Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[OSINT] No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed

The Prynt Stealer is a type of malware categorized primarily as a backdoor, designed to covertly maintain unauthorized access to compromised systems. This malware belongs to a family of information stealers, which typically exfiltrate sensitive data such as credentials, financial information, or system details. The exposed backdoor component of Prynt Stealer indicates that beyond its initial data theft capabilities, it also allows attackers to remotely control infected machines, potentially enabling further malicious activities such as lateral movement, deployment of additional payloads, or persistent espionage. The threat was publicly disclosed through open-source intelligence (OSINT) channels, highlighting a lack of trust even among threat actors ('No Honor Among Thieves'), as the backdoor was exposed by other malicious actors or researchers. Although the malware does not have specific affected versions listed, it is associated with other similar stealer malware families like DarkEye and WorldWind, suggesting a shared or overlapping codebase or operational tactics. The technical details indicate a high threat level with moderate certainty (50%), but no known exploits in the wild have been reported, implying that while the backdoor capability is present, widespread exploitation or targeted campaigns have not been confirmed. The malware's classification as a backdoor emphasizes its potential for stealthy persistence and control, making it a significant threat to infected environments.

Detailed information about [OSINT] No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed. Get real-time updates, technical details, and mitigation strategie

[OSINT] No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed - Live Threat Intelligence - Threat Radar | OffSeq.com

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm

BumbleBee is a modular backdoor malware that evolved from the previously known BookWorm backdoor. It employs a variety of sophisticated techniques to maintain persistence, evade detection, and facilitate remote control by threat actors. BumbleBee uses process injection (MITRE ATT&CK T1055) to execute malicious code within legitimate processes, thereby hiding its presence. It hijacks execution flow (T1574) and modifies system processes (T1543) to establish persistence, including through boot or logon autostart execution (T1547) and initialization scripts (T1037). The malware also incorporates execution guardrails (T1480) to limit its activity to specific environments, reducing the chance of accidental discovery. BumbleBee performs indicator removal on the host (T1070) to erase traces of its activity and uses keylogging and input capture techniques (T1056.001, T1056, T1417) to steal sensitive information. It gathers victim host information (T1592) to tailor its operations and uses web protocols (T1071.001) for command and control communications, often employing proxies (T1090) to obfuscate network traffic. Symmetric cryptography (T1573.001) is used to secure communications and payloads, complicating detection and analysis. BumbleBee’s modular architecture allows it to load and execute various payloads dynamically, increasing its flexibility and adaptability. Although no known exploits in the wild have been reported, its medium threat level and extensive use of stealth and persistence techniques make it a significant threat to targeted environments.

Detailed information about Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm. Get real-time updates, technical details, and mit

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo

The Amavaldo malware is a backdoor Trojan primarily categorized as spyware and keylogger, with capabilities that include masquerading, spearphishing via service, screen capture, input capture, video capture, forced authentication, and deployment through application deployment software. It is identified as a Remote Access Trojan (RAT) with a focus on banking-related espionage activities. The malware employs multiple MITRE ATT&CK techniques such as T1036 (Masquerading), T1194 (Spearphishing via Service), T1113 (Screen Capture), T1056 (Input Capture), T1125 (Video Capture), T1187 (Forced Authentication), and T1017 (Application Deployment Software), indicating a sophisticated approach to infiltrate and maintain persistence within targeted systems. The threat is characterized by a low severity rating but is persistent and capable of continuous espionage, capturing sensitive user inputs and screen data, which can lead to credential theft and unauthorized access to financial accounts. The malware's distribution vector includes spearphishing, which exploits social engineering to gain initial access, and it can masquerade as legitimate software to evade detection. Although no known exploits in the wild are reported, the malware's capabilities suggest it is designed for targeted attacks, especially against financial institutions or users with banking privileges. The threat level and analysis scores indicate moderate confidence in the technical details, with a 50% certainty rating, suggesting some gaps in full attribution or behavioral understanding. The malware's perpetual lifetime implies ongoing risk if not detected and removed.

Detailed information about OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo. Get real-time updates, technical details, and mitigation strategi

OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo - Live Threat Intelligence - Threat Radar | OffSeq.com

Zebrocy is a malware family primarily classified as a backdoor, known for its use in targeted intrusion campaigns. It is associated with a range of sophisticated attack techniques as cataloged in the MITRE ATT&CK framework. Zebrocy typically employs spearphishing links (T1192) to initiate infection, relying on user execution (T1204) to activate its payload. The malware leverages Windows native utilities such as rundll32 (T1085) and Windows Management Instrumentation (WMI) (T1047) to execute malicious code and maintain persistence. Persistence mechanisms include scheduled tasks (T1053), registry run keys/startup folder modifications (T1060), and Component Object Model (COM) hijacking (T1122). Zebrocy also attempts to disable security tools (T1089) and delete files (T1107) to evade detection and hinder forensic analysis.

Once established, Zebrocy conducts extensive reconnaissance activities including process discovery (T1057), system information discovery (T1082), file and directory discovery (T1083), and registry queries (T1012). It collects data from local systems (T1005), network shared drives (T1039), and removable media (T1025), staging this data (T1074) for exfiltration. Zebrocy employs input capture (T1056) and screen capture (T1113) techniques to gather sensitive user information. Data exfiltration is performed over command and control (C2) channels (T1041) using commonly used ports (T1043) and custom cryptographic protocols (T1024), often with multilayer encryption (T1079) and data obfuscation (T1001) to avoid detection. The malware uses fallback channels (T1008) and standard application layer protocols (T1071) to maintain communication resilience.

Zebrocy is notable for its modularity and use of AutoIt scripting in some variants, facilitating rapid development and deployment. Although no known exploits are currently reported in the wild for this malware, its extensive use of legitimate Windows features and complex evasion techniques make it a persistent threat in targeted environments. The threat level is moderate (3/10), with a low severity rating assigned, reflecting the requirement for user interaction and the targeted nature of attacks rather than widespread automated exploitation.

Detailed information about OSINT - A journey to Zebrocy land. Get real-time updates, technical details, and mitigation strategies.

OSINT - A journey to Zebrocy land - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - A journey to Zebrocy land

The Carbanak malware, also known as Anunak, is a sophisticated backdoor malware associated with the Carbanak intrusion set (G0008) and linked to the financially motivated threat actors FIN7 (G0046). This malware has been widely documented in cybercrime campaigns targeting financial institutions and related sectors. Carbanak operates as a backdoor, enabling attackers to gain persistent remote access to compromised systems, allowing them to conduct reconnaissance, data exfiltration, and financial theft. The malware is known for its stealth and ability to evade detection, often leveraging spear-phishing and social engineering to infiltrate networks. The FireEye OSINT report titled "CARBANAK Week" highlights ongoing intelligence gathering and analysis efforts around this malware family. Although the published information dates back to 2019 and the severity is marked as low, Carbanak remains relevant due to its historical impact and continued use by advanced persistent threat groups. The malware's association with FIN7, a group known for targeting retail, hospitality, and financial sectors, underscores its focus on financially lucrative targets. The lack of known exploits in the wild and absence of specific affected versions suggest this report is more of an intelligence summary rather than a disclosure of a new vulnerability or exploit. However, the presence of a backdoor malware with such capabilities poses a significant risk if deployed successfully within an organization's environment.

Detailed information about OSINT - CARBANAK Week - Fire Eye. Get real-time updates, technical details, and mitigation strategies.

OSINT - CARBANAK Week - Fire Eye - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - CARBANAK Week - Fire Eye

The Supreme Backdoor Factory is a malware-related threat categorized under OSINT (Open Source Intelligence) with a focus on supply chain compromise (MITRE ATT&CK T1195). It is described as a backdoor intrusion tool or technique that potentially enables attackers to implant persistent backdoors within software supply chains. The information available is limited and somewhat uncertain, with a certainty rating of 50%, and no specific affected software versions or known exploits in the wild have been reported. The threat is associated with supply chain compromise, which typically involves tampering with software or hardware components during development or distribution to insert malicious code, allowing attackers to maintain long-term access to targeted systems. The threat level is moderate (3 out of an unspecified scale), and the severity is rated low by the source. However, supply chain attacks are inherently dangerous because they can affect multiple downstream organizations unknowingly. The lack of detailed technical indicators and patches suggests this is more of an intelligence report highlighting the potential risk rather than a documented active exploit. The perpetual lifetime tag indicates that this threat remains relevant over time, emphasizing the ongoing risk of supply chain compromises. Overall, this threat represents a latent risk of backdoor insertion through supply chain vectors, requiring vigilance in software integrity verification and supply chain security.

Detailed information about OSINT - The Supreme Backdoor Factory. Get real-time updates, technical details, and mitigation strategies.

OSINT - The Supreme Backdoor Factory - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - The Supreme Backdoor Factory

The APT28 XTunnel Backdoor is a malware tool attributed to the advanced persistent threat group APT28, also known as Sofacy or Strontium, which is widely recognized for its cyber espionage activities targeting government, military, and security organizations globally. XTunnel functions as a backdoor, enabling attackers to maintain persistent access to compromised systems, execute remote commands, and exfiltrate sensitive data covertly. This malware is part of APT28's broader toolkit and has been observed facilitating stealthy communications between compromised hosts and command-and-control servers. Although the provided data does not specify affected software versions or detailed technical mechanisms, XTunnel's classification as a backdoor implies it can bypass traditional security controls, maintain stealth, and potentially escalate privileges. The threat level is indicated as moderate (3 out of an unspecified scale), and the severity is marked as low, likely reflecting limited observed impact or deployment scope at the time of reporting. No known exploits in the wild are documented, suggesting that while the malware is recognized, it may not be actively widespread or currently exploited in large-scale campaigns. The association with APT28, a group historically linked to sophisticated, targeted espionage campaigns primarily against governmental and defense sectors, underscores the strategic nature of this threat. The lack of patch information and absence of CVEs indicates that XTunnel operates more as a covert implant rather than exploiting a specific software vulnerability. This malware is persistent and designed for long-term access, making it a significant concern for organizations handling sensitive or classified information.

Detailed information about 2019-01-28: APT28 XTunnel Backdoor. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'ecsirt:intrusions="backdoor"'

Filter Threats