CVE Database V5

Reddit NetSec

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX General

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure

This threat concerns a ransomware attack, specifically attributed to the RansomEXX ransomware family, targeting the banking infrastructure in India. RansomEXX is a known ransomware strain that encrypts victim data and demands ransom payments to restore access. The attack has caused significant payment disruptions within Indian financial institutions, indicating that critical banking systems were impacted, potentially including transaction processing, payment gateways, or internal financial operations. The ransomware's modus operandi typically involves initial access through phishing, exploitation of vulnerabilities, or compromised credentials, followed by lateral movement within the network to maximize impact before deploying encryption payloads. Although the severity is currently rated as low and the certainty of the incident is about 50%, the disruption to banking infrastructure highlights the potential for operational and financial damage. No specific affected versions or exploited vulnerabilities are listed, and there are no known exploits in the wild beyond this incident. The threat level is moderate (3 out of an unspecified scale), but the analysis is limited, suggesting ongoing investigation. The attack is categorized as an OSINT (Open Source Intelligence) report, indicating public visibility but limited technical detail. The ransomware impact on payment systems can lead to temporary denial of service, loss of transactional data integrity, and reputational damage to affected banks. The lack of patch information and exploit details suggests that mitigation may rely on general ransomware defense strategies and incident response readiness rather than specific vulnerability remediation.

Detailed information about OSINT - Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure. Get real-time updates, technical details, and mit

OSINT - Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New Gootkit Banking Trojan campaign against Italian Companies and Users.

The Gootkit banking Trojan is a well-known malware family primarily targeting financial institutions and their customers. This particular campaign, identified through OSINT sources and reported by CIRCL in September 2019, focuses on Italian companies and users. Gootkit is a modular malware that typically spreads via malicious email attachments or compromised websites, enabling attackers to steal banking credentials, perform web injections, and conduct financial fraud. The Trojan operates by injecting malicious code into web browsers to intercept user credentials and session cookies, allowing attackers to bypass two-factor authentication and other security controls. Although the campaign targets Italy specifically, the malware's capabilities pose a broader threat to any organization relying on online banking or financial transactions. The campaign's low severity rating and 50% certainty indicate limited observed impact or incomplete attribution at the time of reporting. No known exploits in the wild or specific affected software versions were identified, suggesting this is an ongoing or emerging threat rather than a widespread outbreak. The technical details show a moderate threat level (3/10) and limited analysis data, reflecting early-stage intelligence gathering rather than a fully developed attack profile.

Detailed information about OSINT - New Gootkit Banking Trojan campaign against Italian Companies and Users.. Get real-time updates, technical details, and mitig

OSINT - New Gootkit Banking Trojan campaign against Italian Companies and Users. - Live Threat Intelligence - Threat Radar | OffSeq.com

Emotet is a well-known modular banking Trojan and malware loader that has been active since approximately 2014. It primarily targets financial institutions and their customers by stealing banking credentials and delivering additional malware payloads. The notification that "Emotet is back" indicates a resurgence or renewed activity of this malware campaign after a period of reduced or no observed activity. Emotet typically propagates via malicious email campaigns using phishing techniques, often leveraging social engineering to trick users into opening infected attachments or clicking on malicious links. Once executed, Emotet can download and install other malware, including ransomware and information stealers, making it a significant threat to organizations. Although the provided data marks the severity as "low" and certainty at 50%, the historical impact of Emotet campaigns has been substantial. The lack of known exploits in the wild and absence of specific affected versions suggests this is an intelligence update rather than a newly discovered vulnerability. The mention of "adversary:infrastructure-action=take-down" implies that law enforcement or cybersecurity entities may have previously disrupted Emotet's infrastructure, and this update signals its return. The threat level of 3 (on an unspecified scale) and the low severity rating likely reflect the early stage of this resurgence or limited current impact at the time of reporting.

Detailed information about OSINT - Emotet is back. Get real-time updates, technical details, and mitigation strategies.

OSINT - Emotet is back - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Emotet is back

Financial - socgen-compliance.com fake website delivering malicious documents

The threat involves a fraudulent website, socgen-compliance.com, impersonating a legitimate financial entity to distribute malicious documents. This campaign is designed to deceive users into downloading and opening these documents, which likely contain embedded malware. The attack leverages several sophisticated techniques identified by MITRE ATT&CK patterns, including the use of uncommonly used ports (T1065), process injection (T1055), hooking (T1179), Office application startup manipulation (T1137), and registry modification (T1112). These techniques suggest that the malicious documents exploit Office macros or similar scripting capabilities to execute code stealthily, maintain persistence, and evade detection. Process injection and hooking enable the malware to hide its presence and interfere with normal system operations, while registry modifications ensure the malware can persist across reboots. The use of uncommonly used ports indicates attempts to bypass network security controls or blend in with legitimate traffic. Although the campaign's severity is rated low and no known exploits are reported in the wild, the combination of these tactics indicates a targeted approach aimed at financial sector victims. The threat level and analysis scores suggest moderate confidence in the campaign's capabilities, but the overall certainty is about 50%, indicating some uncertainty in the full scope or impact. The campaign is perpetual, meaning it could be ongoing or reactivated over time. The lack of specific affected versions or products implies a broad targeting strategy focused on user interaction with malicious documents rather than exploiting a particular software vulnerability.

Detailed information about Financial - socgen-compliance.com fake website delivering malicious documents. Get real-time updates, technical details, and mitigati

Financial - socgen-compliance.com fake website delivering malicious documents - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake amf-fr.org website delivering malicious Word document and binaries

This threat involves a fraudulent website impersonating the legitimate amf-fr.org domain, which is associated with the French financial markets authority. The fake website is used as a distribution vector for malicious payloads, specifically a Word document embedded with malware and additional binary files. The attack campaign leverages social engineering to entice victims to download and open the malicious Word document, which likely contains macros or exploits that execute malicious code on the victim's system. The binaries delivered may include backdoors, remote access tools, or other malware designed to compromise the target's system. The campaign is tagged with MITRE ATT&CK techniques such as 'service execution' (T1035) and 'hooking' (T1179), indicating that the malware may employ advanced persistence or code injection methods to evade detection and maintain control over the infected system. The threat level is assessed as low, with a 50% certainty rating, suggesting limited observed impact or distribution. However, the targeting of a financial regulatory domain implies a focus on financial sector entities or stakeholders. The lack of known exploits in the wild and absence of patch information indicates this is primarily a social engineering and malware delivery campaign rather than an exploitation of a software vulnerability. The campaign was first identified in early 2019, and no specific affected software versions are listed.

Detailed information about Fake amf-fr.org website delivering malicious Word document and binaries. Get real-time updates, technical details, and mitigation str

Fake amf-fr.org website delivering malicious Word document and binaries - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - CIG Circular 66  â€“ FASTCash  ATM Cash  Out Campaign

The FASTCash ATM Cash Out Campaign, as referenced in the OSINT CIG Circular 66, represents a coordinated financial cybercrime operation targeting ATM networks. This campaign typically involves attackers exploiting vulnerabilities in banking infrastructure or payment processing systems to withdraw large sums of money illicitly from ATMs. Although specific technical details are limited in the provided information, such campaigns often leverage compromised credentials, malware infections on banking systems, or weaknesses in interbank communication protocols to initiate unauthorized cash withdrawals. The campaign is categorized as a low severity threat with no known exploits in the wild at the time of reporting. The threat level and analysis scores indicate a moderate concern but not an immediate critical risk. The campaign's focus on financial systems highlights the importance of securing ATM networks and associated backend systems against unauthorized access and manipulation.

Detailed information about OSINT - CIG Circular 66  â€“ FASTCash  ATM Cash  Out Campaign. Get real-time updates, technical details, and mitigation strategies.

OSINT - CIG Circular 66  â€“ FASTCash  ATM Cash  Out Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - CYBER THREATSCAPE  REPORT 2018 - MIDYEAR CYBERSECURITY  RISK REVIEW

The provided information pertains to an OSINT report titled 'CYBER THREATSCAPE REPORT 2018 - MIDYEAR CYBERSECURITY RISK REVIEW' published by CIRCL and cataloged within the MISP galaxy framework. The report references multiple ransomware families such as Wannasmile, Black Ruby, Rastakhiz, and Tyrant, and associates threat actors including Cobalt, FIN7, and Anunak. These actors are known for financially motivated cybercrime campaigns, often targeting financial institutions and enterprises. The report categorizes the threat as malware with a low severity rating and indicates no known exploits in the wild at the time of publication. The technical details assign a threat level of 3 and an analysis rating of 2, suggesting moderate concern but limited immediate impact. The absence of specific affected versions, CWE identifiers, or patch links implies this is a broad situational awareness report rather than a detailed vulnerability disclosure. The inclusion of multiple ransomware variants and financially motivated threat actors highlights the ongoing risk of ransomware campaigns targeting financial sectors. However, the lack of concrete indicators or exploit details limits the ability to pinpoint specific attack vectors or vulnerabilities. Overall, this report serves as an intelligence overview of the mid-2018 cyber threat landscape, emphasizing ransomware threats and financially motivated threat actors without detailing active exploits or vulnerabilities.

Detailed information about OSINT - CYBER THREATSCAPE  REPORT 2018 - MIDYEAR CYBERSECURITY  RISK REVIEW. Get real-time updates, technical details, and mitigation

OSINT - CYBER THREATSCAPE  REPORT 2018 - MIDYEAR CYBERSECURITY  RISK REVIEW - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions

This threat involves a spear phishing campaign targeting financial institutions, where a misstep (OSINT gaffe) led to the public exposure of the full list of intended targets. The attack leverages Cobalt Strike, a legitimate penetration testing tool frequently abused by threat actors to conduct post-exploitation activities such as lateral movement, privilege escalation, and command and control communications. Spear phishing is a highly targeted form of phishing where attackers craft personalized emails to deceive specific individuals within an organization, often to deliver malicious payloads or gain initial access. The exposure of the full target list increases the risk of these institutions being aware of the attack and potentially preparing defenses, but also reveals the scope and intent of the threat actor. Although the severity is marked as low, the use of Cobalt Strike indicates a sophisticated adversary capable of bypassing traditional defenses once initial access is gained. The threat actor's focus on financial institutions suggests a motive aligned with financial gain or disruption. The lack of known exploits in the wild and absence of specific vulnerabilities or patches indicates this is primarily a social engineering and post-exploitation threat rather than a software vulnerability. The technical details show a moderate threat level and analysis score, reinforcing that this is a credible but not immediately critical threat. Overall, this threat highlights the importance of robust email security, user awareness, and monitoring for Cobalt Strike activity within networks.

Detailed information about OSINT - Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Get real-time

OSINT - Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT -  Banking Trojan Attempts To Steal Brazillion$

The reported threat concerns a banking Trojan malware aiming to steal large sums of money, colloquially described as attempting to steal a 'Brazillion$'. Banking Trojans are malicious software designed to infiltrate victims' systems, primarily targeting financial information such as online banking credentials, credit card details, and other sensitive financial data. Once installed, these Trojans often employ techniques such as keylogging, form grabbing, web injection, and man-in-the-browser attacks to intercept and manipulate banking transactions. The information provided is limited, with no specific affected software versions or detailed technical indicators, and no known exploits in the wild at the time of reporting. The threat level is indicated as low, with a threat level rating of 3 and analysis rating of 2, suggesting limited immediate risk or low sophistication. However, banking Trojans historically pose significant risks due to their potential to cause direct financial loss and compromise user privacy. The lack of detailed technical data and absence of known exploits may imply this is an early-stage or low-activity threat or a general alert rather than an active widespread campaign. Nevertheless, banking Trojans remain a persistent threat vector in cybersecurity, often distributed via phishing emails, malicious downloads, or exploit kits.

Detailed information about OSINT -  Banking Trojan Attempts To Steal Brazillion$. Get real-time updates, technical details, and mitigation strategies.

OSINT -  Banking Trojan Attempts To Steal Brazillion$ - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Ukrainian Financial Institutions Targeted by Wave of Malicious EPS File Attacks

This threat involves a targeted campaign against Ukrainian financial institutions using malicious EPS (Encapsulated PostScript) files. EPS files are a graphics file format that can contain embedded PostScript code, which can be exploited to execute arbitrary code or deliver malicious payloads when opened in vulnerable applications. The campaign leverages these files as a vector to compromise financial organizations, potentially aiming to disrupt operations, steal sensitive financial data, or gain persistent access to critical systems. Although detailed technical specifics such as the exact exploitation mechanism or payload are not provided, the use of EPS files suggests attackers exploit vulnerabilities in document or graphic processing software that handles these files. The campaign was identified and reported by CIRCL (Computer Incident Response Center Luxembourg) as an OSINT observation dating back to 2017, targeting Ukrainian financial institutions. The threat level is noted as low, with no known exploits in the wild at the time of reporting, indicating limited immediate risk or sophistication. However, the targeting of financial institutions highlights the strategic intent to impact critical economic infrastructure.

Detailed information about OSINT - Ukrainian Financial Institutions Targeted by Wave of Malicious EPS File Attacks. Get real-time updates, technical details, an

Title	Severity	Type	Source	Date

Threats Tagged 'circl:topic="finance"'

Filter Threats

Threats Tagged 'circl:topic="finance"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility