Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The provided information pertains to an OSINT report analyzing a breach and attack campaign targeting Uber, focusing on various MITRE ATT&CK techniques observed during the incident. The campaign involves multiple tactics and techniques typically used in credential theft and lateral movement within compromised environments. Key attack patterns include spearphishing via service (T1566.003, T1194), which indicates attackers used targeted phishing campaigns through trusted services to gain initial access. The use of valid accounts (T1078) and domain accounts (T1078.002, T1087.002, T1136.002) suggests attackers leveraged compromised credentials to move laterally and maintain persistence. Techniques such as credentials in files (T1552.001, T1081) and network share discovery (T1135) further indicate attempts to harvest credentials and explore network resources. External remote services (T1133) were likely exploited to facilitate remote access. The attackers also attempted to bypass multi-factor authentication by generating MFA requests (T1621), a sophisticated method to circumvent additional security layers. Data exfiltration was conducted over alternative protocols (T1048), implying the use of non-standard channels to evade detection. The campaign is classified as a system compromise with a low severity rating by the source, though the complexity of techniques used indicates a well-orchestrated attack. No known exploits in the wild or patches are associated, and the certainty of the OSINT is moderate (50%). The threat level is rated 4 on an unspecified scale, suggesting a notable but not critical threat. Overall, the attack demonstrates a combination of social engineering, credential theft, lateral movement, and data exfiltration techniques consistent with advanced persistent threat (APT) behavior targeting a high-profile organization.

Detailed information about OSINT - Uber Breach & Attack Analysis. Get real-time updates, technical details, and mitigation strategies.

OSINT - Uber Breach & Attack Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Uber Breach & Attack Analysis

Incident - pear.php.net - compromised and delivering malicious package

The reported incident concerns the compromise of the pear.php.net domain, a well-known repository for PHP Extension and Application Repository (PEAR) packages. The compromise resulted in the delivery of a malicious package to users relying on this repository. PEAR is widely used in PHP development for managing reusable code libraries, and any compromise in its package distribution system can lead to the inadvertent installation of malicious code within dependent applications. The incident was confirmed by CIRCL and classified as a system compromise involving unauthorized access and unauthorized modification of the repository contents. Although the exact nature of the malicious payload is not detailed, the delivery of a tampered package implies potential risks such as remote code execution, data exfiltration, or further system compromise on systems that install the affected packages. The threat level is indicated as moderate (3 on an unspecified scale), and certainty is moderate (50%), suggesting some confidence in the compromise but possibly limited details on the full scope or impact. No known exploits in the wild have been reported, and no specific affected versions or patches are provided, indicating that the incident might have been contained or is under investigation. The lack of detailed technical indicators or CWE classifications limits precise technical characterization, but the core issue is the integrity breach of a trusted software distribution channel, which is a critical supply chain security concern.

Detailed information about Incident - pear.php.net - compromised and delivering malicious package. Get real-time updates, technical details, and mitigation stra

Incident - pear.php.net - compromised and delivering malicious package - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat described involves malspam campaigns distributed via spambots, reported on April 14, 2016. Malspam refers to malicious spam emails that typically carry malware payloads or links to malicious websites. Spambots are automated programs designed to harvest email addresses or send spam emails en masse. In this context, spambots are used to distribute malspam, potentially leading to system compromise if recipients interact with the malicious content. Although specific malware types or payloads are not detailed, the classification under 'malware' and 'system compromise' indicates that the emails likely contain attachments or links that, when executed or clicked, could install malware on the victim's system or facilitate unauthorized access. The threat level is indicated as low, and there are no known exploits in the wild or specific affected software versions mentioned. The lack of detailed technical indicators or CWEs limits the ability to analyze the exact attack vectors or malware behavior. However, malspam campaigns remain a common initial infection vector for various malware families, including ransomware, banking trojans, or remote access tools. The use of spambots to distribute malspam suggests a broad, indiscriminate targeting approach rather than highly targeted attacks. Given the date of the report (2016), this threat reflects ongoing challenges in email security and the persistent use of spam as a malware delivery mechanism.

Detailed information about Malspam via Spambots (2016-04-14). Get real-time updates, technical details, and mitigation strategies.

Malspam via Spambots (2016-04-14) - Live Threat Intelligence - Threat Radar | OffSeq.com

Malspam via Spambots (2016-04-14)

The provided information refers to a potential threat involving SpamBots identified on March 17, 2016. SpamBots are automated programs designed to send unsolicited messages, often for advertising, phishing, or spreading malware. However, the data here is limited and classified as 'unknown' type with a low severity rating. There are no specific affected versions, no known exploits in the wild, and no technical details beyond a low threat level (3) and minimal analysis (0). The incident classification suggests a possible system compromise, but no concrete evidence or indicators of compromise are provided. Overall, this appears to be an early or preliminary report of potential automated spam activity without detailed technical or exploit information.

Detailed information about Potential SpamBots (2016-03-17). Get real-time updates, technical details, and mitigation strategies.

Potential SpamBots (2016-03-17) - Live Threat Intelligence - Threat Radar | OffSeq.com

Potential SpamBots (2016-03-17)

The provided information describes a potential security threat identified as "Potential SpamBots" dated March 16, 2016. The threat is categorized under "system-compromise" by CIRCL (Computer Incident Response Center Luxembourg) but lacks detailed technical specifics, such as affected software versions, attack vectors, or indicators of compromise. The term "SpamBots" generally refers to automated software agents designed to send unsolicited messages or spam, often leveraging compromised systems to propagate or execute their activities. However, in this case, the threat type is marked as "unknown," and no concrete evidence of exploitation or detailed technical analysis is provided. The threat level is indicated as 3 (on an unspecified scale), and the severity is classified as low. No known exploits in the wild have been reported, and no patches or mitigation links are referenced. The absence of detailed indicators, CWE identifiers, or affected product versions limits the ability to perform a deep technical analysis. Overall, this appears to be an early or preliminary identification of a potential compromise involving spam-related bot activity, but with insufficient data to characterize the threat fully or understand its mechanisms.

Detailed information about Potential SpamBots (2016-03-16). Get real-time updates, technical details, and mitigation strategies.

Potential SpamBots (2016-03-16) - Live Threat Intelligence - Threat Radar | OffSeq.com

Potential SpamBots (2016-03-16)

The provided information refers to a potential threat involving 'SpamBots' identified on March 14, 2016. SpamBots are automated software agents designed to send unsolicited messages, often for advertising, phishing, or spreading malware. However, the data here is minimal and lacks specific technical details such as affected systems, attack vectors, or exploitation methods. The threat is classified as a 'system compromise' by CIRCL, indicating that these SpamBots may have compromised systems to operate. The severity is noted as low, and there are no known exploits in the wild or patches available. The lack of affected versions and technical indicators suggests this is an early or low-confidence detection rather than a confirmed widespread threat. The threat level and analysis scores (3 and 2 respectively) imply moderate concern but limited actionable intelligence. Overall, this appears to be a low-severity, low-confidence potential threat related to automated spam activities that may involve compromised systems but lacks concrete technical details or evidence of active exploitation.

Detailed information about Potential SpamBots (2016-03-14). Get real-time updates, technical details, and mitigation strategies.

Potential SpamBots (2016-03-14) - Live Threat Intelligence - Threat Radar | OffSeq.com

Potential SpamBots (2016-03-14)

The provided information describes a potential threat related to 'SpamBots' identified around March 15, 2016. SpamBots typically refer to automated software agents designed to send unsolicited messages, often for advertising, phishing, or spreading malware. However, the details here are minimal and classified under 'unknown' type with no specific affected versions or products listed. The source is CIRCL (Computer Incident Response Center Luxembourg), indicating a credible security monitoring entity. The threat is tagged as a 'system-compromise' incident classification, suggesting that these SpamBots may have been involved in compromising systems to facilitate spam campaigns. The threat level is noted as 3 (on an unspecified scale), with no known exploits in the wild and no technical details or indicators of compromise provided. The severity is marked as low, reflecting limited information and presumably low immediate risk. Given the lack of detailed technical data, the exact mechanisms, vectors, or payloads of these SpamBots remain unclear. The absence of patch links or CWE identifiers further limits the ability to pinpoint vulnerabilities or attack techniques involved. Overall, this appears to be an early or preliminary identification of suspicious automated spam activity potentially linked to compromised systems, but without concrete evidence or exploit details.

Detailed information about Potential SpamBots (2016-03-15). Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'circl:incident-classification="system-compromise"'

Filter Threats

Threats Tagged 'circl:incident-classification="system-compromise"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility