Threat database

The XCTDH Crypto Heist Part 2 is a medium-severity threat involving multiple MITRE ATT&CK techniques such as exploitation of external remote services, automated data exfiltration, user execution, and compromise of software dependencies. It appears linked to North Korean threat actors and involves persistence, payload delivery, and network activity. No specific affected products or versions are identified, and no patches or known exploits in the wild are reported. The attack likely leverages social engineering and supply chain compromise to infiltrate targets and exfiltrate sensitive data. European organizations could be impacted if targeted via compromised software dependencies or remote service vulnerabilities. Mitigation requires enhanced supply chain security, strict remote access controls, user awareness training, and network monitoring for unusual exfiltration patterns. Countries with significant financial sectors and software development industries, such as Germany, France, and the UK, are more likely to be affected. The threat is assessed as medium severity due to the complexity of exploitation, potential data loss, and moderate ease of execution requiring user interaction and supply chain compromise.

Unknowntype#misp-galaxy:mitre-attack-pattern="external remote services - t1133"#misp-galaxy:mitre-attack-pattern="automated exfiltration - t1020"Germany+4

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

EPSS 0.5%VulnerabilitySonatype#cwe-918Germany+5

ThreatFox IOCs for 2025-10-08

Indicatortype#type:osint#tlp:whiteGermany+5

ThreatFox IOCs for 2025-10-07

Indicatortype#type:osint#tlp:whiteGermany+5

ThreatFox IOCs for 2025-10-06

Indicatortype#type:osint#tlp:whiteGermany+4

ThreatFox IOCs for 2025-10-05

Indicatortype#type:osint#tlp:whiteGermany+5

ThreatFox IOCs for 2025-10-04

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-10-03

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-10-02

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-10-01

Indicatortype#type:osint#tlp:whiteGermany+4

ThreatFox IOCs for 2025-09-30

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-09-29

Indicatortype#type:osint#tlp:whiteGermany+5

ThreatFox IOCs for 2025-09-28

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-09-27

Indicatortype#type:osint#tlp:whiteGermany+4

ThreatFox IOCs for 2025-09-26

Indicatortype#type:osint#tlp:whiteGermany+4

Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.

EPSS 0.3%Vulnerabilitymonkeytypegame#cwe-79Germany+5

ThreatFox IOCs for 2025-09-25

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-09-24

Indicatortype#type:osint#tlp:whiteGermany+4

ThreatFox IOCs for 2025-09-23

Indicatortype#type:osint#tlp:whiteGermany+6

ThreatFox IOCs for 2025-09-22

Indicatortype#type:osint#tlp:whiteGermany+6