Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Chinese cyberespionage group APT41 conducted a targeted attack against government IT services in Africa. The attackers used various tools including Impacket, Cobalt Strike, and custom malware for lateral movement, privilege escalation, and data exfiltration. They leveraged DLL sideloading techniques and a compromised SharePoint server as a command and control center. The attack involved credential harvesting, use of web shells, and custom stealers to collect sensitive data. Notable TTPs included using hardcoded internal service names and proxy servers in malware, and exploiting a captive SharePoint server for C2 communication. The incident highlights the importance of comprehensive infrastructure monitoring and proper access controls.

The threat described involves a targeted cyberespionage campaign conducted by the Chinese threat actor group APT41 against government IT services in Africa. APT41 is known for its sophisticated and multi-faceted attack techniques combining espionage and financially motivated operations. In this campaign, the attackers employed a combination of open-source and custom tools, including Impacket for lateral movement, Cobalt Strike for command and control and post-exploitation activities, and custom malware designed for privilege escalation and data exfiltration. A notable technique used was DLL sideloading, which allows malicious DLLs to be loaded by legitimate applications, evading detection. The attackers also compromised a SharePoint server, which they used as a covert command and control (C2) infrastructure, leveraging it to communicate with deployed malware. Credential harvesting was a key component, utilizing tools such as Mimikatz and custom stealers to collect sensitive authentication data. Web shells were deployed to maintain persistent access and facilitate remote control. The attackers embedded hardcoded internal service names and proxy server configurations within their malware, indicating a high level of operational security and customization tailored to the target environment. This campaign underscores the attackers’ focus on government entities, aiming to exfiltrate sensitive data and maintain long-term access. The use of captive SharePoint servers for C2 communication and DLL sideloading techniques highlights the advanced nature of the attack and the importance of monitoring infrastructure components that are often trusted and overlooked. The incident emphasizes the need for comprehensive monitoring, strict access controls, and detection capabilities for lateral movement and credential theft within government IT environments.

Detailed information about SOC files: an APT41 attack on government IT services in Africa. Get real-time updates, technical details, and mitigation strategies.

SOC files: an APT41 attack on government IT services in Africa - Live Threat Intelligence - Threat Radar | OffSeq.com

SOC files: an APT41 attack on government IT services in Africa

Threats Tagged 'checkout'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'checkout'

Lead Pen Test Professional