Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Compromised host delivering malware (Mirai)

The threat involves a compromised host that is delivering malware associated with the Mirai botnet. Mirai is a well-known malware family that primarily targets Internet of Things (IoT) devices by exploiting weak or default credentials to gain control over these devices. Once infected, these devices become part of a botnet that can be used to launch distributed denial-of-service (DDoS) attacks, propagate additional malware, or conduct other malicious activities. The compromised host in this context is acting as a delivery mechanism for Mirai malware, potentially distributing it to vulnerable devices or networks. Although no specific affected versions or products are listed, the reference to "infrastructure-status" suggests that the compromised host may be part of network infrastructure or monitoring systems. The threat is tagged with a high severity level and is categorized as an adversary-controlled infrastructure delivering Mirai malware. There are no known exploits in the wild specifically tied to this compromised host, but Mirai itself has a history of widespread exploitation. The technical details indicate a low threat level rating (1) and no detailed analysis provided, with a moderate certainty (50%) of the intelligence. The perpetual lifetime tag implies this is an ongoing threat. Overall, this threat represents a persistent risk of Mirai malware distribution via compromised infrastructure hosts, which can facilitate large-scale botnet activity and associated cyberattacks.

Detailed information about Compromised host delivering malware (Mirai). Get real-time updates, technical details, and mitigation strategies.

Compromised host delivering malware (Mirai) - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - 97 domains phishing spread over 10 IP's

This threat involves a phishing campaign identified through Open Source Intelligence (OSINT) methods, consisting of 97 distinct phishing domains distributed across 10 different IP addresses. Phishing is a social engineering attack technique where attackers create fraudulent websites or domains that mimic legitimate services to deceive users into divulging sensitive information such as login credentials, financial data, or personal details. The distribution of these domains over multiple IP addresses suggests an attempt to evade detection and takedown efforts by spreading the infrastructure. The source of this intelligence is CIRCL, a reputable Computer Incident Response Center, indicating credible observation of this phishing infrastructure. The campaign's low severity rating and the absence of known exploits in the wild suggest that while the phishing infrastructure is active, it may not be currently widespread or highly effective. The threat level of 3 (on an unspecified scale) and an analysis score of 1 imply limited immediate impact or sophistication. The adversary infrastructure is marked as compromised, which could mean that the IPs or domains used are hijacked or abused resources rather than attacker-owned assets. No specific affected products or software versions are identified, as this is a phishing infrastructure rather than a software vulnerability. The lack of CVEs or CWEs further supports this. The campaign's TLP (Traffic Light Protocol) is white, indicating the information is publicly shareable without restriction.

Detailed information about OSINT - 97 domains phishing spread over 10 IP's. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'adversary:infrastructure-status="compromised"'

Filter Threats