Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Emotet is a well-known modular banking Trojan and malware loader that has been active since approximately 2014. It primarily targets financial institutions and their customers by stealing banking credentials and delivering additional malware payloads. The notification that "Emotet is back" indicates a resurgence or renewed activity of this malware campaign after a period of reduced or no observed activity. Emotet typically propagates via malicious email campaigns using phishing techniques, often leveraging social engineering to trick users into opening infected attachments or clicking on malicious links. Once executed, Emotet can download and install other malware, including ransomware and information stealers, making it a significant threat to organizations. Although the provided data marks the severity as "low" and certainty at 50%, the historical impact of Emotet campaigns has been substantial. The lack of known exploits in the wild and absence of specific affected versions suggests this is an intelligence update rather than a newly discovered vulnerability. The mention of "adversary:infrastructure-action=take-down" implies that law enforcement or cybersecurity entities may have previously disrupted Emotet's infrastructure, and this update signals its return. The threat level of 3 (on an unspecified scale) and the low severity rating likely reflect the early stage of this resurgence or limited current impact at the time of reporting.

Detailed information about OSINT - Emotet is back. Get real-time updates, technical details, and mitigation strategies.

OSINT - Emotet is back - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Emotet is back

IoT malware - Gafgyt.Gen28 (active) - 20190220 - 20190222

Gafgyt.Gen28 is a variant of the Gafgyt (also known as Bashlite or Lizkebab) malware family, which primarily targets Internet of Things (IoT) devices. This malware is known for infecting vulnerable IoT devices such as routers, IP cameras, and DVRs by exploiting weak or default credentials and unpatched vulnerabilities. Once infected, these devices become part of a botnet that can be leveraged for distributed denial-of-service (DDoS) attacks, credential brute forcing, and other malicious activities. The Gafgyt.Gen28 variant was active during the period from February 20 to February 22, 2019, as reported by CIRCL. While the severity is classified as low, the malware's persistence and ability to compromise a wide range of IoT devices pose ongoing risks. The malware does not have known exploits in the wild beyond its typical infection vectors, and it does not require user interaction for propagation, relying instead on automated scanning and brute forcing. The threat level and analysis scores indicate moderate confidence in the malware's activity and impact. Given the proliferation of IoT devices in various sectors, Gafgyt.Gen28 represents a continuing threat to network stability and security, especially when devices are left unsecured or unpatched.

Detailed information about IoT malware - Gafgyt.Gen28 (active) - 20190220 - 20190222. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'adversary:infrastructure-action="take-down"'

Filter Threats