Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable edge appliances and employs brute-force tools for Microsoft Outlook and RDWeb portals. Their ransom negotiation panel features AI-driven chatbots, enabling non-English-speaking affiliates to engage victims more effectively. The group offers an 85% revenue share to affiliates and provides a mobile-friendly control panel. GLOBAL GROUP's infrastructure has been traced to a Russia-based VPS provider, and their operations show similarities to previous Mamona ransomware activities.

The GLOBAL GROUP ransomware-as-a-service (RaaS) campaign represents a sophisticated evolution in ransomware operations, likely a rebranding of the previously known BlackLock RaaS. This group targets multiple sectors across the US and Europe, with a pronounced focus on healthcare providers, a sector known for critical data and operational sensitivity. GLOBAL GROUP leverages Initial Access Brokers (IABs) to gain footholds in victim networks, specifically exploiting vulnerable edge appliances. They also employ brute-force attacks targeting Microsoft Outlook and RDWeb portals, common vectors for remote access and email compromise. A notable innovation in their operation is the integration of AI-driven chatbots within their ransom negotiation panel, which facilitates multilingual communication and enables affiliates who may not be fluent in English to negotiate effectively with victims. This AI-enhanced negotiation capability likely increases the success rate of ransom payments by improving communication and persuasion. The group offers an attractive 85% revenue share to affiliates, incentivizing widespread participation. Additionally, GLOBAL GROUP provides a mobile-friendly control panel, enhancing operational flexibility for affiliates to manage campaigns remotely. Their infrastructure is hosted on a Russia-based VPS provider, and their tactics and infrastructure bear resemblance to the Mamona ransomware group, suggesting possible shared resources or lineage. The campaign employs a broad range of tactics, techniques, and procedures (TTPs) including brute-force (T1110), exploitation of remote services (T1190), persistence mechanisms (T1505.003), and ransomware deployment (T1486). Indicators of compromise include multiple file hashes, IP addresses, and onion domains used for command and control or ransom negotiation. Although no known exploits are currently reported in the wild, the campaign's use of brute-force and initial access brokers indicates a high likelihood of successful intrusions where security controls are weak or outdated.

Detailed information about Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates. Get real-time updat

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates - Live Threat Intelligence - Threat Radar | OffSeq.com

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates

Chaos RAT, an open-source remote administration tool written in Golang, has evolved since its first appearance in 2022. Recent variants have been identified in Linux and Windows attacks. The malware offers cross-platform compatibility and is being exploited by threat actors for malicious purposes. It provides an administrative panel for payload generation and control of compromised systems. The latest samples show improved encoding of configuration data and expanded capabilities. A critical vulnerability in Chaos RAT's web panel allowed attackers to execute remote code on the server. While overall usage remains limited, its low detection profile creates opportunities for espionage, data exfiltration, and establishing footholds for further attacks.

Chaos RAT is a remote administration tool (RAT) originally released as open-source software written in Golang, which has evolved since its initial appearance in 2022 into a malware platform exploited by threat actors. Its cross-platform design supports both Linux and Windows environments, increasing its potential attack surface. The malware provides an administrative web panel that allows attackers to generate payloads and control compromised systems remotely. Recent variants have improved the encoding of configuration data, making detection and analysis more difficult, and have expanded capabilities that facilitate persistence, lateral movement, and data exfiltration. A critical vulnerability (CVE-2024-30850) was discovered in the Chaos RAT web panel, enabling remote code execution on the server hosting the panel, which could allow attackers to take full control of the command and control infrastructure. Although overall usage of Chaos RAT remains limited compared to more widespread malware, its low detection profile and modular capabilities make it attractive for espionage campaigns and establishing persistent footholds within targeted networks. The malware leverages multiple tactics and techniques mapped to MITRE ATT&CK, including process injection, persistence mechanisms, command and control communication, and execution of arbitrary code, highlighting its sophistication and adaptability. No known widespread exploits of the critical vulnerability have been reported in the wild yet, but the presence of this flaw significantly raises the risk profile for organizations running the Chaos RAT infrastructure or those potentially targeted by attackers using it.

Detailed information about From open-source to open threat: Tracking Chaos RAT’s evolution. Get real-time updates, technical details, and mitigation strategies.

From open-source to open threat: Tracking Chaos RAT’s evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

From open-source to open threat: Tracking Chaos RAT’s evolution

A recent campaign attributed to APT36 has been observed spoofing India's Ministry of Defence to deliver cross-platform malware. The attackers used a ClickFix-style infection chain, mimicking government press releases and leveraging a compromised .in domain for payload staging. The campaign targeted both Windows and Linux users, employing clipboard-based execution techniques. On Windows, the attack utilized mshta.exe to execute a heavily obfuscated HTA file, while on Linux, it attempted to execute a shell script. The tradecraft observed, including government-themed lures, HTA-based delivery, and decoy documents, aligns with known APT36 tactics. This activity demonstrates the continued evolution of ClickFix techniques in new contexts.

This threat campaign, attributed to the Advanced Persistent Threat group APT36, employs a sophisticated ClickFix-style attack chain targeting both Windows and Linux platforms. The attackers spoof India's Ministry of Defence by mimicking official government press releases and leveraging compromised Indian (.in) domains for hosting malicious payloads. The infection vector relies heavily on social engineering and spoofing tactics to lure victims into executing malware. On Windows systems, the attack uses mshta.exe to run a heavily obfuscated HTML Application (HTA) file, a technique that leverages the Windows utility mshta.exe to execute malicious scripts without triggering traditional executable detection. On Linux systems, the campaign attempts to execute shell scripts, indicating cross-platform targeting capabilities. The attackers utilize clipboard-based execution techniques, which may involve manipulating clipboard contents to execute commands or payloads stealthily. The campaign also uses decoy documents to distract or mislead victims while the malware executes in the background. The observed tactics align with known APT36 tradecraft, including the use of government-themed lures, obfuscation, and multi-stage infection chains. The domains involved (e.g., avtzyu.store, drdosurvey.info, trade4wealth.in) are used for payload staging and command and control (C2) communication. The attack techniques correspond to MITRE ATT&CK tactics such as T1059 (Command and Scripting Interpreter), T1547 (Boot or Logon Autostart Execution), T1071 (Application Layer Protocol), T1036 (Masquerading), T1021 (Remote Services), T1083 (File and Directory Discovery), T1102 (Web Service), T1218.005 (Mshta), T1204 (User Execution), T1059.001 (PowerShell), T1566 (Phishing), T1059.004 (Unix Shell), T1027 (Obfuscated Files or Information), T1518 (Software Discovery), and T1105 (Ingress Tool Transfer). This campaign demonstrates the evolution of ClickFix techniques beyond traditional Windows environments into cross-platform attacks, increasing the complexity and potential reach of the threat.

Detailed information about APT36-Style ClickFix Attack Spoofs Indian Ministry to Target Windows & Linux. Get real-time updates, technical details, and mitigatio

Title	Severity	Type	Source	Date

Threats Tagged 'cross-platform'

Filter Threats

Threats Tagged 'cross-platform'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility