Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Turla Outlook White Paper describes a threat associated with the Turla group, a well-known advanced persistent threat (APT) actor. This threat involves the exploitation of Microsoft Outlook through a technique known as Component Object Model (COM) hijacking (MITRE ATT&CK T1122). COM hijacking allows attackers to manipulate the way Outlook components are loaded and executed, enabling them to persist within the victim's environment and evade detection. The primary objective of this threat is email collection (MITRE ATT&CK T1114), which involves unauthorized access to and exfiltration of sensitive email communications. The attack targets sectors such as academic and research institutions and government entities, particularly within Western Europe. The threat is characterized by medium certainty and medium threat level, indicating that while the indicators of compromise (IOCs) and technical details are not fully confirmed, there is credible intelligence suggesting active targeting. No specific affected product versions or patches are identified, and no known exploits in the wild have been reported. The persistence mechanism through COM hijacking suggests a sophisticated approach to maintain long-term access and data collection capabilities. The lack of patch availability and the use of legitimate system components for hijacking complicate detection and mitigation efforts. Overall, this threat represents a targeted espionage campaign leveraging Outlook's architecture to harvest sensitive email data from high-value targets in Western Europe.

https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf

Detailed information about Turla Outlook White Paper. Get real-time updates, technical details, and mitigation strategies.

Turla Outlook White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Turla Outlook White Paper

Lokibot is a well-known malware family primarily classified as a password stealer and keylogger targeting Windows systems. The specific sample referenced here is associated with an "Equation Editor," which suggests it may be leveraging or masquerading as a component related to Microsoft Office's Equation Editor, a known attack vector in past campaigns. Lokibot typically operates by infiltrating a victim's system, often through phishing emails or malicious attachments, and then harvesting sensitive information such as credentials, cookies, and other stored data. The malware also logs keystrokes to capture passwords and other confidential inputs. Although this particular sample is tagged with a low threat level and no known exploits in the wild, Lokibot remains a persistent threat due to its capability to steal credentials and facilitate further compromise. The lack of affected versions and patch links indicates this sample may be a proof-of-concept or a variant without a newly discovered vulnerability but still represents a malware outbreak scenario. The technical details show a medium confidence in indicators of compromise and a low overall threat level, but the presence of keylogging and credential theft functionalities means that successful infections can lead to significant data breaches and lateral movement within networks.

Detailed information about Lokibot Equation Editor Sample. Get real-time updates, technical details, and mitigation strategies.

Lokibot Equation Editor Sample - Live Threat Intelligence - Threat Radar | OffSeq.com

Lokibot Equation Editor Sample

The Turla Outlook White Paper describes a campaign attributed to the Turla group, a well-known advanced persistent threat (APT) actor. This campaign leverages Component Object Model (COM) hijacking techniques (MITRE ATT&CK T1122) to compromise Microsoft Outlook and facilitate email collection (T1114). COM hijacking involves manipulating the Windows COM infrastructure to execute malicious code when a legitimate application, such as Outlook, invokes a COM object. By exploiting this mechanism, the threat actor can stealthily intercept and exfiltrate emails without triggering typical detection mechanisms. The campaign targets sectors including academic and research institutions as well as government entities, primarily within Western Europe. Although no specific affected software versions are listed, the focus on Outlook suggests exploitation of vulnerabilities or misconfigurations in Microsoft Outlook or its integration with Windows COM components. The campaign is classified as high severity by the source, with a medium threat level and medium IOC accuracy, indicating some uncertainty but credible risk. No known exploits in the wild have been reported, suggesting this may be a targeted or emerging threat rather than widespread malware. The campaign's persistence and stealth capabilities align with typical APT behaviors, emphasizing espionage objectives through email data collection. The use of COM hijacking is significant because it allows execution of malicious payloads with the privileges of the Outlook process, potentially bypassing security controls and evading detection. The campaign's targeting of Western European academic, research, and government sectors highlights a strategic focus on sensitive information and intellectual property.

Title	Severity	Type	Source	Date

Threats Tagged 'cert-ist:ioc_accuracy="medium"'

Filter Threats

Threats Tagged 'cert-ist:ioc_accuracy="medium"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility