Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

MSFT - MSTIC - Destructive malware targeting Ukrainian organizations

This security threat involves destructive malware campaigns targeting Ukrainian organizations, as reported by Microsoft Threat Intelligence Center (MSTIC) and shared via CIRCL OSINT sources. The malware is characterized by its data destruction capabilities, aligning with the MITRE ATT&CK pattern T1485, which involves wiping or corrupting data to disrupt operations. Although specific technical details and indicators of compromise are not provided, the campaign is identified as ongoing with a moderate certainty level (50%) and a low severity rating by the source. The malware's destructive nature suggests it aims to cause significant operational disruption by erasing or damaging critical data, potentially impacting availability and integrity of affected systems. The campaign appears politically motivated, focusing on Ukrainian targets, likely in the context of geopolitical tensions in the region. No known exploits or vulnerabilities are directly associated with this malware, indicating it may rely on other infection vectors or social engineering rather than exploiting software flaws. The lack of affected versions and patch links further supports this. The threat level assigned is moderate (4 out of an unspecified scale), and the analysis confidence is low (2 out of an unspecified scale), reflecting limited available intelligence. Overall, this campaign represents a destructive cyber threat with potential to disrupt critical infrastructure or organizational operations through data destruction, primarily targeting Ukrainian entities.

Detailed information about MSFT - MSTIC - Destructive malware targeting Ukrainian organizations. Get real-time updates, technical details, and mitigation strate

MSFT - MSTIC - Destructive malware targeting Ukrainian organizations - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

CVE-2019-13720 is a zero-day vulnerability affecting Google Chrome, identified as being exploited in the context of Operation WizardOpium, a threat actor campaign. This vulnerability allows for exploitation via client-side execution, specifically categorized under the MITRE ATT&CK technique T1203 (Exploitation for Client Execution). Although detailed technical specifics of the exploit are not provided in the available information, zero-day vulnerabilities in Chrome typically involve memory corruption or sandbox escape flaws that enable attackers to execute arbitrary code on the victim's machine upon visiting a malicious or compromised website. The exploit was publicly noted in OSINT reports by CIRCL in late 2019, but no public patch or remediation was linked at the time of reporting. The threat level is moderate (3 out of an unspecified scale), with an analysis confidence level of 2, indicating some uncertainty or limited data. The exploit is associated with Operation WizardOpium, a known threat actor group, suggesting targeted or strategic use rather than widespread indiscriminate attacks. No known exploits in the wild were confirmed at the time, and the severity was initially rated as low by the source, though this may reflect limited impact or exploitation scope at that time. The vulnerability's exploitation requires client interaction (e.g., visiting a malicious webpage), and no authentication is needed, which increases the attack surface. However, the lack of a patch and the zero-day nature imply a significant risk if leveraged by attackers. The absence of affected versions and patch information limits precise technical mitigation guidance but highlights the need for vigilance and rapid patching once updates become available.

Detailed information about OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium affecting type osint. Get real-time updates, technical deta

OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New traces of Hacking Team in the wild

The provided information references new traces of the Hacking Team in the wild, as reported by CIRCL (Computer Incident Response Center Luxembourg). Hacking Team is a well-known Italian company that developed offensive intrusion and surveillance software, often used by law enforcement and intelligence agencies. The mention of "new traces" suggests that indicators or artifacts related to Hacking Team's tools or infrastructure have been detected in operational environments, potentially indicating ongoing or renewed activity by actors using or linked to Hacking Team's capabilities. However, the details are sparse: no specific affected products or versions are identified, no technical indicators are provided, and no known exploits in the wild are confirmed. The threat level and analysis scores are moderate (both 2), and the severity is marked as medium. The lack of detailed technical data or confirmed exploitation suggests this is an intelligence report highlighting the probable presence or use of Hacking Team tools rather than a direct vulnerability or active exploit campaign. The term "OSINT" (Open Source Intelligence) indicates that the information was gathered from publicly available sources, which may include network traffic, malware samples, or other forensic evidence. Overall, this points to a medium-level threat scenario involving surveillance or intrusion capabilities associated with Hacking Team, with a likelihood assessed as very likely but without concrete evidence of active exploitation or impact at the time of reporting.

Detailed information about OSINT - New traces of Hacking Team in the wild. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'collaborative-intelligence:request="sample"'

Filter Threats