Skip to main content
Threat Radar animated logo
DashboardThreatsMapFeedsAPILifetime Access
reconnecting
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

0
Low
UnknownCVE-2023-46805type:osintosint:lifetime="perpetual"osint:certainty="50"tlp:whitetlp:clearmisp-galaxy:country="afghanistan"misp-galaxy:country="brazil"misp-galaxy:country="eswatini"misp-galaxy:country="india"misp-galaxy:country="indonesia"misp-galaxy:country="malaysia"misp-galaxy:country="pakistan"misp-galaxy:country="philippines"misp-galaxy:country="south africa"misp-galaxy:country="taiwan"misp-galaxy:country="thailand"misp-galaxy:country="united states of america"misp-galaxy:country="vietnam"misp-galaxy:threat-actor="earth estries"misp-galaxy:sector="consulting"misp-galaxy:sector="managed services provider"misp-galaxy:sector="ngo"misp-galaxy:sector="telecoms"
Published: Wed Nov 27 2024 (11/27/2024, 00:00:00 UTC)
Source: CIRCL OSINT Feed
Vendor/Project: type
Product: osint

Description

The 'Game of Emperor' report reveals a long-term cyber intrusion campaign attributed to the threat actor 'Earth Estries,' targeting multiple sectors including consulting, managed service providers, NGOs, and telecoms across various countries primarily outside Europe. The campaign appears to be persistent and ongoing, with a low severity rating and no known exploits or patches available. The threat actor's activity has been observed in countries such as Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. Although no direct European targets are listed, the sectors affected and the global nature of managed service providers and telecoms imply potential indirect risks to European organizations. The lack of detailed technical indicators and the unknown nature of the threat limit precise mitigation steps, but vigilance and enhanced monitoring of supply chains and third-party providers are recommended. Given the low severity and absence of known exploits, the threat is assessed as medium severity due to its persistence and potential for indirect impact.

AI-Powered Analysis

AILast updated: 12/24/2025, 06:08:53 UTC

Technical Analysis

The 'Game of Emperor' campaign, attributed to the threat actor 'Earth Estries,' represents a long-term cyber intrusion effort identified through OSINT sources. The campaign targets sectors including consulting, managed service providers, NGOs, and telecoms, which are critical for information flow and infrastructure support. The affected countries span multiple continents, with a focus on Asia, Africa, and the Americas, but no direct European countries are listed among the affected. The campaign's persistence suggests a strategic intent to maintain access or influence over targeted networks. The CVE-2023-46805 is referenced but lacks detailed vulnerability or exploit information, and no patches or known exploits exist, indicating either a newly discovered or poorly understood threat vector. The low severity rating assigned may reflect limited immediate impact or exploitation capability. The absence of technical indicators and detailed attack vectors restricts comprehensive technical analysis, but the involvement of managed service providers and telecoms raises concerns about supply chain risks and potential lateral movement into connected networks. The campaign's OSINT classification and 50% certainty indicate moderate confidence in the attribution and impact assessment. Overall, this threat highlights the importance of monitoring persistent, low-profile intrusion campaigns that may serve as precursors to more significant attacks.

Potential Impact

For European organizations, the direct impact appears limited due to the absence of explicit targeting of European countries. However, the involvement of managed service providers and telecom sectors globally suggests potential indirect risks through supply chain compromise or third-party access. European entities relying on affected sectors or providers in the listed countries could face confidentiality breaches, data integrity issues, or service disruptions if the threat actor expands operations or leverages existing footholds. Persistent intrusions increase the risk of long-term espionage, intellectual property theft, or preparatory activities for future attacks. The low severity rating and lack of known exploits reduce immediate risk, but the campaign's longevity and sector focus warrant caution. NGOs and consulting firms in Europe working with or within affected regions may also be at risk of targeted espionage or data compromise. Overall, the impact is potentially medium due to indirect exposure and the strategic value of the targeted sectors.

Mitigation Recommendations

1. Conduct thorough supply chain risk assessments focusing on managed service providers and telecom partners, especially those operating in or connected to the affected countries. 2. Enhance network segmentation and access controls to limit lateral movement from third-party connections. 3. Implement continuous monitoring and anomaly detection tailored to detect persistent, low-and-slow intrusion behaviors. 4. Increase threat intelligence sharing with industry peers and national cybersecurity centers to stay informed about evolving tactics of the 'Earth Estries' actor. 5. Review and tighten security policies for consulting and NGO engagements involving sensitive data or cross-border collaborations. 6. Conduct regular security audits and penetration testing focusing on third-party integrations. 7. Develop incident response plans that consider supply chain compromise scenarios. 8. Educate staff on social engineering and spear-phishing risks, as these are common vectors in persistent intrusion campaigns. 9. Maintain up-to-date asset inventories to quickly identify and isolate potentially compromised systems. 10. Collaborate with telecom providers to monitor for unusual network activity indicative of intrusion attempts.

Affected Countries

GermanyGermany
FranceFrance
United KingdomUnited Kingdom
NetherlandsNetherlands
ItalyItaly
SpainSpain
BelgiumBelgium
SwedenSweden
Need more detailed analysis?Upgrade to Pro Console

Technical Details

Uuid
ffea72a3-7935-4078-b769-b872475c5eae
Original Timestamp
1732697965

Indicators of Compromise

Vulnerability

ValueDescriptionCopy
vulnerabilityCVE-2023-46805
—
vulnerabilityCVE-2024-21887
—
vulnerabilityCVE-2023-48788
—
vulnerabilityCVE-2022-3236
—
vulnerabilityCVE-2021-26855
—
vulnerabilityCVE-2021-26857
—
vulnerabilityCVE-2021-26858
—
vulnerabilityCVE-2021-27065
—
vulnerabilityCVE-2021-27065
—
vulnerabilityCVE-2021-26858
—
vulnerabilityCVE-2021-26857
—
vulnerabilityCVE-2021-26855
—
vulnerabilityCVE-2021-26857
—
vulnerabilityCVE-2021-26858
—
vulnerabilityCVE-2024-21887
—

Ip

ValueDescriptionCopy
ip139.59.108.43
Campaign Beta (GHOSTSPIDER)
ip185.105.1.243
Campaign Beta (GHOSTSPIDER)
ip143.198.92.175
Campaign Beta (GHOSTSPIDER)
ip139.99.114.108
Campaign Beta (GHOSTSPIDER)
ip139.59.236.31
Campaign Beta (GHOSTSPIDER)
ip104.194.153.65
Campaign Beta (GHOSTSPIDER)
ip45.125.67.144
Campaign Beta (DEMODEX)
ip43.226.126.164
Campaign Beta (DEMODEX)
ip172.93.165.10
Campaign Beta (DEMODEX)
ip193.239.86.168
Campaign Beta (DEMODEX)
ip146.70.79.18
Campaign Beta (DEMODEX)
ip146.70.79.105
Campaign Beta (DEMODEX)
ip205.189.160.3
Campaign Beta (DEMODEX)
ip96.9.211.27
Campaign Beta (DEMODEX)
ip43.226.126.165
Campaign Beta (DEMODEX)
ip103.75.190.73
Campaign Alpha (related C&C)
ip172.93.165.14
Campaign Alpha (related C&C)
ip91.245.253.27
Campaign Alpha (SNAPPYBEE)
ip158.247.222.165
Campaign Alpha (SNAPPYBEE)
ip23.81.41.166
Campaign Alpha (Open directory C&C)
ip165.154.227.192
Campaign Alpha (frpc)
ip103.91.64.214
Campaign Alpha (DEMODEX)
ip165.154.227.192
—

Link

ValueDescriptionCopy
linkhttps://www.trendmicro.com/en_us/research/24/k/earth-estries.html
—
linkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065
—
linkhttp://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
—
linkhttp://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
—
linkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858
—
linkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857
—
linkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855
—
linkhttp://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html
—
linkhttp://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
—
linkhttp://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html
—
linkhttp://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
—
linkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857
—
linkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858
—
linkhttps://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
—
linkhttp://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
—

Text

ValueDescriptionCopy
text- Earth Estries, a Chinese APT group, has primarily targeted critical sectors like telecommunications and government entities across the US, Asia-Pacific, Middle East, and South Africa since 2023. - The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities. - Earth Estries exploits public-facing server vulnerabilities to establish initial access and uses living-off-the-land binaries for lateral movement within networks to deploy malware and conduct long-term espionage. - The group has compromised over 20 organizations, targeting various sectors including telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies and NGOs in numerous countries. - Earth Estries uses a complex C&C infrastructure managed by different teams, and their operations often overlap with TTPs of other known Chinese APT groups, indicating possible use of shared tools from malware-as-a-service providers
—
textGame of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions
—
textBlog
—
textMicrosoft Exchange Server Remote Code Execution Vulnerability
—
textCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
—
textPublished
—
textImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
—
textStable
—
textBase
—
text76
—
textManipulating Web Input to File System Calls
—
textAn attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
—
textProgram must allow for user controlled variables to be applied directly to the filesystem
—
textDesign: Enforce principle of least privilege. Design: Ensure all input is validated, and does not contain file system commands Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.
—
text78
—
textUsing Escaped Slashes in Alternate Encoding
—
textThis attack targets the use of the backslash in alternate encoding. An attacker can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the attacker tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
—
textThe application accepts the backlash character as escape character. The application server does incomplete input data decoding, filtering and validation.
—
textVerify that the user-supplied data does not use backslash character to escape malicious characters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Be aware of the threat of alternative method of data encoding. Regular expressions can be used to filter out backslash. Make sure you decode before filtering and validating the untrusted input data. In the case of path traversals, use the principle of least privilege when determining access rights to file systems. Do not allow users to access directories/files that they should not access. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
—
text126
—
textPath Traversal
—
textAn adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files.
—
textThe attacker must be able to control the path that is requested of the target. The target must fail to adequately sanitize incoming paths
—
textDesign: Configure the access control correctly. Design: Enforce principle of least privilege. Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution. Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement. Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host. Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin. Implementation: Perform input validation for all remote content, including remote and user-generated content. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables. Implementation: Use indirect references rather than actual file names. Implementation: Use possible permissions on file access when developing and deploying web applications. Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- using an allowlist approach.
—
text64
—
textUsing Slashes and URL Encoding Combined to Bypass Validation Logic
—
textThis attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
—
textThe application accepts and decodes URL string request. The application performs insufficient filtering/canonicalization on the URLs.
—
textAssume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input. Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. When client input is required from web-based forms, avoid using the "GET" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the "POST method whenever possible. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Refer to the RFCs to safely decode URL. Regular expression can be used to match safe URL patterns. However, that may discard valid URL requests if the regular expression is too restrictive. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx).
—
text79
—
textUsing Slashes in Alternate Encoding
—
textThis attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.
—
textThe application server accepts paths to locate resources. The application server does insufficient input data validation on the resource path requested by the user. The access right to resources are not set properly.
—
textAny security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Refer to the RFCs to safely decode URL. When client input is required from web-based forms, avoid using the "GET" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the "POST method whenever possible. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx) Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. (See related guideline section) Test your path decoding process against malicious input. In the case of path traversals, use the principle of least privilege when determining access rights to file systems. Do not allow users to access directories/files that they should not access. Assume all input is malicious. Create an allowlist that defines all valid input to the application based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system.
—
textMicrosoft Exchange Server Remote Code Execution Vulnerability
—
textCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
—
textPublished
—
textMicrosoft Exchange Server Remote Code Execution Vulnerability
—
textCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
—
textPublished
—
textDeserialization of Untrusted Data
—
textDraft
—
textBase
—
text586
—
textObject Injection
—
textAn adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
—
textThe target application must unserialize data before validation.
—
textImplementation: Validate object before deserialization process Design: Limit which types can be deserialized. Implementation: Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. Use an allowlist of acceptable classes. Implementation: Keep session state on the server, when possible.
—
textMicrosoft Exchange Server Remote Code Execution Vulnerability
—
textCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
—
textPublished
—
textServer-Side Request Forgery (SSRF)
—
textIncomplete
—
textBase
—
textMicrosoft Exchange Server Remote Code Execution Vulnerability
—
textCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
—
textPublished
—
textMicrosoft Exchange Server Remote Code Execution Vulnerability
—
textCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
—
textPublished
—
textA command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
—
textCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
—
textPublished
—
textImproper Neutralization of Special Elements used in a Command ('Command Injection')
—
textDraft
—
textClass
—
text248
—
textCommand Injection
—
textAn adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
—
textThe target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed.
—
textAll user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary. Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter. Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.
—
text40
—
textManipulating Writeable Terminal Devices
—
textThis attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.
—
textUser terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals.
—
textDesign: Ensure that terminals are only writeable by named owner user and/or administrator Design: Enforce principle of least privilege
—
text43
—
textExploiting Multiple Input Interpretation Layers
—
textAn attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
—
textUser input is used to construct a command to be executed on the target system or as part of the file name. Multiple parser passes are performed on the data supplied by the user.
—
textAn iterative approach to input validation may be required to ensure that no dangerous characters are present. It may be necessary to implement redundant checking across different input validation layers. Ensure that invalid data is rejected as soon as possible and do not continue to work with it. Make sure to perform input validation on canonicalized data (i.e. data that is data in its most standard form). This will help avoid tricky encodings getting past the filters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist would not be permitted to enter into the system.
—
text136
—
textLDAP Injection
—
textAn attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.
—
textThe target application must accept a string as user input, fail to sanitize characters that have a special meaning in LDAP queries in the user input, and insert the user-supplied string in an LDAP query which is then processed.
—
textStrong input validation - All user-controllable input must be validated and filtered for illegal characters as well as LDAP content. Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about an error without disclosing information about the LDAP or application.
—
text15
—
textCommand Delimiters
—
textAn attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
—
textSoftware's input validation or filtering must not detect and block presence of additional malicious command.
—
textDesign: Perform allowlist validation against a positive specification for command length, type, and parameters. Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account Implementation: Perform input validation for all remote content. Implementation: Use type conversions such as JDBC prepared statements.
—
text183
—
textIMAP/SMTP Command Injection
—
textAn attacker exploits weaknesses in input validation on IMAP/SMTP servers to execute commands on the server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.
—
textThe target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker. The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server. The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server.
—
text75
—
textManipulating Writeable Configuration Files
—
textGenerally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
—
textConfiguration files must be modifiable by the attacker
—
textDesign: Enforce principle of least privilege Design: Backup copies of all configuration files Implementation: Integrity monitoring for configuration files Implementation: Enforce audit logging on code and configuration promotion procedures. Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD
—
textall
—
textBackdoor_GHOSTSPIDER_beacon_loader
—
textall
—
textBackdoor_GHOSTSPIDER_stager
—

Datetime

ValueDescriptionCopy
datetime2024-07-25T17:34:00+00:00
—
datetime2021-03-03T00:15:00+00:00
—
datetime2024-07-25T17:53:00+00:00
—
datetime2021-03-03T00:15:00+00:00
—
datetime2024-07-25T17:53:00+00:00
—
datetime2021-03-03T00:15:00+00:00
—
datetime2024-02-15T20:18:00+00:00
—
datetime2021-03-03T00:15:00+00:00
—
datetime2024-07-25T17:53:00+00:00
—
datetime2021-03-03T00:15:00+00:00
—
datetime2024-07-25T17:53:00+00:00
—
datetime2021-03-03T00:15:00+00:00
—
datetime2024-06-10T16:21:00+00:00
—
datetime2024-01-12T17:15:00+00:00
—

Float

ValueDescriptionCopy
float7.8
—
float7.8
—
float7.8
—
float9.1
—
float7.8
—
float7.8
—
float9.1
—

Cpe

ValueDescriptionCopy
cpecpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
—
cpecpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*
—
cpecpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*
—

Weakness

ValueDescriptionCopy
weaknessCWE-22
—
weaknessCWE-15
—
weaknessCWE-22
—
weaknessCWE-23
—
weaknessCWE-264
—
weaknessCWE-272
—
weaknessCWE-285
—
weaknessCWE-346
—
weaknessCWE-348
—
weaknessCWE-59
—
weaknessCWE-715
—
weaknessCWE-73
—
weaknessCWE-74
—
weaknessCWE-77
—
weaknessCWE-171
—
weaknessCWE-172
—
weaknessCWE-173
—
weaknessCWE-180
—
weaknessCWE-181
—
weaknessCWE-20
—
weaknessCWE-21
—
weaknessCWE-22
—
weaknessCWE-697
—
weaknessCWE-707
—
weaknessCWE-73
—
weaknessCWE-74
—
weaknessCWE-22
—
weaknessCWE-171
—
weaknessCWE-172
—
weaknessCWE-173
—
weaknessCWE-177
—
weaknessCWE-20
—
weaknessCWE-21
—
weaknessCWE-22
—
weaknessCWE-697
—
weaknessCWE-707
—
weaknessCWE-73
—
weaknessCWE-74
—
weaknessCWE-171
—
weaknessCWE-173
—
weaknessCWE-180
—
weaknessCWE-181
—
weaknessCWE-185
—
weaknessCWE-20
—
weaknessCWE-200
—
weaknessCWE-21
—
weaknessCWE-22
—
weaknessCWE-697
—
weaknessCWE-707
—
weaknessCWE-73
—
weaknessCWE-74
—
weaknessCWE-502
—
weaknessCWE-502
—
weaknessCWE-918
—
weaknessCWE-77
—
weaknessCWE-77
—
weaknessCWE-77
—
weaknessCWE-171
—
weaknessCWE-179
—
weaknessCWE-181
—
weaknessCWE-183
—
weaknessCWE-184
—
weaknessCWE-20
—
weaknessCWE-697
—
weaknessCWE-707
—
weaknessCWE-74
—
weaknessCWE-77
—
weaknessCWE-78
—
weaknessCWE-20
—
weaknessCWE-77
—
weaknessCWE-90
—
weaknessCWE-138
—
weaknessCWE-140
—
weaknessCWE-146
—
weaknessCWE-154
—
weaknessCWE-157
—
weaknessCWE-184
—
weaknessCWE-185
—
weaknessCWE-697
—
weaknessCWE-713
—
weaknessCWE-77
—
weaknessCWE-78
—
weaknessCWE-93
—
weaknessCWE-77
—
weaknessCWE-346
—
weaknessCWE-349
—
weaknessCWE-353
—
weaknessCWE-354
—
weaknessCWE-713
—
weaknessCWE-77
—
weaknessCWE-99
—

Yara

ValueDescriptionCopy
yararule Backdoor_GHOSTSPIDER_beacon_loader { meta: author = "Trend Micro Research" strings: $clr = { C7 45 ?? 43 4C 52 43 C7 45 ?? 72 65 61 74 C7 45 ?? 65 49 6E 73 C7 45 ?? 74 61 6E 63 } $chunk1 = { C1 EA ?? 0F B6 D2 8B 34 95 ?? ?? ?? ?? 8B 55 ?? C1 EA ?? 8B 14 95 ?? ?? ?? ?? C1 E9 ?? 0F B6 F9 33 34 BD ?? ?? ?? ?? 8B 7D ?? 89 75 ?? 31 55 ?? 0F B6 55 ?? 8B 75 ?? 33 34 95 ?? ?? ?? ?? 8B D3 33 B0 ?? ?? ?? ?? } $chunk2 = { 41 0F B6 1B 41 8B C2 99 41 F7 F9 48 63 C2 0F B6 4C 05 ?? 44 03 C1 44 03 C3 } condition: uint16(0) == 0x5a4d and filesize < 300KB and ( $clr and any of ($chunk*) ) }
—
yararule Backdoor_GHOSTSPIDER_stager { meta: author = "Trend Micro Research" strings: $s1 = "new_comp" ascii wide $s2 = "del_comp" ascii wide $s3 = "new_client" ascii wide $s4 = "del_client" ascii wide $s5 = "new_base" ascii wide $s6 = "del_base" ascii wide $cookie = "phpsessid=%s; b=%d; path=/; expires=%s" ascii wide condition: uint16(0) == 0x5a4d and filesize < 300KB and ( $cookie and 2 of ($s*) ) }
—

Hash

ValueDescriptionCopy
hash1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296
—
hash05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870
—
hashb2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac
—
hash6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc
—
hash25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b
—
hash9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c
—
hash16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266
—
hash2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec
DEMODEX PowerShell dropper
hashfba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098
SNAPPYBEE payload
hashfc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5
SNAPPYBEE loader

File

ValueDescriptionCopy
filedbindex.dat
—
fileimfsbDLL.dll
—
fileDgApi.dll
—
fileimfsbDLL.dll
—
fileDgApi.dll
—
file%WINDIR%\System32\SstpCfs.dll
—
file%WINDIR%\System32\drivers\dumpfiskfss.sys
—
fileonedrived.ps1
DEMODEX PowerShell dropper
fileNortonLog.txt
SNAPPYBEE payload
fileWINMM.dll
SNAPPYBEE loader

X509 fingerprint-sha256

ValueDescriptionCopy
x509-fingerprint-sha2562b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31
—

Threat ID: 6842e9ce71f4d251b5c75966

Added to database: 6/6/2025, 1:14:54 PM

Last enriched: 12/24/2025, 6:08:53 AM

Last updated: 1/17/2026, 2:01:36 PM

Views: 76

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Related Threats

ThreatFox IOCs for 2026-01-16

Medium
MalwareSat Jan 17 2026

ThreatFox IOCs for 2026-01-15

Medium
MalwareFri Jan 16 2026

KRVTZ IDS alerts for 2026-01-15

Low
UnknownThu Jan 15 2026

ThreatFox IOCs for 2026-01-14

Medium
MalwareThu Jan 15 2026

KRVTZ IDS alerts for 2026-01-14

Low
UnknownWed Jan 14 2026

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats