Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar allows Stored XSS. This issue affects Bg Orthodox Calendar: from n/a through 0.13.10.

CVE-2025-28958 is a high-severity vulnerability classified as CWE-352, indicating a Cross-Site Request Forgery (CSRF) issue in the Bg Orthodox Calendar software developed by Vadim Bogaiskov. The vulnerability affects versions up to 0.13.10. CSRF vulnerabilities allow an attacker to trick an authenticated user into submitting a forged request to a web application, potentially causing unintended actions. In this case, the CSRF vulnerability enables a Stored Cross-Site Scripting (XSS) attack, which means that malicious scripts can be permanently stored on the vulnerable application and executed in the context of users’ browsers when they access affected pages. The CVSS 3.1 base score of 7.1 reflects a high severity, with the vector indicating network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), scope changed (S:C), and impacts on confidentiality, integrity, and availability rated as low to low and low respectively (C:L/I:L/A:L). The scope change (S:C) suggests that the vulnerability affects components beyond the initially vulnerable component, increasing its impact. The vulnerability was published on June 6, 2025, with no known exploits in the wild yet and no available patches at the time of reporting. The Bg Orthodox Calendar is a specialized calendar application, likely used by communities or organizations that follow the Orthodox Christian calendar, which may include religious institutions or cultural organizations. The combination of CSRF and stored XSS can allow attackers to perform unauthorized actions on behalf of users and inject persistent malicious scripts, potentially leading to session hijacking, data theft, or further compromise of user accounts and systems.

Detailed information about CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar affecting Vadim Bogaiskov Bg Orthod

CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar

The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2025-3870 is a vulnerability identified in the '1 Decembrie 1918' WordPress plugin developed by olarmarius. This plugin is affected in all versions up to and including version 1.dec.2012. The vulnerability is classified as Cross-Site Scripting (XSS) under CWE-79, specifically caused by improper neutralization of input during web page generation. The root cause is the absence or incorrect implementation of nonce validation on the plugin's main PHP page (1-decembrie-1918/1-decembrie-1918.php). Nonces are security tokens used in WordPress to verify that requests originate from legitimate sources and prevent Cross-Site Request Forgery (CSRF). Due to missing or faulty nonce checks, an unauthenticated attacker can craft a malicious request that, if an authenticated site administrator is tricked into clicking (e.g., via a phishing link), allows the attacker to update plugin settings and inject malicious scripts into the website. This injection can lead to the execution of arbitrary JavaScript in the context of the administrator's browser session, potentially compromising session tokens, redirecting users, or performing unauthorized actions. Although no known exploits are currently in the wild, the vulnerability's nature means it can be exploited remotely without authentication, relying on social engineering to induce administrator interaction. The plugin's widespread use in WordPress sites that focus on Romanian historical content or related themes increases the attack surface. The vulnerability was reserved and published in April 2025, with enrichment from CISA, but no official patch or CVSS score has been provided yet.

Detailed information about CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 

CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 1918 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 1918

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Interlock ransomware evolving under the radar - Live Threat Intelligence - Threat Radar | OffSeq.com

Interlock ransomware evolving under the radar

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

Operation RoundPress is a sophisticated espionage campaign attributed to the Russia-aligned threat actor group Sednit, targeting high-value webmail servers primarily used by governmental and defense sector entities. The operation exploits cross-site scripting (XSS) vulnerabilities in popular webmail platforms, including Roundcube, Horde, MDaemon, and Zimbra. Initially observed in 2023 focusing on Roundcube, the campaign expanded in 2024 to target additional webmail software, leveraging multiple vulnerabilities, notably including a zero-day in MDaemon (CVE-2023-23397) and other CVEs such as CVE-2023-43770 and CVE-2024-11182. The attackers inject malicious JavaScript code into the webmail interface, enabling the SpyPress malware to stealthily harvest sensitive information. This includes stealing webmail credentials, exfiltrating contacts and email messages, and in some cases bypassing two-factor authentication mechanisms, significantly increasing the risk of unauthorized access and data compromise. The operation's targeting of governmental and defense organizations in Eastern Europe, with additional victims in Africa, Europe, and South America, indicates a strategic focus on high-value intelligence collection. The exploitation method relies on injecting malicious scripts via XSS vulnerabilities, which do not require initial authentication but do require the victim to access the compromised webmail interface, making user interaction a factor. Despite the medium severity rating assigned, the presence of zero-day exploits and the ability to bypass two-factor authentication elevate the technical sophistication and potential impact of this threat. No known public exploits have been reported yet, but the active targeting and use of zero-days underscore the urgency for affected organizations to implement mitigations promptly.

Detailed information about Operation RoundPress targeting high-value webmail servers. Get real-time updates, technical details, and mitigation strategies.

Operation RoundPress targeting high-value webmail servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation RoundPress targeting high-value webmail servers

OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics

The security threat identified as CVE-2024-38402 pertains to the use of surveillance technology and digital repression tactics by Serbian authorities, specifically involving the Qualcomm Digital Signal Processor (DSP) driver. This vulnerability is categorized under OSINT (Open Source Intelligence) and relates to network activity and external analysis rather than a traditional software flaw with patchable code. The Qualcomm DSP driver is a critical component in many mobile devices, responsible for handling audio, sensor data, and other real-time processing tasks. While no specific affected versions or patch information are provided, the threat highlights how state actors may leverage proprietary hardware drivers and embedded system components to conduct surveillance and digital repression. The technical details indicate a low severity rating and no known exploits in the wild, suggesting limited immediate risk from a technical exploitation standpoint. However, the nature of the threat is more strategic and operational, focusing on the deployment of surveillance infrastructure and tactics rather than a direct vulnerability that can be exploited by external attackers. The involvement of Serbian authorities and the tagging of the threat with country-specific metadata imply a geopolitical dimension, where surveillance technology is used for monitoring and potentially repressing digital communications within Serbia. This OSINT report underscores the importance of understanding how hardware-level components like the Qualcomm DSP driver can be manipulated or utilized in state-sponsored surveillance campaigns, which may not be mitigated by traditional software patches or updates.

Detailed information about OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics affect

OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided threat information pertains to a set of Indicators of Compromise (IOCs) published on October 26, 2022, by ThreatFox, a platform specializing in sharing threat intelligence data. The threat is categorized as malware-related, specifically linked to OSINT (Open Source Intelligence) data, which suggests that the information primarily consists of observable artifacts such as IP addresses, domains, hashes, or other indicators associated with malicious activity. However, no specific affected software versions, vulnerabilities, or exploit details are provided. The threat level is rated as 2 on an unspecified scale, with a medium severity classification. There are no known exploits in the wild, and no patches or mitigation links are referenced. The absence of detailed technical indicators or CWE (Common Weakness Enumeration) identifiers limits the ability to pinpoint the exact nature or mechanism of the malware. The distribution score of 3 implies a moderate spread or prevalence of these IOCs, while the analysis score of 1 suggests limited in-depth examination or contextual information. Overall, this threat appears to be a collection of malware-related IOCs intended for use in detection and prevention efforts rather than a direct vulnerability or exploit targeting specific software products.

QakBot payload delivery URL (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2022-10-26. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2022-10-26 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2022-10-26

This report appears to be an OSINT (Open Source Intelligence) analysis focusing on the use of Qualcomm DSP (Digital Signal Processor) drivers by Serbian authorities to deploy surveillance technology and digital repression tactics. The Qualcomm DSP driver is a component that interfaces with the digital signal processor hardware in Qualcomm chipsets, often used in mobile devices for audio, sensor processing, and other low-level functions. The report does not describe a specific vulnerability or exploit in the Qualcomm DSP driver itself but rather highlights how this technology is leveraged by state actors for surveillance purposes. The technical details are minimal, with no direct evidence of a software vulnerability or exploit code. Instead, the focus is on the operational use of existing technology for monitoring and repression, which may involve custom firmware, driver modifications, or exploitation of device capabilities for intelligence gathering. The threat level is rated low, and there are no known exploits in the wild or patches available. The lack of affected versions or CWE identifiers further supports that this is not a traditional software vulnerability but an intelligence report on surveillance tactics. The report is tagged with Serbia as the country of interest and is classified with TLP white and clear, indicating it is intended for broad dissemination. Overall, this is an intelligence insight into state-level surveillance using Qualcomm DSP technology rather than a direct cybersecurity vulnerability or exploit affecting end users or organizations.

Detailed information about OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics. Get r

OSINT - File Spider Ransomware Targeting the Balkans With Malspam

File Spider ransomware is a malware threat identified as targeting the Balkan region through malicious spam (malspam) campaigns. The ransomware operates by distributing infected email attachments or links that, once executed by the victim, encrypt files on the compromised system, rendering them inaccessible until a ransom is paid. The campaign's focus on the Balkans suggests a geographically targeted attack vector, likely exploiting regional language or cultural elements to increase the likelihood of user interaction. Although the technical details are limited, the threat level is moderate (threatLevel 3) with some analysis performed (analysis 2), indicating that the malware has been observed but may not be widely studied or understood. The lack of known exploits in the wild and absence of affected software versions imply that this ransomware operates primarily through social engineering and user interaction rather than exploiting specific software vulnerabilities. The campaign's use of malspam suggests that phishing remains the primary infection vector, leveraging email as the attack surface. Given the ransomware classification, the primary impact involves encryption of user data, potentially leading to operational disruption and financial loss if victims opt to pay the ransom. The low severity rating in the source may reflect limited spread or impact at the time of reporting, but ransomware inherently carries significant risk due to its potential to disrupt business continuity.

Detailed information about OSINT - File Spider Ransomware Targeting the Balkans With Malspam. Get real-time updates, technical details, and mitigation strategie

Title	Severity	Type	Source	Date

Threats Affecting Serbia

Filter Threats

Threats Affecting Serbia

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility