Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
21 IOCs
ColdFusion++ Christmas Campaign: Catching a Coordinated Callback Calamity
Excerpt
UPDATE: Further analysis revealed the ColdFusion campaign represents a small fraction of a much larger operation. The two primary IPs (134.122.136.119, 134.122.136.96) generated over 2.5 million requests targeting 767 distinct CVEs across 47+ technology stacks, using nearly 10,000 unique Interactsh OAST domains. This appears to be a broad, well-coordinated initial access broker campaign. Details in the Expanded Campaign Scope section below. GreyNoise observed a coordinated…
Read the original report →Indicators of Compromise
Open the mindmap →21 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2010-2035 | Medium | Score 51/100 | First seen |
| CVE | CVE-2014-6271 | Medium | Score 53/100 | First seen |
| CVE | CVE-2013-2251 | Medium | Score 51/100 | First seen |
| CVE | CVE-2002-1131 | Medium | Score 51/100 | First seen |
| CVE | CVE-2018-15961 | Medium | Score 51/100 | First seen |
| CVE | CVE-2022-47945 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-26359 | Medium | Score 51/100 | First seen |
| CVE | CVE-2013-2134 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-38204 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-44352 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-38205 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-26347 | Medium | Score 51/100 | First seen |
| CVE | CVE-2024-20767 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-29300 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-29298 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-44353 | Medium | Score 51/100 | First seen |
| CVE | CVE-2016-6195 | Medium | Score 51/100 | First seen |
| CVE | CVE-2022-26134 | High | Score 82/100 | First seen |
| CVE | CVE-2018-11776 | Medium | Score 51/100 | First seen |
| CVE | CVE-2017-10271 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-38203 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…