 - - High
90 40.126.57.0 - - High
91 40.126.57.32 - - High
92 40.126.58.0 - - High
93 40.126.58.32 - - High
94 40.126.200.0 - - High
95 44.141.125.0 - - High
96 45.8.8.0 - - High
97 45.8.220.0 - - High
98 45.12.70.168 most-trim.alltieinc.com - High
99 45.12.71.168 - - High
100 45.12.223.0 - - High
101 45.13.72.0 - - High
102 45.13.75.64 - - High
103 45.14.52.0 45.14.52.0.static.lyse.net - High
104 45.15.108.0 - - High
105 45.66.128.0 - - High
106 45.67.8.0 - - High
107 45.67.160.0 - - High
108 45.80.144.0 - - High
109 45.86.236.0 - - High
110 45.88.116.0 - - High
111 45.89.192.0 - - High
112 45.89.232.0 - - High
113 45.90.36.0 - - High
114 45.92.228.0 - - High
115 45.93.140.0 - - High
116 45.134.208.0 - - High
117 45.135.139.0 - - High
118 45.135.156.0 - - High
119 45.136.80.0 - - High
120 45.136.176.0 - - High
121 45.138.236.0 0.45-138-236.static.xfiber.net - High
122 45.139.84.0 - - High
123 45.144.76.0 - - High
124 45.147.28.0 - - High
125 45.152.48.0 dhcp45152480.blix.com - High
126 45.153.104.0 - - High
127 45.153.244.0 - - High
128 45.154.52.0 - - High
129 45.154.232.0 - - High
130 45.158.92.0 - - High
131 46.9.0.0 - - High
132 46.15.0.0 telia-2e0f00-0.connect.netcom.no - High
133 46.16.48.0 - - High
134 46.17.16.0 - - High
135 46.19.16.0 - - High
136 46.29.216.0 - - High
137 46.31.184.0 - - High
138 46.46.192.0 - - High
139 46.66.0.0 46.66.0.0.tmi.telenormobil.no - High
140 46.156.0.0 46.156.0.0.tmi.telenormobil.no - High
141 46.183.168.0 - - High
142 46.212.0.0 cm-46.212.0.0.get.no - High
143 46.226.8.0 - - High
144 46.226.24.0 - - High
145 46.227.192.0 - - High
146 46.228.48.0 46-228-48-0.bb.cust.hknett.no - High
147 46.230.128.0 - - High
148 46.230.160.0 - - High
149 46.236.70.208 h46-236-70-208.cust.bredband2.com - High
150 46.246.122.0 - - High
151 46.249.224.0 - - High
152 46.250.192.0 9enq0.ip.hatteland.com - High
153 46.255.16.0 - - High
154 51.13.0.0 - - High
155 51.107.208.0 - - High
156 51.107.240.0 - - High
157 51.120.0.0 - - High
158 51.120.128.0 - - High
159 51.120.192.0 - - High
160 51.120.224.0 norwayw02.rnm.core.windows.net - High
161 51.120.240.0 - - High
162 51.174.0.0 0.51-174-0.customer.lyse.net - High
163 52.97.227.0 - - High
164 52.97.228.80 - - High
165 52.97.229.0 - - High
166 52.97.229.128 - - High
167 52.97.229.192 - - High
168 52.97.229.224 - - High
169 52.97.230.0 - - High
170 52.97.230.128 - - High
171 52.101.86.0 - - High
172 52.101.147.0 - - High
173 52.104.37.0 - - High
174 52.104.42.0 - - High
175 52.105.18.0 - - High
176 52.108.77.0 - - High
177 52.108.198.0 - - High
178 52.114.234.0 - - High
179 52.114.238.0 - - High
180 52.253.167.0 - - High
181 52.253.168.0 - - High
182 52.253.177.0 - - High
183 52.253.178.0 - - High
184 57.86.96.0 - - High
185 62.16.128.0 - - High
186 62.24.32.0 - - High
187 62.50.160.0 - - High
188 62.63.0.0 - - High
189 62.65.23.114 one2com.no - High
190 62.65.31.1 - - High
191 62.70.0.0 - - High
192 62.73.192.0 - - High
193 62.89.32.0 - - High
194 62.92.0.0 0.0.92.62.static.cust.telenor.com - High
195 62.97.160.0 - - High
196 62.97.192.0 - - High
197 62.101.192.0 - - High
198 62.102.160.0 - - High
199 62.109.39.64 - - High
200 62.113.128.0 heathcomm-net.heathcomm.no - High
201 62.122.248.0 - - High
202 62.128.224.0 - - High
203 62.141.128.0 cm-62.141.128.0.get.no - High
204 62.148.32.0 - - High
205 62.176.192.0 narviknett.no - High
206 62.184.247.0 - - High
207 62.185.228.0 - - High
208 62.186.1.192 - - High
209 62.186.7.104 - - High
210 62.186.85.192 - - High
211 62.186.155.0 - - High
212 62.186.156.0 - - High
213 62.186.156.32 - - High
214 62.186.157.0 - - High
215 62.186.157.64 - - High
216 62.186.157.88 - - High
217 62.186.157.96 - - High
218 62.186.157.128 - - High
219 62.186.225.64 - - High
220 62.187.36.0 - - High
221 62.187.37.0 - - High
222 62.187.37.128 - - High
223 62.187.68.0 - - High
224 62.187.68.64 - - High
225 62.187.70.0 - - High
226 62.201.42.0 - - High
227 62.209.64.0 - - High
228 62.209.164.0 - - High
229 62.249.160.0 - - High
230 64.28.0.0 - - High
231 64.38.202.0 - - High
232 68.67.2.0 - - High
233 68.67.10.0 - - High
234 69.64.253.48 - - High
235 69.64.253.64 network.wansecurity.net - High
236 74.125.60.120 - - High
237 74.125.61.112 - - High
238 77.16.0.0 77.16.0.0.tmi.telenormobil.no - High
239 77.37.112.0 - - High
240 77.40.128.0 - - High
241 77.67.50.224 - - High
242 77.67.107.248 - - High
243 77.70.148.0 - - High
244 77.70.191.30 - - High
245 77.74.160.0 - - High
246 77.74.200.0 - - High
247 77.74.216.0 - - High
248 77.75.208.0 - - High
249 77.88.64.0 keystep.no - High
250 77.94.232.0 - - High
251 77.95.72.0 77-95-72-0.bb.cust.hknett.no - High
252 77.106.128.0 ip-0-128-106-77.eidsiva.net - High
253 77.110.192.0 77-110-192-0.inet.signal.no - High
254 77.111.244.0 - - High
255 77.222.160.0 - - High
256 77.222.192.0 - - High
257 77.223.160.0 - - High
258 77.234.48.0 host-77-234-48-0.lynet.no - High
259 77.241.96.0 0.77-241-96.static.xfiber.net - High
260 77.247.144.0 - - High
261 78.24.144.0 - - High
262 78.26.0.0 - - High
263 78.31.80.0 - - High
264 78.31.207.0 - - High
265 78.41.44.0 - - High
266 78.41.120.0 - - High
267 78.41.136.0 - - High
268 78.91.0.0 - - High
269 78.156.0.0 cm-78.156.0.0.get.no - High
270 78.158.224.0 - - High
271 79.135.0.0 - - High
272 79.141.96.0 ip79-141-96-0.brdy.online - High
273 79.160.0.0 0.79-160-0.customer.lyse.net - High
274 79.170.80.0 - - High
275 79.171.64.0 0.64-171-79.ipv4.rev.vossfiber.net - High
276 79.171.80.0 - - High
277 79.171.149.24 - - High
278 79.174.16.0 - - High
279 79.174.176.0 - - High
280 80.64.192.0 - - High
281 80.65.48.0 - - High
282 80.67.7.0 80-67-7-0.static.glesys.net - High
283 80.67.36.0 - - High
284 80.75.220.0 - - High
285 80.86.128.0 - - High
286 80.86.208.0 - - High
287 80.89.32.0 - - High
288 80.91.32.0 - - High
289 80.91.224.0 - - High
290 80.202.0.0 - - High
291 80.212.0.0 - - High
292 80.231.30.32 - - High
293 80.232.0.0 - - High
294 80.239.0.0 - - High
295 80.239.159.61 80-239-159-61.teliacarrier-cust.com - High
296 80.239.159.62 80-239-159-62.teliacarrier-cust.com - High
297 80.239.159.68 80-239-159-68.teliacarrier-cust.com - High
298 80.239.159.76 80-239-159-76.teliacarrier-cust.com - High
299 80.239.159.84 80-239-159-84.teliacarrier-cust.com - High
300 80.239.159.92 80-239-159-92.teliacarrier-cust.com - High
301 80.239.159.100 80-239-159-100.teliacarrier-cust.com - High
302 80.239.242.30 - - High
303 80.241.80.0 - - High
304 80.244.77.0 h80-244-77-0.cust.bredband2.com - High
305 80.254.32.0 - - High
306 81.0.128.0 - - High
307 81.4.14.0 - - High
308 81.26.32.0 - - High
309 81.27.32.0 - - High
310 81.29.32.0 - - High
311 81.88.64.0 - - High
312 81.92.27.192 - - High
313 81.93.96.0 - - High
314 81.93.160.0 - - High
315 81.166.0.0 0.81-166-0.customer.lyse.net - High
316 81.173.42.0 - - High
317 81.175.0.0 c000AF51.static.as2116.net - High
318 81.191.0.0 c0000BF51.dhcp.as2116.net - High
319 82.96.15.0 - - High
320 82.99.16.0 - - High
321 82.99.17.64 - - High
322 82.99.17.128 - - High
323 82.99.40.192 - - High
324 82.102.22.0 - - High
325 82.102.27.0 - - High
326 82.116.64.0 - - High
327 ... ... ... ...

There are 1303 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Norway Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-28 Pathname Traversal High
2 T1040 CWE-294 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-88, CWE-94, CWE-1321 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 ... ... ... ...

There are 22 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Norway Unknown. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File .../gogo/ Medium
2 File .github/workflows/combine-prs.yml High
3 File /admin/api/admin/articles/ High
4 File /admin/submit-articles High
5 File /adms/admin/?page=vehicles/sell_vehicle High
6 File /adms/admin/?page=vehicles/view_transaction High
7 File /appliance/users?action=edit High
8 File /attachments Medium
9 File /bin/httpd Medium
10 File /bsms_ci/index.php/book High
11 File /context/%2e/WEB-INF/web.xml High
12 File /debug/pprof Medium
13 File /dev/block/mmcblk0rpmb High
14 File /DocSystem/Repos/getReposAllUsers.do High
15 File /etc/hosts Medium
16 File /etc/ldap.conf High
17 File /etc/shadow Medium
18 File /face-recognition-php/facepay-master/camera.php High
19 File /forum/away.php High
20 File /fos/admin/ajax.php?action=login High
21 File /fos/admin/index.php?page=menu High
22 File /goform/wizard_end High
23 File /home/masterConsole High
24 File /home/sendBroadcast High
25 File /hrm/employeeadd.php High
26 File /hrm/employeeview.php High
27 File /index.php Medium
28 File /jsoa/hntdCustomDesktopActionContent High
29 File /login/index.php High
30 File /lookin/info Medium
31 File /medicines/profile.php High
32 File /modules/caddyhttp/rewrite/rewrite.go High
33 File /out.php Medium
34 File /proxy Low
35 File /Redcock-Farm/farm/category.php High
36 File /reports/rwservlet High
37 File /spip.php Medium
38 File /tmp Low
39 File /uncpath/ Medium
40 File /vendor/htmlawed/htmlawed/htmLawedTest.php High
41 File /wireless/security.asp High
42 File 01article.php High
43 File 2020\Messages\SDNotify.exe High
44 File AbstractScheduleJob.java High
45 File actionphp/download.File.php High
46 ... ... ...

There are 398 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!