Mirrors/cyber_threat_intelligence
6
0
Fork 0
mirror of https://github.com/vuldb/cyber_threat_intelligence synced 2024-06-29 02:12:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
a4924b8159
cyber_threat_intelligence/actors/Tofsee
History
Marc Ruef a4924b8159 Update August 2023
2023-08-01 08:06:09 +02:00
..
README.md Update August 2023 2023-08-01 08:06:09 +02:00

README.md

Tofsee - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as Tofsee. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.tofsee

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with Tofsee:

There are 14 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of Tofsee.

ID IP address Hostname Campaign Confidence
1 2.22.2.5 a2-22-2-5.deploy.static.akamaitechnologies.com - High
2 2.57.187.191 - - High
3 5.8.10.237 - - High
4 5.9.32.166 static.166.32.9.5.clients.your-server.de - High
5 5.9.49.12 static.12.49.9.5.clients.your-server.de - High
6 5.9.72.48 cpanelbk.pcready.me - High
7 5.61.37.41 - - High
8 5.61.236.235 is-antiddos-front-vip8.i.smailru.net - High
9 5.135.183.146 freya.stelas.de - High
10 12.167.151.115 - - High
11 12.167.151.116 - - High
12 12.167.151.117 - - High
13 12.167.151.119 - - High
14 13.107.21.200 - - High
15 13.107.42.14 - - High
16 13.225.224.25 server-13-225-224-25.jfk51.r.cloudfront.net - High
17 18.209.118.139 cxr.mx.a.cloudfilter.net - High
18 18.237.235.220 ec2-18-237-235-220.us-west-2.compute.amazonaws.com - Medium
19 20.44.209.209 - - High
20 20.53.203.50 - - High
21 20.81.111.85 - - High
22 20.84.181.62 - - High
23 20.103.85.33 - - High
24 20.112.52.29 - - High
25 23.3.13.35 a23-3-13-35.deploy.static.akamaitechnologies.com - High
26 23.3.13.88 a23-3-13-88.deploy.static.akamaitechnologies.com - High
27 23.3.112.125 a23-3-112-125.deploy.static.akamaitechnologies.com - High
28 23.5.227.69 a23-5-227-69.deploy.static.akamaitechnologies.com - High
29 23.5.238.94 a23-5-238-94.deploy.static.akamaitechnologies.com - High
30 23.5.238.97 a23-5-238-97.deploy.static.akamaitechnologies.com - High
31 23.10.92.253 a23-10-92-253.deploy.static.akamaitechnologies.com - High
32 23.10.134.216 a23-10-134-216.deploy.static.akamaitechnologies.com - High
33 23.15.9.58 a23-15-9-58.deploy.static.akamaitechnologies.com - High
34 23.36.87.113 a23-36-87-113.deploy.static.akamaitechnologies.com - High
35 23.61.211.155 a23-61-211-155.deploy.static.akamaitechnologies.com - High
36 23.64.99.87 a23-64-99-87.deploy.static.akamaitechnologies.com - High
37 23.64.110.75 a23-64-110-75.deploy.static.akamaitechnologies.com - High
38 23.78.210.51 a23-78-210-51.deploy.static.akamaitechnologies.com - High
39 23.90.4.6 dementia.virtual-dope.com - High
40 23.94.5.133 23-94-5-133-host.colocrossing.com - High
41 23.160.0.108 - - High
42 23.216.244.163 a23-216-244-163.deploy.static.akamaitechnologies.com - High
43 23.218.146.162 a23-218-146-162.deploy.static.akamaitechnologies.com - High
44 23.239.11.30 mail.mailinator.com - High
45 31.13.64.174 instagram-p42-shv-01-amt2.fbcdn.net - High
46 31.13.65.52 instagram-p3-shv-01-atl3.fbcdn.net - High
47 31.13.65.174 instagram-p42-shv-01-atl3.fbcdn.net - High
48 31.13.66.174 instagram-p42-shv-01-iad3.fbcdn.net - High
49 31.13.71.174 instagram-p42-shv-01-lga3.fbcdn.net - High
50 31.13.93.174 instagram-p42-shv-02-dfw5.fbcdn.net - High
51 31.31.194.100 vip89.hosting.reg.ru - High
52 31.31.198.239 scp110.hosting.reg.ru - High
53 31.41.244.81 - - High
54 31.41.244.82 - - High
55 31.41.244.84 - - High
56 31.41.244.85 - - High
57 31.41.244.126 - - High
58 31.41.244.128 - - High
59 31.41.244.200 - - High
60 31.42.189.81 simamail1.ga - High
61 31.192.237.6 fastlined.online - High
62 34.98.127.226 226.127.98.34.bc.googleusercontent.com - Medium
63 34.117.59.81 81.59.117.34.bc.googleusercontent.com - Medium
64 34.205.21.41 ec2-34-205-21-41.compute-1.amazonaws.com - Medium
65 34.212.80.54 cxr.mx.a.cloudfilter.net - High
66 34.223.6.127 ec2-34-223-6-127.us-west-2.compute.amazonaws.com - Medium
67 35.162.106.154 cxr.mx.a.cloudfilter.net - High
68 35.228.103.145 145.103.228.35.bc.googleusercontent.com - Medium
69 37.1.217.172 - - High
70 37.28.155.134 vi37-28-155-134.vibiznes.pl - High
71 37.34.248.24 - - High
72 37.235.1.174 resolver1.freedns.zone.powered.by.virtexxa.com - High
73 40.76.4.15 - - High
74 40.93.207.0 - - High
75 40.93.207.1 mail-bn3pr00cu00201.inbound.protection.outlook.com - High
76 40.93.207.2 - - High
77 40.93.207.7 - - High
78 40.93.212.0 - - High
79 40.97.188.2 - - High
80 40.112.72.205 - - High
81 40.113.200.201 - - High
82 43.231.4.6 - - High
83 43.231.4.7 - - High
84 45.8.124.99 free.gbnhost.com - High
85 45.8.229.39 - - High
86 45.9.20.178 - - High
87 45.9.20.187 - - High
88 45.32.28.232 - - High
89 45.33.83.75 li1029-75.members.linode.com - High
90 45.56.117.118 li935-118.members.linode.com - High
91 45.61.139.224 - - High
92 45.63.25.55 45.63.25.55.vultrusercontent.com - High
93 45.63.99.180 45.63.99.180.vultrusercontent.com - High
94 45.90.34.87 - - High
95 45.90.219.105 vm1430047.firstbyte.club - High
96 45.93.6.27 - - High
97 45.140.167.9 superia.cf - High
98 45.143.137.184 alex.dubikov.example.com - High
99 45.143.201.238 free.ntup.net - High
100 45.150.65.4 vm1085147.stark-industries.solutions - High
101 45.155.204.13 - - High
102 45.159.189.105 . - High
103 46.4.52.109 witntech.dev - High
104 46.28.66.2 unallocated.layer6.net - High
105 46.173.218.209 - - High
106 47.43.18.9 mx0.bresnan.net.msg.chrl.nc.charter.net - High
107 47.43.26.7 pkvw-mx.msg.pkvw.co.charter.net - High
108 47.251.38.135 - - High
109 51.81.57.58 oxsus1lb01p.external.vadesecure.com - High
110 51.81.61.70 mx01.earthlink-vadesecure.net - High
111 51.158.144.223 51-158-144-223.rev.poneytelecom.eu - High
112 51.178.207.67 host-35d452a2.hostiman.com - High
113 52.11.241.224 ec2-52-11-241-224.us-west-2.compute.amazonaws.com - Medium
114 52.73.137.222 cxr.mx.a.cloudfilter.net - High
115 52.101.24.0 - - High
116 52.101.40.29 - - High
117 52.180.174.216 - - High
118 52.223.241.7 - - High
119 54.36.100.25 vps-0cc65142.vps.ovh.net - High
120 54.38.220.85 ns1.emailverification.info - High
121 54.184.154.83 ec2-54-184-154-83.us-west-2.compute.amazonaws.com - Medium
122 58.235.189.192 - - High
123 62.42.230.22 62.42.230.22.static.user.ono.com - High
124 62.141.42.208 srv21237.dus4.fastwebserver.de - High
125 62.204.41.45 - - High
126 62.204.41.46 - - High
127 62.204.41.48 - - High
128 62.204.41.50 - - High
129 62.204.41.210 - - High
130 62.204.41.212 - - High
131 62.211.72.32 mx.tin.it - High
132 63.240.178.216 - - High
133 64.8.71.111 mx.wowway.com - High
134 64.88.254.180 - - High
135 64.98.36.4 mx.b.hostedemail.com - High
136 64.136.44.37 mx.dca.untd.com - High
137 64.136.52.37 mx.vgs.untd.com - High
138 64.233.184.26 wa-in-f26.1e100.net - High
139 ... ... ... ...

There are 553 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by Tofsee. This data is unique as it uses our predictive model for actor profiling.

ID Technique Weakness Description Confidence
1 T1006 CWE-21, CWE-22, CWE-23, CWE-28 Pathname Traversal High
2 T1040 CWE-294, CWE-319 Authentication Bypass by Capture-replay High
3 T1055 CWE-74 Injection High
4 T1059 CWE-88, CWE-94, CWE-1321 Cross Site Scripting High
5 T1059.007 CWE-79, CWE-80 Cross Site Scripting High
6 T1068 CWE-264, CWE-269, CWE-284 J2EE Misconfiguration: Weak Access Permissions for EJB Methods High
7 ... ... ... ...

There are 22 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by Tofsee. This data is unique as it uses our predictive model for actor profiling.

ID Type Indicator Confidence
1 File /?p=products Medium
2 File /admin.php/accessory/filesdel.html High
3 File /admin/?page=user/manage High
4 File /admin/add-new.php High
5 File /admin/departments/view_department.php High
6 File /admin/doctors.php High
7 File /admin/read.php?mudi=getSignal High
8 File /admin/submit-articles High
9 File /admin/userprofile.php High
10 File /alphaware/summary.php High
11 File /api/ Low
12 File /api/admin/store/product/list High
13 File /api/baskets/{name} High
14 File /api/stl/actions/search High
15 File /api/v2/cli/commands High
16 File /apply.cgi Medium
17 File /attachments Medium
18 File /bin/ate Medium
19 File /boat/login.php High
20 File /booking/show_bookings/ High
21 File /bsms_ci/index.php/book High
22 File /cgi-bin Medium
23 File /cgi-bin/wlogin.cgi High
24 File /College/admin/teacher.php High
25 File /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx High
26 File /dcim/rack-roles/ High
27 File /debug/pprof Medium
28 File /env Low
29 File /etc/hosts Medium
30 File /etc/passwd Medium
31 File /forum/away.php High
32 File /goform/addUserName High
33 File /goform/aspForm High
34 File /goform/delAd High
35 File /goform/SysToolChangePwd High
36 File /goform/wifiSSIDset High
37 File /gpac/src/bifs/unquantize.c High
38 File /inc/topBarNav.php High
39 File /index.php Medium
40 File /index.php?app=main&func=passport&action=login High
41 File /kelas/data Medium
42 File /medicines/profile.php High
43 File /modules/caddyhttp/rewrite/rewrite.go High
44 File /Moosikay/order.php High
45 File /php-sms/admin/?page=user/manage_user High
46 ... ... ...

There are 403 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

Literature

The following articles explain our unique predictive cyber threat intelligence:

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!