Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Turla Outlook White Paper describes a threat associated with the Turla group, a well-known advanced persistent threat (APT) actor. This threat involves the exploitation of Microsoft Outlook through a technique known as Component Object Model (COM) hijacking (MITRE ATT&CK T1122). COM hijacking allows attackers to manipulate the way Outlook components are loaded and executed, enabling them to persist within the victim's environment and evade detection. The primary objective of this threat is email collection (MITRE ATT&CK T1114), which involves unauthorized access to and exfiltration of sensitive email communications. The attack targets sectors such as academic and research institutions and government entities, particularly within Western Europe. The threat is characterized by medium certainty and medium threat level, indicating that while the indicators of compromise (IOCs) and technical details are not fully confirmed, there is credible intelligence suggesting active targeting. No specific affected product versions or patches are identified, and no known exploits in the wild have been reported. The persistence mechanism through COM hijacking suggests a sophisticated approach to maintain long-term access and data collection capabilities. The lack of patch availability and the use of legitimate system components for hijacking complicate detection and mitigation efforts. Overall, this threat represents a targeted espionage campaign leveraging Outlook's architecture to harvest sensitive email data from high-value targets in Western Europe.

https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf

Detailed information about Turla Outlook White Paper. Get real-time updates, technical details, and mitigation strategies.

Turla Outlook White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Turla Outlook White Paper

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

The reported threat involves a campaign by the Sandworm intrusion set targeting Centreon systems, as identified by CERT-FR and CIRCL. Sandworm is a well-known advanced persistent threat (APT) group associated with sophisticated cyber espionage and sabotage activities. Centreon is an IT infrastructure monitoring software widely used in enterprise environments, including Linux-based systems. The campaign exploits public-facing applications (MITRE ATT&CK T1190), likely leveraging vulnerabilities or misconfigurations in Centreon's web interface to gain initial access. Post-compromise activities include deploying web shells (T1505.003) for persistent remote control, performing file and directory discovery (T1083) to map the environment, and creating or modifying system processes or Windows services (T1543, T1543.003) to maintain persistence and escalate privileges. The attackers use symmetric and asymmetric cryptography (T1573.001, T1573.002) and encrypted channels (T1573) to secure command and control communications, complicating detection and analysis. Data exfiltration is conducted over these encrypted C2 channels (T1041). The threat targets Linux systems predominantly in Western Europe, with high confidence in the indicators of compromise (IOCs) accuracy. Although the severity is classified as low by CERT-FR, the involvement of a high-profile APT group and the use of advanced techniques indicate a targeted espionage campaign rather than widespread destructive attacks. No known exploits in the wild or patches are currently documented, suggesting either a zero-day or exploitation of configuration weaknesses. The campaign aligns with historical Sandworm tactics, including stealthy infiltration and long-term presence in victim networks.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems affecting fr-classif non-classifiees. Get real-time updates, tec

Lokibot is a well-known malware family primarily classified as a password stealer and keylogger targeting Windows systems. The specific sample referenced here is associated with an "Equation Editor," which suggests it may be leveraging or masquerading as a component related to Microsoft Office's Equation Editor, a known attack vector in past campaigns. Lokibot typically operates by infiltrating a victim's system, often through phishing emails or malicious attachments, and then harvesting sensitive information such as credentials, cookies, and other stored data. The malware also logs keystrokes to capture passwords and other confidential inputs. Although this particular sample is tagged with a low threat level and no known exploits in the wild, Lokibot remains a persistent threat due to its capability to steal credentials and facilitate further compromise. The lack of affected versions and patch links indicates this sample may be a proof-of-concept or a variant without a newly discovered vulnerability but still represents a malware outbreak scenario. The technical details show a medium confidence in indicators of compromise and a low overall threat level, but the presence of keylogging and credential theft functionalities means that successful infections can lead to significant data breaches and lateral movement within networks.

Detailed information about Lokibot Equation Editor Sample. Get real-time updates, technical details, and mitigation strategies.

Lokibot Equation Editor Sample - Live Threat Intelligence - Threat Radar | OffSeq.com

Lokibot Equation Editor Sample

The Turla Outlook White Paper describes a campaign attributed to the Turla group, a well-known advanced persistent threat (APT) actor. This campaign leverages Component Object Model (COM) hijacking techniques (MITRE ATT&CK T1122) to compromise Microsoft Outlook and facilitate email collection (T1114). COM hijacking involves manipulating the Windows COM infrastructure to execute malicious code when a legitimate application, such as Outlook, invokes a COM object. By exploiting this mechanism, the threat actor can stealthily intercept and exfiltrate emails without triggering typical detection mechanisms. The campaign targets sectors including academic and research institutions as well as government entities, primarily within Western Europe. Although no specific affected software versions are listed, the focus on Outlook suggests exploitation of vulnerabilities or misconfigurations in Microsoft Outlook or its integration with Windows COM components. The campaign is classified as high severity by the source, with a medium threat level and medium IOC accuracy, indicating some uncertainty but credible risk. No known exploits in the wild have been reported, suggesting this may be a targeted or emerging threat rather than widespread malware. The campaign's persistence and stealth capabilities align with typical APT behaviors, emphasizing espionage objectives through email data collection. The use of COM hijacking is significant because it allows execution of malicious payloads with the privileges of the Outlook process, potentially bypassing security controls and evading detection. The campaign's targeting of Western European academic, research, and government sectors highlights a strategic focus on sensitive information and intellectual property.

Talos Blog: Multiple Cobalt Personality Disorder

The threat described as "Multiple Cobalt Personality Disorder" relates to the use of the Cobalt Strike framework by threat actors, particularly the Cobalt group, to conduct advanced persistent threat (APT) operations targeting Windows systems. Cobalt Strike is a legitimate penetration testing tool that has been widely abused by malicious actors for post-exploitation activities such as lateral movement, privilege escalation, and command and control (C2) communications. This threat involves multiple attack patterns including spearphishing with malicious attachments (T1193), use of scripting languages like PowerShell (T1086), and exploitation of Windows utilities such as CMSTP (T1191) and Regsvr32 (T1117) to execute malicious code without dropping files on disk, thereby evading detection. The mention of ThreadKit exploit kit suggests the use of exploit delivery frameworks to compromise targets. The threat is primarily focused on the finance sector, targeting Windows environments, and is characterized by a medium severity level with a low overall threat level from CERT-IST, indicating limited immediate risk but notable potential for damage if exploited. The lack of known exploits in the wild suggests this is more an observed tactic or vulnerability pattern rather than an actively exploited zero-day. The attack techniques emphasize stealth and persistence, leveraging scripting and living-off-the-land binaries (LOLBins) to maintain access and evade traditional security controls. The analysis highlights the complexity of the threat actor's toolkit and the need for advanced detection capabilities to identify such multi-faceted attacks.

Detailed information about Talos Blog: Multiple Cobalt Personality Disorder affecting tlp white. Get real-time updates, technical details, and mitigation strate

Title	Severity	Type	Source	Date

Threats Tagged 'cert-ist:enriched'

Filter Threats

Threats Tagged 'cert-ist:enriched'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility