cyber_threat_intelligence/actors/Havoc
2024-01-26 07:53:33 +01:00
..
README.md Update January 2024 2024-01-26 07:53:33 +01:00

Havoc - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Havoc. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.havoc

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Havoc:

There are 23 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Havoc.

ID IP address Hostname Campaign Confidence
1 2.56.10.6 - - High
2 2.58.14.26 - - High
3 2.59.254.20 - - High
4 2.102.90.244 host-2-102-90-244.as13285.net - High
5 3.6.98.232 ec2-3-6-98-232.ap-south-1.compute.amazonaws.com - Medium
6 3.6.115.64 ec2-3-6-115-64.ap-south-1.compute.amazonaws.com - Medium
7 3.8.184.124 ec2-3-8-184-124.eu-west-2.compute.amazonaws.com - Medium
8 3.17.156.183 ec2-3-17-156-183.us-east-2.compute.amazonaws.com - Medium
9 3.26.10.74 ec2-3-26-10-74.ap-southeast-2.compute.amazonaws.com - Medium
10 3.67.64.179 ec2-3-67-64-179.eu-central-1.compute.amazonaws.com - Medium
11 3.71.188.11 ec2-3-71-188-11.eu-central-1.compute.amazonaws.com - Medium
12 3.72.1.193 ec2-3-72-1-193.eu-central-1.compute.amazonaws.com - Medium
13 3.72.106.201 ec2-3-72-106-201.eu-central-1.compute.amazonaws.com - Medium
14 3.72.110.16 ec2-3-72-110-16.eu-central-1.compute.amazonaws.com - Medium
15 3.84.191.39 ec2-3-84-191-39.compute-1.amazonaws.com - Medium
16 3.85.21.250 ec2-3-85-21-250.compute-1.amazonaws.com - Medium
17 3.87.213.122 ec2-3-87-213-122.compute-1.amazonaws.com - Medium
18 3.105.246.81 ec2-3-105-246-81.ap-southeast-2.compute.amazonaws.com - Medium
19 3.110.101.202 ec2-3-110-101-202.ap-south-1.compute.amazonaws.com - Medium
20 3.110.107.80 ec2-3-110-107-80.ap-south-1.compute.amazonaws.com - Medium
21 3.149.246.173 ec2-3-149-246-173.us-east-2.compute.amazonaws.com - Medium
22 3.208.22.29 ec2-3-208-22-29.compute-1.amazonaws.com - Medium
23 3.215.181.98 ec2-3-215-181-98.compute-1.amazonaws.com - Medium
24 3.249.31.242 ec2-3-249-31-242.eu-west-1.compute.amazonaws.com - Medium
25 4.180.20.2 - - High
26 4.196.211.113 - - High
27 4.231.105.17 - - High
28 5.35.34.36 v2259232.hosted-by-vdsina.ru - High
29 5.44.42.124 zema.ip-ptr.tech - High
30 5.53.125.31 teal.rvncerr.org - High
31 5.61.41.71 - - High
32 5.161.118.248 static.248.118.161.5.clients.your-server.de - High
33 5.161.197.230 static.230.197.161.5.clients.your-server.de - High
34 5.182.37.3 vm1450803.stark-industries.solutions - High
35 5.188.87.39 - - High
36 5.252.178.146 5-252-178-146.mivocloud.com - High
37 5.252.178.157 5-252-178-157.mivocloud.com - High
38 5.255.97.196 - - High
39 5.255.123.86 - - High
40 8.208.95.78 - - High
41 8.210.103.41 - - High
42 8.210.104.188 - - High
43 8.217.13.6 - - High
44 8.217.111.67 - - High
45 8.219.206.59 - - High
46 8.222.230.219 - - High
47 13.38.219.27 ec2-13-38-219-27.eu-west-3.compute.amazonaws.com - Medium
48 13.39.48.10 ec2-13-39-48-10.eu-west-3.compute.amazonaws.com - Medium
49 13.39.237.2 ec2-13-39-237-2.eu-west-3.compute.amazonaws.com - Medium
50 13.41.55.238 ec2-13-41-55-238.eu-west-2.compute.amazonaws.com - Medium
51 13.42.17.180 ec2-13-42-17-180.eu-west-2.compute.amazonaws.com - Medium
52 13.48.45.227 ec2-13-48-45-227.eu-north-1.compute.amazonaws.com - Medium
53 13.53.84.163 ec2-13-53-84-163.eu-north-1.compute.amazonaws.com - Medium
54 13.93.75.195 - - High
55 13.125.17.253 ec2-13-125-17-253.ap-northeast-2.compute.amazonaws.com - Medium
56 13.209.21.1 ec2-13-209-21-1.ap-northeast-2.compute.amazonaws.com - Medium
57 13.213.147.86 ec2-13-213-147-86.ap-southeast-1.compute.amazonaws.com - Medium
58 13.213.218.169 ec2-13-213-218-169.ap-southeast-1.compute.amazonaws.com - Medium
59 13.214.204.113 ec2-13-214-204-113.ap-southeast-1.compute.amazonaws.com - Medium
60 13.215.191.59 ec2-13-215-191-59.ap-southeast-1.compute.amazonaws.com - Medium
61 13.235.248.157 ec2-13-235-248-157.ap-south-1.compute.amazonaws.com - Medium
62 13.235.254.216 ec2-13-235-254-216.ap-south-1.compute.amazonaws.com - Medium
63 13.244.111.157 ec2-13-244-111-157.af-south-1.compute.amazonaws.com - Medium
64 13.244.144.1 ec2-13-244-144-1.af-south-1.compute.amazonaws.com - Medium
65 13.246.26.24 ec2-13-246-26-24.af-south-1.compute.amazonaws.com - Medium
66 15.188.15.165 ec2-15-188-15-165.eu-west-3.compute.amazonaws.com - Medium
67 15.188.62.181 ec2-15-188-62-181.eu-west-3.compute.amazonaws.com - Medium
68 16.16.26.234 ec2-16-16-26-234.eu-north-1.compute.amazonaws.com - Medium
69 16.62.217.129 ec2-16-62-217-129.eu-central-2.compute.amazonaws.com - Medium
70 16.170.155.141 ec2-16-170-155-141.eu-north-1.compute.amazonaws.com - Medium
71 16.170.217.78 ec2-16-170-217-78.eu-north-1.compute.amazonaws.com - Medium
72 16.171.54.181 ec2-16-171-54-181.eu-north-1.compute.amazonaws.com - Medium
73 16.171.56.119 ec2-16-171-56-119.eu-north-1.compute.amazonaws.com - Medium
74 16.171.60.36 ec2-16-171-60-36.eu-north-1.compute.amazonaws.com - Medium
75 16.171.65.50 ec2-16-171-65-50.eu-north-1.compute.amazonaws.com - Medium
76 16.171.112.33 ec2-16-171-112-33.eu-north-1.compute.amazonaws.com - Medium
77 16.171.237.4 ec2-16-171-237-4.eu-north-1.compute.amazonaws.com - Medium
78 16.171.242.239 ec2-16-171-242-239.eu-north-1.compute.amazonaws.com - Medium
79 16.171.254.242 ec2-16-171-254-242.eu-north-1.compute.amazonaws.com - Medium
80 18.116.150.89 ec2-18-116-150-89.us-east-2.compute.amazonaws.com - Medium
81 18.117.107.132 ec2-18-117-107-132.us-east-2.compute.amazonaws.com - Medium
82 18.134.161.59 ec2-18-134-161-59.eu-west-2.compute.amazonaws.com - Medium
83 18.140.234.35 ec2-18-140-234-35.ap-southeast-1.compute.amazonaws.com - Medium
84 18.157.84.230 ec2-18-157-84-230.eu-central-1.compute.amazonaws.com - Medium
85 18.158.68.206 ec2-18-158-68-206.eu-central-1.compute.amazonaws.com - Medium
86 18.185.111.207 ec2-18-185-111-207.eu-central-1.compute.amazonaws.com - Medium
87 18.190.106.65 ec2-18-190-106-65.us-east-2.compute.amazonaws.com - Medium
88 18.191.149.233 ec2-18-191-149-233.us-east-2.compute.amazonaws.com - Medium
89 18.195.241.171 ec2-18-195-241-171.eu-central-1.compute.amazonaws.com - Medium
90 18.196.5.34 ec2-18-196-5-34.eu-central-1.compute.amazonaws.com - Medium
91 18.196.203.78 ec2-18-196-203-78.eu-central-1.compute.amazonaws.com - Medium
92 18.198.246.147 ec2-18-198-246-147.eu-central-1.compute.amazonaws.com - Medium
93 18.204.35.247 ec2-18-204-35-247.compute-1.amazonaws.com - Medium
94 18.208.213.147 ec2-18-208-213-147.compute-1.amazonaws.com - Medium
95 18.214.99.112 ec2-18-214-99-112.compute-1.amazonaws.com - Medium
96 18.216.147.202 ec2-18-216-147-202.us-east-2.compute.amazonaws.com - Medium
97 18.219.102.188 ec2-18-219-102-188.us-east-2.compute.amazonaws.com - Medium
98 18.224.73.25 ec2-18-224-73-25.us-east-2.compute.amazonaws.com - Medium
99 20.12.180.13 - - High
100 20.15.162.87 - - High
101 20.19.1.146 - - High
102 20.52.226.156 - - High
103 20.52.249.198 - - High
104 20.55.94.241 - - High
105 20.61.52.34 - - High
106 20.67.246.154 - - High
107 20.71.97.27 - - High
108 20.74.236.100 - - High
109 20.84.6.140 - - High
110 20.92.20.220 - - High
111 20.93.5.194 - - High
112 20.94.83.139 - - High
113 20.107.115.8 - - High
114 20.109.45.183 - - High
115 20.115.112.114 - - High
116 20.126.20.79 - - High
117 20.157.16.178 - - High
118 20.158.49.49 - - High
119 20.160.143.1 - - High
120 20.197.230.164 - - High
121 20.199.89.215 - - High
122 20.220.86.194 - - High
123 20.224.91.188 - - High
124 20.235.26.66 - - High
125 23.26.55.9 23.26.55.9-static.reverse.arandomserver.com - High
126 23.83.133.160 - - High
127 23.83.133.164 - - High
128 23.94.50.240 23-94-50-240-host.colocrossing.com - High
129 23.94.59.56 23-94-59-56-host.colocrossing.com - High
130 23.94.198.26 23-94-198-26-host.colocrossing.com - High
131 23.95.44.80 23-95-44-80-host.colocrossing.com - High
132 23.105.212.89 23.105.212.89.16clouds.com - High
133 23.106.215.192 clearmetro.net - High
134 24.99.36.214 - - High
135 24.144.90.189 - - High
136 24.199.106.201 backstopsolution.net - High
137 24.199.125.30 - - High
138 27.124.44.241 - - High
139 31.41.244.85 - - High
140 31.187.76.237 - - High
141 31.220.89.214 ip-214-89-220-31.static.contabo.net - High
142 31.220.94.133 vmi1504295.contaboserver.net - High
143 31.222.238.48 esx.com - High
144 31.223.16.23 23.16.223.31.srv.turk.net - High
145 34.18.9.224 224.9.18.34.bc.googleusercontent.com - Medium
146 34.29.20.95 95.20.29.34.bc.googleusercontent.com - Medium
147 34.92.127.28 28.127.92.34.bc.googleusercontent.com - Medium
148 34.93.29.231 231.29.93.34.bc.googleusercontent.com - Medium
149 34.93.89.189 189.89.93.34.bc.googleusercontent.com - Medium
150 34.100.240.82 82.240.100.34.bc.googleusercontent.com - Medium
151 34.116.228.55 55.228.116.34.bc.googleusercontent.com - Medium
152 34.136.114.164 164.114.136.34.bc.googleusercontent.com - Medium
153 34.203.229.137 ec2-34-203-229-137.compute-1.amazonaws.com - Medium
154 34.217.46.159 ec2-34-217-46-159.us-west-2.compute.amazonaws.com - Medium
155 34.224.40.221 ec2-34-224-40-221.compute-1.amazonaws.com - Medium
156 34.227.89.96 ec2-34-227-89-96.compute-1.amazonaws.com - Medium
157 34.229.221.1 ec2-34-229-221-1.compute-1.amazonaws.com - Medium
158 34.231.34.198 ec2-34-231-34-198.compute-1.amazonaws.com - Medium
159 34.231.97.149 ec2-34-231-97-149.compute-1.amazonaws.com - Medium
160 34.232.77.201 ec2-34-232-77-201.compute-1.amazonaws.com - Medium
161 34.235.159.186 ec2-34-235-159-186.compute-1.amazonaws.com - Medium
162 34.239.255.86 ec2-34-239-255-86.compute-1.amazonaws.com - Medium
163 34.243.164.16 ec2-34-243-164-16.eu-west-1.compute.amazonaws.com - Medium
164 35.75.17.242 ec2-35-75-17-242.ap-northeast-1.compute.amazonaws.com - Medium
165 35.90.217.46 ec2-35-90-217-46.us-west-2.compute.amazonaws.com - Medium
166 35.92.41.20 ec2-35-92-41-20.us-west-2.compute.amazonaws.com - Medium
167 35.136.215.120 035-136-215-120.dhcp.bhn.net - High
168 35.158.7.214 ec2-35-158-7-214.eu-central-1.compute.amazonaws.com - Medium
169 35.158.109.72 ec2-35-158-109-72.eu-central-1.compute.amazonaws.com - Medium
170 35.167.204.55 ec2-35-167-204-55.us-west-2.compute.amazonaws.com - Medium
171 35.173.234.124 ec2-35-173-234-124.compute-1.amazonaws.com - Medium
172 35.178.199.73 ec2-35-178-199-73.eu-west-2.compute.amazonaws.com - Medium
173 35.178.199.78 ec2-35-178-199-78.eu-west-2.compute.amazonaws.com - Medium
174 ... ... ... ...

There are 694 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Havoc. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23, CWE-24, CWE-36, CWE-37, CWE-425 Pathname Traversal High
2 T1040 CWE-294, CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-88, CWE-94 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 ... ... ... ...

There are 21 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Havoc. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File %PROGRAMFILES(X86)%\TSplus\UserDesktop\themes. High
2 File .../gogo/ Medium
3 File /.env Low
4 File /?ajax-request=jnews High
5 File /?r=recruit/resume/edit&op=status High
6 File /admin/?page=user/list High
7 File /admin/?page=user/manage_user&id=3 High
8 File /admin/about-us.php High
9 File /admin/action/new-father.php High
10 File /admin/del_category.php High
11 File /admin/del_service.php High
12 File /admin/edit-accepted-appointment.php High
13 File /admin/edit-services.php High
14 File /admin/edit_category.php High
15 File /admin/edit_subject.php High
16 File /admin/forgot-password.php High
17 File /admin/index.php High
18 File /admin/maintenance/view_designation.php High
19 File /admin/products/manage_product.php High
20 File /admin/reg.php High
21 File /admin/search-appointment.php High
22 File /admin/students/manage.php High
23 File /admin/sys_sql_query.php High
24 File /api/baskets/{name} High
25 File /api/user/upsert/<uuid> High
26 File /api/v2/cli/commands High
27 File /api/v4/teams//channels/deleted High
28 File /appliance/users?action=edit High
29 File /apply.cgi Medium
30 File /backup.pl Medium
31 File /bin/boa Medium
32 File /blog Low
33 File /booking/show_bookings/ High
34 File /cgi-bin/cstecgi.cgi High
35 File /cgi-bin/cstecgi.cgi?action=login High
36 File /cgi-bin/wlogin.cgi High
37 File /collection/all High
38 File /config/php.ini High
39 File /debug/pprof Medium
40 File /dipam/athlete-profile.php High
41 File /DXR.axd Medium
42 File /E-mobile/App/System/File/downfile.php High
43 File /edoc/doctor/patient.php High
44 File /emap/devicePoint_addImgIco?hasSubsystem=true High
45 File /etc/ldap.conf High
46 File /etc/shadow Medium
47 File /forum/away.php High
48 File /fusion/portal/action/Link High
49 File /HNAP1/ Low
50 File /importexport.php High
51 File /index.php Medium
52 File /index.php?app=main&func=passport&action=login High
53 File /kelasdosen/data High
54 File /listplace/user/coverPhotoUpdate High
55 File /login/index.php High
56 File /nagiosxi/admin/banner_message-ajaxhelper.php High
57 File /novel/bookSetting/list High
58 File /osm/REGISTER.cmd High
59 File /out.php Medium
60 File /owa/auth/logon.aspx High
61 File /paysystem/datatable.php High
62 ... ... ...

There are 539 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2024 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!