Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This threat concerns an ongoing campaign exploiting zero-day vulnerabilities in Microsoft Exchange servers, as identified through OSINT (Open Source Intelligence) by Atos and reported via the CIRCL OSINT Feed. The campaign targets Microsoft Exchange, a widely used email and calendaring server product, leveraging unknown (zero-day) vulnerabilities that have not yet been patched. The campaign is characterized by spear phishing tactics aimed at delivering malicious payloads, with a focus on government and administration sectors, as well as media organizations. The campaign spans multiple regions, notably Asia and Europe, indicating a broad geographic targeting scope. The lack of available patches and absence of known exploits in the wild at the time of reporting suggest that the threat actors may be in the reconnaissance or early exploitation phase, or that the campaign is newly discovered. The campaign's reliance on spear phishing for payload delivery implies a high degree of targeting and sophistication, aiming to compromise high-value targets through social engineering combined with technical exploitation of Exchange vulnerabilities. The information credibility is rated moderately (admiralty-scale 3), indicating a reasonable level of confidence in the reported details. The campaign's targeting of government and media sectors underscores the potential for espionage, data exfiltration, and disruption of critical communications infrastructure. The absence of specific affected versions or detailed technical indicators limits precise identification of vulnerable systems but does not diminish the urgency given the high severity rating and the critical role of Exchange servers in organizational communications.

Used as part of targeted attacks against government sectors

Detailed information about OSINT of Exchange 0-day campaign (Atos). Get real-time updates, technical details, and mitigation strategies.

OSINT of Exchange 0-day campaign (Atos) - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT of Exchange 0-day campaign (Atos)

This threat concerns an OSINT (Open Source Intelligence) report on a zero-day vulnerability campaign targeting Microsoft Exchange servers, as identified by Atos and reported by CIRCL. The vulnerability is classified as a zero-day, indicating that it was unknown to the vendor and unpatched at the time of disclosure (October 2022). The campaign appears to focus on delivering payloads via network activity, with spear phishing as a likely initial vector for payload delivery, targeting sectors such as government, administration, financial institutions, and media organizations. The attack leverages Microsoft Exchange vulnerabilities, which are critical due to Exchange's role in email communication and calendaring within organizations. The absence of a patch and known exploits in the wild at the time of reporting suggests that the vulnerability was either newly discovered or under active investigation. The threat level is rated high, with a reliability rating of 'b' and information credibility level 3 on the Admiralty scale, indicating moderate confidence in the source and analysis. The campaign is geographically relevant to both Asia and Europe, with a particular focus on government and financial sectors, which are strategic targets for espionage and financial fraud. The technical details are limited, but the campaign involves network activity and payload delivery, implying exploitation attempts that could lead to unauthorized access, data exfiltration, or disruption of services. Given the nature of Microsoft Exchange vulnerabilities historically, potential impacts include compromise of email confidentiality and integrity, lateral movement within networks, and disruption of critical communication infrastructure.

Detailed information about OSINT of Exchange 0-day campaign (Atos) affecting tlp clear. Get real-time updates, technical details, and mitigation strategies.

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif

BatLoader is a malware loader that has been observed abusing Google Search Ads as a distribution vector to deliver two prominent information-stealing malware families: Vidar Stealer and Ursnif. BatLoader operates by leveraging malicious advertisements appearing in Google Search results, which entice users to click and subsequently download the malware payloads. Vidar Stealer is known for harvesting sensitive information such as credentials, browser data, cryptocurrency wallets, and system information. Ursnif, also known as Gozi, is a banking Trojan that primarily targets financial information and can also facilitate further malware deployment or lateral movement within compromised networks. The use of Google Search Ads as a delivery mechanism is notable because it exploits a trusted platform, increasing the likelihood of user interaction and successful infection. The malware employs scripting techniques, including PowerShell and Python, to execute commands and maintain persistence. The threat leverages network traffic capture or redirection techniques to intercept sensitive data. Although no specific affected product versions are listed, the threat targets end-user systems that interact with Google Search and download malicious payloads. There are no known exploits in the wild beyond this delivery method, but the campaign's reliance on social engineering and trusted advertising platforms makes it a persistent medium-risk threat. The technical details indicate a moderate threat level, with the malware categorized as a loader that facilitates the installation of stealer and banking Trojan malware.

Detailed information about BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif. Get real-time updates, technical details, and mit

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif - Live Threat Intelligence - Threat Radar | OffSeq.com

Finding Nemo(hosts) from Sofacy by ThreatConnect

The threat campaign titled "Finding Nemo(hosts) from Sofacy by ThreatConnect" is attributed to the Sofacy group, also known as APT28, a well-known advanced persistent threat actor with a history of cyber espionage activities primarily targeting government, military, and strategic sectors. This campaign was reported by CIRCL and documented in 2017, with a high severity rating assigned by the source. Sofacy is recognized for sophisticated, targeted intrusions often involving spear-phishing, zero-day exploits, and custom malware to gain persistent access to sensitive networks. Although specific technical details and affected versions are not provided, the campaign's designation as a high-severity APT operation implies significant risk to information confidentiality and integrity. The campaign appears to focus on identifying and exploiting hosts (Finding Nemo(hosts)) to establish footholds within targeted environments, likely leveraging advanced reconnaissance and tailored attack vectors. The lack of known exploits in the wild suggests this may be a targeted or emerging campaign rather than a widespread exploit. The threat level and analysis scores indicate a credible and concerning threat, though some uncertainty remains due to limited public technical details. Sofacy's historical modus operandi includes targeting NATO countries, defense contractors, and governmental institutions, often aiming to exfiltrate sensitive intelligence or disrupt operations. The campaign's association with information credibility and the admiralty-scale tags suggest a focus on validating or undermining data sources, possibly through misinformation or manipulation of network hosts to facilitate espionage or influence operations.

Detailed information about Finding Nemo(hosts) from Sofacy by ThreatConnect. Get real-time updates, technical details, and mitigation strategies.

Finding Nemo(hosts) from Sofacy by ThreatConnect - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information pertains to an OSINT (Open Source Intelligence) investigation titled "Who Ran Leakedsource.com?". LeakedSource.com was a website known for aggregating and providing access to large databases of leaked credentials and personal information. The data here does not describe a direct vulnerability or exploit but rather an information leak incident and an analysis of the operators behind the site. The threat is classified as an information leak with a low severity rating and no known exploits in the wild. The source reliability and information credibility are moderate to low, indicating some uncertainty about the details. The technical details mention a threat level of 3 and an analysis rating of 2, which suggests a low to moderate concern primarily related to the exposure of sensitive data rather than an active attack vector or software vulnerability. Since no affected versions or specific technical vulnerabilities are listed, this is not a direct software security threat but rather a case of data exposure and potential privacy compromise due to the operation of LeakedSource.com. The incident classification as "information-leak" aligns with concerns about the unauthorized dissemination of personal data rather than exploitation of a system flaw.

Detailed information about OSINT - Who Ran Leakedsource.com?. Get real-time updates, technical details, and mitigation strategies.

OSINT - Who Ran Leakedsource.com? - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Who Ran Leakedsource.com?

The provided information pertains to an OSINT (Open Source Intelligence) entry titled "shadow-brokers-windows," linked to the Shadow Brokers threat actor group. The Shadow Brokers are known for leaking hacking tools and exploits allegedly developed by the Equation Group, a sophisticated cyber espionage group believed to be associated with a nation-state. This entry is categorized as a threat actor intelligence report rather than a specific vulnerability or exploit. It references source code repositories related to Windows-targeting tools leaked by Shadow Brokers. However, no specific affected product versions, exploits in the wild, or technical vulnerability details are provided. The threat level is indicated as low, with no known active exploitation or direct impact described. The information credibility is moderate (admiralty-scale 3), and the threat actor is linked to Equation Group activities. Overall, this entry serves as a contextual intelligence piece about the existence of leaked Windows-related offensive cyber tools rather than a direct actionable security vulnerability or incident.

Detailed information about OSINT - shadow-brokers-windows. Get real-time updates, technical details, and mitigation strategies.

OSINT - shadow-brokers-windows - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - shadow-brokers-windows

The provided information references a security-related entry titled "Expansion on 596552@qq.com" sourced from CIRCL with a medium severity rating. However, the details are minimal and ambiguous, lacking explicit technical descriptions, affected products or versions, or concrete vulnerability or threat vectors. The title and tags suggest the entry relates to an expansion or additional information about the registrant email address "596552@qq.com" possibly linked to domain registration data (as indicated by the tag "expansion:whois-registrant-email"). This could imply that the threat intelligence involves identifying or tracking malicious infrastructure or threat actor attribution through domain registration details. The absence of known exploits, patches, or CWE identifiers further indicates that this is likely an intelligence enrichment or contextual data point rather than a direct technical vulnerability or exploit. The threat level and analysis scores of 2 (on an unspecified scale) and the medium severity rating suggest moderate concern but no immediate or critical technical risk. Overall, this entry appears to be a piece of threat intelligence focused on attribution or infrastructure expansion rather than a direct exploitable vulnerability or malware campaign.

Detailed information about Expansion on 596552@qq.com. Get real-time updates, technical details, and mitigation strategies.

Expansion on 596552@qq.com - Live Threat Intelligence - Threat Radar | OffSeq.com

Expansion on 596552@qq.com

Pivot around IP 193.109.68.87 (from ns1.carbon2u.com) - potential Sofacy

The provided information describes a potential threat involving the IP address 193.109.68.87, associated with the domain ns1.carbon2u.com, which is suspected to be linked to the Sofacy threat actor. Sofacy, also known as APT28 or Fancy Bear, is a well-known advanced persistent threat group attributed to Russian state-sponsored cyber espionage activities. The mention of "pivot around IP" suggests that this IP address may be used as a pivot point or infrastructure node in a larger attack or reconnaissance campaign. However, the data lacks specific technical details such as attack vectors, exploited vulnerabilities, malware signatures, or targeted systems. The threat type is marked as "unknown," and no affected products or versions are listed. The severity is rated low, and no known exploits in the wild have been reported. The source is CIRCL (Computer Incident Response Center Luxembourg), and the threat level and analysis scores are relatively low (4 and 2 respectively), indicating limited confidence or impact. Overall, this appears to be an intelligence indicator or early warning about potential Sofacy activity involving this IP address rather than a confirmed active exploit or vulnerability. The lack of concrete technical details limits the ability to fully characterize the threat or its mechanisms.

Detailed information about Pivot around IP 193.109.68.87 (from ns1.carbon2u.com) - potential Sofacy. Get real-time updates, technical details, and mitigation st

Pivot around IP 193.109.68.87 (from ns1.carbon2u.com) - potential Sofacy - Live Threat Intelligence - Threat Radar | OffSeq.com

Pivot on other email addresses found by using the same physical address as support-apple-id.com - potential sofacy

The provided threat intelligence concerns a potential pivoting technique linked to the threat actor group Sofacy (also known as APT28 or Fancy Bear). The core of the threat involves identifying multiple email addresses associated with the same physical address as the domain support-apple-id.com. This suggests that the adversary may be leveraging infrastructure overlaps or impersonation tactics to expand their attack surface or reconnaissance capabilities. Sofacy is a well-known advanced persistent threat group with a history of targeting government, military, and critical infrastructure entities primarily in Europe and North America. The tactic of pivoting on email addresses sharing a physical address implies a reconnaissance or lateral movement phase, where attackers use discovered information to identify additional targets or footholds within an organization or sector. Although no specific affected products or versions are listed, the mention of support-apple-id.com hints at potential phishing or credential harvesting campaigns masquerading as Apple support services, a common social engineering vector. The lack of known exploits in the wild and absence of detailed technical indicators limits the ability to pinpoint exact attack vectors, but the high severity rating and association with Sofacy indicate a credible and potentially impactful threat. The threat level and analysis scores (1 and 2 respectively) suggest early-stage intelligence with moderate confidence. Overall, this threat represents a strategic reconnaissance and potential lateral movement technique employed by a sophisticated threat actor to expand access or compromise additional targets by exploiting trust relationships or identity overlaps in email infrastructure.

Detailed information about Pivot on other email addresses found by using the same physical address as support-apple-id.com - potential sofacy. Get real-time upd

Pivot on other email addresses found by using the same physical address as support-apple-id.com - potential sofacy - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT -  Clickjacking Campaign Plays on European Cookie Law

The reported security threat involves a clickjacking campaign that exploits the European Cookie Law as a social engineering vector. Clickjacking is a technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially leading to unauthorized actions such as enabling webcam/microphone access, changing security settings, or unknowingly consenting to cookie policies. In this campaign, attackers leverage the heightened awareness and regulatory requirements around cookie consent in Europe to craft deceptive interfaces that prompt users to interact with malicious elements disguised as legitimate cookie consent dialogs. Although the campaign is categorized as low severity and no specific affected software versions or exploits in the wild are documented, the threat relies on user interaction and social engineering rather than technical vulnerabilities. The campaign's technical details indicate a moderate threat level (3) and analysis confidence (2), suggesting some reliability but limited technical depth or exploitation complexity. The absence of known exploits and patches implies this is primarily an awareness and user behavior risk rather than a direct software vulnerability.

Detailed information about OSINT -  Clickjacking Campaign Plays on European Cookie Law. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'admiralty-scale:information-credibility="3"'

Filter Threats

Threats Tagged 'admiralty-scale:information-credibility="3"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility