Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Operation Cobalt Whisper is a low-severity cyber espionage campaign targeting multiple industries primarily in Hong Kong and Pakistan. The threat actor employs spearphishing attachments (MITRE ATT&CK T1566.001) as the initial infection vector, delivering malicious files (T1204.002) that leverage Visual Basic scripting (T1059.005) to execute payloads. The campaign includes persistence mechanisms such as scheduled tasks (T1053.005) and employs portable executable injection (T1055.002) to evade detection and maintain foothold. Post-compromise activities include system owner/user discovery (T1033) to gather intelligence about the environment and use of web protocols (T1071.001) for command and control communications. The targeted sectors span academia, civil aviation, defense, electric, energy, engineering, environment, IT security, pharmacy, and security actors, indicating a broad multi-sector espionage focus. Although no known exploits in the wild have been reported and the campaign is assessed with a low severity, the use of sophisticated attack patterns and targeting of critical infrastructure and sensitive sectors suggest a persistent threat actor with strategic intent. The campaign's geographical focus on Hong Kong and Pakistan reflects geopolitical interests and regional strategic importance. The technical details indicate a moderate threat level (3 on an unspecified scale) with limited analysis available, and the certainty of the intelligence is moderate (50%).

Detailed information about Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.. Get real-time updates, technical d

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan. - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Unraveling SloppyLemming’s Operations Across South Asia

The provided information pertains to an OSINT (Open Source Intelligence) report focusing on the threat actor known as SloppyLemming and its operations primarily across South Asia, including Sri Lanka, Pakistan, Bangladesh, and China. SloppyLemming is identified as a threat actor with activities targeting multiple sectors such as police and law enforcement, energy, telecommunications, and technology. The report is sourced from CIRCL and categorized under the MISP galaxy for threat actors. Although no specific vulnerabilities or exploits are detailed, the intelligence highlights the ongoing presence and potential targeting strategies of SloppyLemming in these regions and sectors. The threat level is indicated as low, with no known exploits in the wild, and the threat actor's operations appear to be persistent and perpetual in nature. The technical details suggest a moderate threat level (threatLevel: 3) but limited analysis depth (analysis: 2), indicating that while the actor is recognized, detailed tactics, techniques, and procedures (TTPs) or attack vectors are not extensively documented in this report. The absence of indicators of compromise (IOCs) or specific affected versions implies this is primarily an intelligence briefing rather than a direct vulnerability or exploit notification.

Detailed information about OSINT - Unraveling SloppyLemming’s Operations Across South Asia. Get real-time updates, technical details, and mitigation strategies.

OSINT - Unraveling SloppyLemming’s Operations Across South Asia - Live Threat Intelligence - Threat Radar | OffSeq.com

The Lazarus Pakistan Toolkits refer to a set of malware tools attributed to the Lazarus Group, a well-known North Korean state-sponsored threat actor. These toolkits, identified around January 2019, include components such as PowerRatankba, a PowerShell-based malware installer, and keyloggers. PowerRatankba is a sophisticated malware family that leverages PowerShell scripts to execute payloads stealthily, often bypassing traditional detection mechanisms. The toolkits are believed to be used for espionage and cyber intrusion campaigns, with a focus on persistent access and data exfiltration. The mention of Pakistan in the context likely indicates targeting or operational infrastructure related to that region, though Lazarus is primarily linked to DPRK. The malware’s capabilities include keylogging to capture sensitive credentials and information, and the use of PowerShell installers suggests a reliance on living-off-the-land techniques, making detection and mitigation more challenging. The threat intelligence certainty is moderate (50%), and no known exploits in the wild have been reported, indicating that while the toolkits exist and are attributed to Lazarus, their active deployment or impact is not fully confirmed. The threat level is rated medium, reflecting the potential for espionage and data compromise but without evidence of widespread exploitation or destructive payloads.

Detailed information about 2019-01-25: Lazarus Pakistan Toolkits. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Pakistan

Filter Threats

Threats Affecting Pakistan

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility