{
  "name": "Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA",
  "slug": "burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa",
  "description": "A zero-day vulnerability exploited by an advanced adversary to gain access to a victim\u2019s network, according to research by FortiGuard Labs and the Centre for Strategic Intelligence (CISA).",
  "published": "2024-10-15T16:04:52+00:00",
  "created_at": "2024-10-15T16:04:52+00:00",
  "modified_at": "2024-10-15T16:19:20+00:00",
  "created_at_opencti": "2024-10-15T16:04:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-15",
    "attack",
    "csa appliance",
    "cve20248190",
    "life",
    "lockbit",
    "malicious",
    "powershell",
    "rootkit",
    "service",
    "threat actor",
    "web shell",
    "zero",
    "zero-day vulnerability"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "74.62.81.162"
      },
      {
        "id": "",
        "name": "69.49.88.235"
      },
      {
        "id": "",
        "name": "67.217.228.92"
      },
      {
        "id": "",
        "name": "51.91.79.17"
      },
      {
        "id": "",
        "name": "38.207.159.76"
      },
      {
        "id": "",
        "name": "208.105.190.170"
      },
      {
        "id": "",
        "name": "156.234.193.18"
      },
      {
        "id": "",
        "name": "45.61.136.189"
      },
      {
        "id": "",
        "name": "216.131.75.52"
      },
      {
        "id": "",
        "name": "23.236.66.97"
      },
      {
        "id": "",
        "name": "l8u6aolk4ejfsl9zeq6321zvwm2eq3.burpcollaborator.net"
      },
      {
        "id": "",
        "name": "iowxuintgredogzgblrsmr2cx2e471bor.oast.fun"
      },
      {
        "id": "",
        "name": "apiv5.serverbks.xyz"
      },
      {
        "id": "",
        "name": "oast.fun"
      },
      {
        "id": "",
        "name": "d57a2cac394a778e19ce9b926f2e0a71936510798f30d20f207f2a49b49ce7b1"
      },
      {
        "id": "",
        "name": "8d016d02f8fbe25dce76481a90dd0b48630ce9e74e8c31ba007cf133e48b8526"
      },
      {
        "id": "",
        "name": "6edd7b3123de985846a805931ca8ee5f6f7ed7b160144aa0e066967bc7c0423a"
      }
    ],
    "attack_patterns": [
      {
        "id": "444de5e0-bd7f-4700-b700-26320057dd80",
        "name": "T1110"
      },
      {
        "id": "41af8283-2fa5-469e-9c29-e8ad77b4f224",
        "name": "T1014"
      },
      {
        "id": "eb118bf2-fdf2-4b49-a470-0acabf7608ad",
        "name": "T1505"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      }
    ]
  },
  "external_refs": [
    "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa",
    "https://otx.alienvault.com/pulse/670eaec50e8004d11d044338"
  ]
}