Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

CVE-2022-37155 is a high-severity remote code execution (RCE) vulnerability affecting SPIP versions 3.1.13 through 4.1.2. SPIP is an open-source content management system (CMS) widely used for website publishing, particularly in French-speaking regions. The vulnerability arises due to improper handling of the '_oups' parameter, which allows remote authenticated users to inject and execute arbitrary code on the affected server. This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating that user-supplied input is not properly sanitized before being evaluated or executed. Exploitation requires authentication but no user interaction beyond that, and the attack can be performed remotely over the network. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and no user interaction required. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk due to the potential for full system compromise, data theft, or service disruption. The lack of vendor or product-specific details in the provided data suggests that the vulnerability is specific to SPIP CMS itself rather than a third-party component. No official patches or mitigation links are listed, indicating that organizations must monitor SPIP project communications for updates or apply custom mitigations.

Detailed information about CVE-2022-37155: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2022-37155: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-37155: n/a in n/a

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Interlock ransomware evolving under the radar - Live Threat Intelligence - Threat Radar | OffSeq.com

Interlock ransomware evolving under the radar

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

Operation RoundPress is a sophisticated espionage campaign attributed to the Russia-aligned threat actor group Sednit, targeting high-value webmail servers primarily used by governmental and defense sector entities. The operation exploits cross-site scripting (XSS) vulnerabilities in popular webmail platforms, including Roundcube, Horde, MDaemon, and Zimbra. Initially observed in 2023 focusing on Roundcube, the campaign expanded in 2024 to target additional webmail software, leveraging multiple vulnerabilities, notably including a zero-day in MDaemon (CVE-2023-23397) and other CVEs such as CVE-2023-43770 and CVE-2024-11182. The attackers inject malicious JavaScript code into the webmail interface, enabling the SpyPress malware to stealthily harvest sensitive information. This includes stealing webmail credentials, exfiltrating contacts and email messages, and in some cases bypassing two-factor authentication mechanisms, significantly increasing the risk of unauthorized access and data compromise. The operation's targeting of governmental and defense organizations in Eastern Europe, with additional victims in Africa, Europe, and South America, indicates a strategic focus on high-value intelligence collection. The exploitation method relies on injecting malicious scripts via XSS vulnerabilities, which do not require initial authentication but do require the victim to access the compromised webmail interface, making user interaction a factor. Despite the medium severity rating assigned, the presence of zero-day exploits and the ability to bypass two-factor authentication elevate the technical sophistication and potential impact of this threat. No known public exploits have been reported yet, but the active targeting and use of zero-days underscore the urgency for affected organizations to implement mitigations promptly.

Detailed information about Operation RoundPress targeting high-value webmail servers. Get real-time updates, technical details, and mitigation strategies.

Operation RoundPress targeting high-value webmail servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation RoundPress targeting high-value webmail servers

M2M -  Trickbot 2017-06-12 : mac1 : Facture N 1234 du 12/06/2017 - "FACTURE_1234.zip"

The provided information references a threat related to Trickbot, a well-known banking Trojan and malware family that has been active since around 2016. The specific entry dates back to June 12, 2017, and appears to be associated with a malicious email campaign using a French-language invoice-themed lure ("Facture N 1234 du 12/06/2017"), with a ZIP attachment named "FACTURE_1234.zip". Trickbot typically propagates via phishing emails containing malicious attachments or links, aiming to infect victims' systems to steal banking credentials, personal data, and facilitate further malware deployment. Although the exact technical details are sparse in this record, Trickbot is known for modular architecture, enabling it to perform credential theft, network reconnaissance, lateral movement, and delivery of additional payloads such as ransomware. The threat level is indicated as low in this record, and no known exploits in the wild are reported here, suggesting this specific campaign or sample may have had limited impact or was detected early. The lack of affected versions or patch links indicates this is not a vulnerability but rather a malware campaign. The use of French invoice-themed lures suggests targeting French-speaking users or organizations, possibly in Europe. Trickbot's persistence and modularity make it a significant threat when active, often used in multi-stage attacks. However, this particular entry does not provide detailed technical indicators or exploit mechanisms beyond the phishing vector and attachment name.

Detailed information about M2M -  Trickbot 2017-06-12 : mac1 : Facture N 1234 du 12/06/2017 - "FACTURE_1234.zip". Get real-time updates, technical details, and 

Title	Severity	Type	Source	Date

Threats Affecting Monaco

Filter Threats

Threats Affecting Monaco

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility