Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-27 09:28:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
9acd7aff46
cyber_threat_intelligence/actors/Deimos
History
Marc Ruef 9acd7aff46 Update February 2024
2024-02-02 10:19:44 +01:00
..
README.md Update February 2024 2024-02-02 10:19:44 +01:00

README.md

Deimos - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Deimos. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.deimos

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Deimos:

There are 1 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Deimos.

ID IP address Hostname Campaign Confidence
1 3.78.199.107 ec2-3-78-199-107.eu-central-1.compute.amazonaws.com - Medium
2 3.139.182.36 ec2-3-139-182-36.us-east-2.compute.amazonaws.com - Medium
3 3.140.170.199 ec2-3-140-170-199.us-east-2.compute.amazonaws.com - Medium
4 3.209.12.178 ec2-3-209-12-178.compute-1.amazonaws.com - Medium
5 5.101.4.196 hvilica.ru.4.101.5.in-addr.arpa - High
6 5.101.5.196 - - High
7 8.129.77.150 - - High
8 8.140.203.92 - - High
9 8.217.217.243 - - High
10 8.218.26.114 - - High
11 13.33.49.168 server-13-33-49-168.man50.r.cloudfront.net - High
12 13.245.163.162 ec2-13-245-163-162.af-south-1.compute.amazonaws.com - Medium
13 13.248.174.235 afa2de089f3755ebd.awsglobalaccelerator.com - High
14 13.248.202.168 a9031a079942f632b.awsglobalaccelerator.com - High
15 13.248.204.3 a87b0d9ebcb20e8b5.awsglobalaccelerator.com - High
16 13.251.49.40 ec2-13-251-49-40.ap-southeast-1.compute.amazonaws.com - Medium
17 14.29.118.239 - - High
18 15.197.184.110 ad0b0534d5815035b.awsglobalaccelerator.com - High
19 15.222.155.153 ec2-15-222-155-153.ca-central-1.compute.amazonaws.com - Medium
20 18.162.155.202 ec2-18-162-155-202.ap-east-1.compute.amazonaws.com - Medium
21 18.162.193.120 ec2-18-162-193-120.ap-east-1.compute.amazonaws.com - Medium
22 18.183.137.140 ec2-18-183-137-140.ap-northeast-1.compute.amazonaws.com - Medium
23 18.211.5.15 ec2-18-211-5-15.compute-1.amazonaws.com - Medium
24 20.65.145.66 - - High
25 20.200.107.245 - - High
26 20.216.129.54 - - High
27 34.81.252.215 215.252.81.34.bc.googleusercontent.com - Medium
28 34.91.254.205 205.254.91.34.bc.googleusercontent.com - Medium
29 34.142.44.93 93.44.142.34.bc.googleusercontent.com - Medium
30 34.147.114.77 77.114.147.34.bc.googleusercontent.com - Medium
31 35.71.185.24 ac55a7ad608d437b5.awsglobalaccelerator.com - High
32 36.95.131.171 - - High
33 36.138.134.148 - - High
34 37.152.179.33 - - High
35 38.47.99.24 - - High
36 38.207.176.111 - - High
37 39.106.36.96 - - High
38 42.247.11.53 - - High
39 43.132.69.14 - - High
40 43.198.73.212 ec2-43-198-73-212.ap-east-1.compute.amazonaws.com - Medium
41 43.198.187.66 ec2-43-198-187-66.ap-east-1.compute.amazonaws.com - Medium
42 43.198.203.238 ec2-43-198-203-238.ap-east-1.compute.amazonaws.com - Medium
43 44.216.250.133 ec2-44-216-250-133.compute-1.amazonaws.com - Medium
44 44.230.201.248 ec2-44-230-201-248.us-west-2.compute.amazonaws.com - Medium
45 45.77.7.58 45.77.7.58.vultrusercontent.com - High
46 45.90.218.248 komarik777.freemyip.com - High
47 45.249.9.171 host-249-9-171.tes.com.pk - High
48 46.225.119.108 - - High
49 47.97.166.129 - - High
50 49.13.57.52 static.52.57.13.49.clients.your-server.de - High
51 52.77.170.230 ec2-52-77-170-230.ap-southeast-1.compute.amazonaws.com - Medium
52 52.84.151.45 - - High
53 54.68.113.254 ec2-54-68-113-254.us-west-2.compute.amazonaws.com - Medium
54 54.93.117.12 ec2-54-93-117-12.eu-central-1.compute.amazonaws.com - Medium
55 54.151.143.251 ec2-54-151-143-251.ap-southeast-1.compute.amazonaws.com - Medium
56 58.27.188.30 58-27-188-30.wateen.net - High
57 58.181.97.19 - - High
58 58.250.32.16 - - High
59 58.251.128.87 reverse.gdsz.cncnet.net - High
60 58.251.128.117 reverse.gdsz.cncnet.net - High
61 58.251.128.148 reverse.gdsz.cncnet.net - High
62 59.46.210.116 - - High
63 59.103.81.96 - - High
64 59.103.171.17 - - High
65 61.121.83.152 - - High
66 61.121.83.153 - - High
67 61.121.83.154 - - High
68 61.216.149.32 61-216-149-32.hinet-ip.hinet.net - High
69 62.77.159.136 4nvo.l.time4vps.cloud - High
70 62.216.92.151 - - High
71 64.254.19.142 142-19-254-64.cognicase.net - High
72 64.254.28.121 121-28-254-64.cgitmsmdc.ca - High
73 64.254.28.122 122-28-254-64.cgitmsmdc.ca - High
74 ... ... ... ...

There are 291 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Deimos. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23 Pathname Traversal High
2 T1040 CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-88, CWE-94 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 ... ... ... ...

There are 22 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Deimos. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File /+CSCOE+/logon.html High
2 File /?p=products Medium
3 File /admin/admapi.php High
4 File /admin/edit-doc.php High
5 File /admin/fckphplist.php High
6 File /api/admin/store/product/list High
7 File /api/baskets/{name} High
8 File /apply/index.php High
9 File /author_posts.php High
10 File /bin/sh Low
11 File /boaform/device_reset.cgi High
12 File /boaform/wlan_basic_set.cgi High
13 File /cgi-bin/cstecgi.cgi High
14 File /cgi-bin/koha/catalogue/search.pl High
15 File /cgi-bin/login.cgi High
16 File /cgi-bin/qcmap_auth High
17 File /classes/Master.php?f=save_brand High
18 File /cm/delete Medium
19 File /config/getuser High
20 File /core/config-revisions High
21 File /cwms/classes/Master.php?f=save_contact High
22 File /debug/pprof Medium
23 File /drivers/isdn/i4l/isdn_net.c High
24 File /etc/gsissh/sshd_config High
25 File /event/admin/?page=user/list High
26 File /export Low
27 File /forum/away.php High
28 File /general/email/inbox/delete_webmail.php High
29 File /getcfg.php Medium
30 File /ghost/preview High
31 File /goform/AdvSetLanip High
32 File /goform/formDefault High
33 File /goform/setDeviceSettings High
34 File /goform/set_LimitClient_cfg High
35 File /goform/telnet High
36 File /goform/WanParameterSetting High
37 File /htdocs/cgibin High
38 File /include/file.php High
39 File /include/makecvs.php High
40 File /index.php Medium
41 File /index.php/client/message/message_read/xxxxxxxx[random-msg-hash] High
42 ... ... ...

There are 362 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2024 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!