Campaign threats

MoustachedBouncer is an espionage campaign targeting foreign diplomats in Belarus. The activity involves intelligence gathering against diplomatic personnel, as identified by open-source intelligence (OSINT) sources. There are no specific technical details, affected software versions, or known exploits associated with this campaign. The threat is assessed as high severity due to its espionage nature and targeted geopolitical focus.

Campaign#type:osint#osint:lifetime="perpetual"Belarus

OSINT of Exchange 0-day campaign (Atos)

Campaign#tlp:clear#admiralty-scale:source-reliability="b"Germany+9

The TA558 threat group has increased campaigns targeting the travel and hospitality industries with fake reservation emails containing malicious links or attachments. These campaigns deliver malware payloads such as remote access trojans (RATs) via ISO and RAR file attachments, which victims must decompress and execute. The group has evolved tactics from using Office document exploits to container files due to changes in Microsoft Office macro policies. TA558 is financially motivated, aiming to steal data and money from organizations and customers in the travel sector.

Phishing La Banque Postale - Lookyloo Capture (http://one.doesntexist.com/p/b2ba4)

Campaign#circl:incident-classification="phishing"#tlp:whiteFrance+3

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

Campaign#misp-galaxy:target-information="france"#osint:lifetime="perpetual"France+6

CERT-FR reports a campaign by the Sandworm intrusion set targeting Centreon systems primarily in Western Europe. The campaign exploits public-facing Linux applications to perform file discovery, deploy web shells, modify system processes, and exfiltrate data via command and control channels. Multiple threat actors including Iridium, Telebots, Sandworm, and Electrum are involved. The overall threat level is assessed as low by CERT-IST, with medium severity noted in the report. No patches are currently available for this threat.

Campaigncert-ist#fr-classif:non-classifiees="non-classifiees"#cossi:recherchesourceouverte="interdite"France+6

New Phishing Attacks Abuse Excel Internet Query Files

Campaign#veris:action:social:variety="phishing"#osint:source-type="blog-post"Germany+7