Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Interlock ransomware evolving under the radar - Live Threat Intelligence - Threat Radar | OffSeq.com

Interlock ransomware evolving under the radar

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

Operation RoundPress is a sophisticated espionage campaign attributed to the Russia-aligned threat actor group Sednit, targeting high-value webmail servers primarily used by governmental and defense sector entities. The operation exploits cross-site scripting (XSS) vulnerabilities in popular webmail platforms, including Roundcube, Horde, MDaemon, and Zimbra. Initially observed in 2023 focusing on Roundcube, the campaign expanded in 2024 to target additional webmail software, leveraging multiple vulnerabilities, notably including a zero-day in MDaemon (CVE-2023-23397) and other CVEs such as CVE-2023-43770 and CVE-2024-11182. The attackers inject malicious JavaScript code into the webmail interface, enabling the SpyPress malware to stealthily harvest sensitive information. This includes stealing webmail credentials, exfiltrating contacts and email messages, and in some cases bypassing two-factor authentication mechanisms, significantly increasing the risk of unauthorized access and data compromise. The operation's targeting of governmental and defense organizations in Eastern Europe, with additional victims in Africa, Europe, and South America, indicates a strategic focus on high-value intelligence collection. The exploitation method relies on injecting malicious scripts via XSS vulnerabilities, which do not require initial authentication but do require the victim to access the compromised webmail interface, making user interaction a factor. Despite the medium severity rating assigned, the presence of zero-day exploits and the ability to bypass two-factor authentication elevate the technical sophistication and potential impact of this threat. No known public exploits have been reported yet, but the active targeting and use of zero-days underscore the urgency for affected organizations to implement mitigations promptly.

Detailed information about Operation RoundPress targeting high-value webmail servers. Get real-time updates, technical details, and mitigation strategies.

Operation RoundPress targeting high-value webmail servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation RoundPress targeting high-value webmail servers

OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics

The security threat identified as CVE-2024-38402 pertains to the use of surveillance technology and digital repression tactics by Serbian authorities, specifically involving the Qualcomm Digital Signal Processor (DSP) driver. This vulnerability is categorized under OSINT (Open Source Intelligence) and relates to network activity and external analysis rather than a traditional software flaw with patchable code. The Qualcomm DSP driver is a critical component in many mobile devices, responsible for handling audio, sensor data, and other real-time processing tasks. While no specific affected versions or patch information are provided, the threat highlights how state actors may leverage proprietary hardware drivers and embedded system components to conduct surveillance and digital repression. The technical details indicate a low severity rating and no known exploits in the wild, suggesting limited immediate risk from a technical exploitation standpoint. However, the nature of the threat is more strategic and operational, focusing on the deployment of surveillance infrastructure and tactics rather than a direct vulnerability that can be exploited by external attackers. The involvement of Serbian authorities and the tagging of the threat with country-specific metadata imply a geopolitical dimension, where surveillance technology is used for monitoring and potentially repressing digital communications within Serbia. This OSINT report underscores the importance of understanding how hardware-level components like the Qualcomm DSP driver can be manipulated or utilized in state-sponsored surveillance campaigns, which may not be mitigated by traditional software patches or updates.

Detailed information about OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics affect

OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics - Live Threat Intelligence - Threat Radar | OffSeq.com

This report appears to be an OSINT (Open Source Intelligence) analysis focusing on the use of Qualcomm DSP (Digital Signal Processor) drivers by Serbian authorities to deploy surveillance technology and digital repression tactics. The Qualcomm DSP driver is a component that interfaces with the digital signal processor hardware in Qualcomm chipsets, often used in mobile devices for audio, sensor processing, and other low-level functions. The report does not describe a specific vulnerability or exploit in the Qualcomm DSP driver itself but rather highlights how this technology is leveraged by state actors for surveillance purposes. The technical details are minimal, with no direct evidence of a software vulnerability or exploit code. Instead, the focus is on the operational use of existing technology for monitoring and repression, which may involve custom firmware, driver modifications, or exploitation of device capabilities for intelligence gathering. The threat level is rated low, and there are no known exploits in the wild or patches available. The lack of affected versions or CWE identifiers further supports that this is not a traditional software vulnerability but an intelligence report on surveillance tactics. The report is tagged with Serbia as the country of interest and is classified with TLP white and clear, indicating it is intended for broad dissemination. Overall, this is an intelligence insight into state-level surveillance using Qualcomm DSP technology rather than a direct cybersecurity vulnerability or exploit affecting end users or organizations.

Detailed information about OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics. Get r

OSINT - File Spider Ransomware Targeting the Balkans With Malspam

File Spider ransomware is a malware threat identified as targeting the Balkan region through malicious spam (malspam) campaigns. The ransomware operates by distributing infected email attachments or links that, once executed by the victim, encrypt files on the compromised system, rendering them inaccessible until a ransom is paid. The campaign's focus on the Balkans suggests a geographically targeted attack vector, likely exploiting regional language or cultural elements to increase the likelihood of user interaction. Although the technical details are limited, the threat level is moderate (threatLevel 3) with some analysis performed (analysis 2), indicating that the malware has been observed but may not be widely studied or understood. The lack of known exploits in the wild and absence of affected software versions imply that this ransomware operates primarily through social engineering and user interaction rather than exploiting specific software vulnerabilities. The campaign's use of malspam suggests that phishing remains the primary infection vector, leveraging email as the attack surface. Given the ransomware classification, the primary impact involves encryption of user data, potentially leading to operational disruption and financial loss if victims opt to pay the ransom. The low severity rating in the source may reflect limited spread or impact at the time of reporting, but ransomware inherently carries significant risk due to its potential to disrupt business continuity.

Detailed information about OSINT - File Spider Ransomware Targeting the Balkans With Malspam. Get real-time updates, technical details, and mitigation strategie

Title	Severity	Type	Source	Date

Threats Affecting North Macedonia

Filter Threats

Threats Affecting North Macedonia

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility