Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat described is a malware campaign involving a fake job application that includes a macro. Such attacks typically use social engineering to entice victims to open a document, often a Microsoft Office file, which contains embedded macros. When the macro is enabled by the user, it executes malicious code that can download or install malware on the victim's system. The mention of "smoke loader" in the tags suggests that the malware payload may be related to Smoke Loader, a known modular malware downloader and loader used to deliver additional malicious payloads such as ransomware, banking trojans, or other malware families. Although the severity is marked as low and no known exploits in the wild are reported, the presence of macros in job application documents is a common vector for initial compromise in targeted phishing campaigns. The threat level and analysis scores indicate a moderate concern but not an immediate critical risk. The lack of affected versions and patch links suggests this is not a vulnerability in software but rather a malware campaign leveraging social engineering and macro execution. The attack relies heavily on user interaction, specifically enabling macros, which is a common infection vector in phishing and spear-phishing attacks.

Detailed information about Fake Job Application incl. Macro. Get real-time updates, technical details, and mitigation strategies.

Fake Job Application incl. Macro - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake Job Application incl. Macro

OSINT - MM Core In-Memory Backdoor Returns as "BigBoss" and "SillyGoose"

The threat described involves the return of an in-memory backdoor malware family known as "MM Core," which has resurfaced under the aliases "BigBoss" and "SillyGoose." In-memory backdoors are a class of malware that reside primarily in volatile memory rather than on disk, making them more difficult to detect and analyze using traditional file-based antivirus or endpoint detection systems. The MM Core backdoor is designed to maintain stealthy persistence on compromised systems, allowing attackers to execute arbitrary commands, exfiltrate data, or establish further footholds without leaving persistent artifacts on the file system. The reappearance of this malware under new names suggests ongoing development or reuse by threat actors, potentially indicating a continued interest in leveraging this tool for targeted intrusions. Although the provided information lacks detailed technical specifics such as infection vectors, command and control mechanisms, or payload capabilities, the classification as an in-memory backdoor implies significant stealth and control capabilities. The threat level and analysis scores (3 and 2 respectively) suggest moderate concern but limited public technical data. The absence of known exploits in the wild and the low severity rating from the source may indicate limited current impact or deployment, but the stealthy nature of in-memory backdoors warrants attention.

Detailed information about OSINT - MM Core In-Memory Backdoor Returns as "BigBoss" and "SillyGoose". Get real-time updates, technical details, and mitigation st

OSINT - MM Core In-Memory Backdoor Returns as "BigBoss" and "SillyGoose" - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Exposing an AV-Disabling Driver Just in Time for Lunch

The provided information describes a malware threat identified as an AV-disabling driver, exposed through OSINT (Open Source Intelligence) methods. This malware operates on the Win32 platform and is designed to disable antivirus (AV) software by leveraging a driver component. Disabling AV software allows the malware to evade detection and maintain persistence on infected systems. The threat was reported by CIRCL in early 2017, with a low severity rating and no known exploits in the wild at the time of publication. The technical details indicate a moderate threat level (3) and analysis rating (2), suggesting some technical complexity but limited immediate impact. The absence of affected versions and patch links implies that this driver may be a standalone malicious component rather than exploiting a specific vulnerability in a known product. The malware's capability to disable AV software is significant because it undermines endpoint security defenses, potentially allowing further malicious activities such as data exfiltration, lateral movement, or deployment of additional payloads. However, the low severity and lack of widespread exploitation suggest limited deployment or effectiveness. The threat primarily targets Windows 32-bit systems, which remain common in many enterprise environments, though 64-bit systems are increasingly prevalent. Overall, this malware represents a specialized tool aimed at compromising endpoint defenses by disabling antivirus protections through a malicious driver component.

Detailed information about OSINT - Exposing an AV-Disabling Driver Just in Time for Lunch. Get real-time updates, technical details, and mitigation strategies.

OSINT - Exposing an AV-Disabling Driver Just in Time for Lunch - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - GRIZZLY STEPPE â€“ Additional expansion

The provided information pertains to an OSINT (Open Source Intelligence) report titled 'GRIZZLY STEPPE – Additional expansion,' associated with the threat actor known as Sofacy. Sofacy, also known as APT28 or Fancy Bear, is a well-documented advanced persistent threat group linked to Russian state-sponsored cyber espionage activities. The report is categorized as malware-related but lacks specific technical details such as affected software versions, indicators of compromise, or exploit mechanisms. The threat level is indicated as moderate (3 on an unspecified scale), and the severity is marked as low by the source. The absence of known exploits in the wild and lack of patch information suggest this report is more of an intelligence update or expansion on the threat actor's capabilities or infrastructure rather than a newly discovered vulnerability or active malware campaign. Sofacy is known for deploying sophisticated malware families targeting government, military, security organizations, and critical infrastructure, often leveraging spear-phishing and zero-day exploits. This OSINT expansion likely reflects additional insights into Sofacy's malware tools or tactics, but without concrete technical artifacts or exploitation details, the threat is primarily informational at this stage.

Detailed information about OSINT - GRIZZLY STEPPE â€“ Additional expansion. Get real-time updates, technical details, and mitigation strategies.

OSINT - GRIZZLY STEPPE â€“ Additional expansion - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - PROMETHIUM and NEODYMIUM: Parallel zeroday attacks targeting individuals in Europe

The threat described involves two parallel zero-day malware campaigns named PROMETHIUM and NEODYMIUM, targeting individuals in Europe. These campaigns are attributed to distinct threat actor groups identified by Microsoft as PROMETHIUM and NEODYMIUM, both known for conducting sophisticated cyber espionage operations. Zero-day attacks exploit previously unknown vulnerabilities, allowing attackers to compromise systems without prior detection or available patches. The campaigns reportedly run in parallel, indicating coordinated or simultaneous efforts to infiltrate targets. While specific technical details about the malware payloads, infection vectors, or exploited vulnerabilities are not provided, the involvement of these named threat actors suggests advanced persistent threat (APT) tactics, including targeted spear-phishing, custom malware deployment, and stealthy persistence mechanisms. The focus on individuals in Europe implies a targeted approach, possibly aiming at high-value persons such as government officials, diplomats, or corporate executives. The lack of known exploits in the wild and the low severity rating suggest limited spread or impact at the time of reporting, but the zero-day nature means the threat could escalate if vulnerabilities are disclosed or exploited more broadly. The absence of affected product versions and patch links indicates that the vulnerabilities exploited were previously unknown and unpatched at the time. Overall, this threat represents a sophisticated espionage campaign leveraging zero-day vulnerabilities to compromise European targets through malware associated with PROMETHIUM and NEODYMIUM threat groups.

Detailed information about OSINT - PROMETHIUM and NEODYMIUM: Parallel zeroday attacks targeting individuals in Europe. Get real-time updates, technical details,

OSINT - PROMETHIUM and NEODYMIUM: Parallel zeroday attacks targeting individuals in Europe - Live Threat Intelligence - Threat Radar | OffSeq.com

LuminosityLink RAT (Remote Access Trojan) is a type of malware that enables unauthorized remote control over infected systems. Originally identified around 2016, LuminosityLink RAT has been used by threat actors to gain persistent access to victim machines, allowing them to execute arbitrary commands, exfiltrate data, capture keystrokes, and manipulate files. Although the provided information indicates a low severity and no known active exploits in the wild, the nature of RATs inherently poses risks to confidentiality, integrity, and availability of affected systems. LuminosityLink RAT typically spreads through phishing campaigns, malicious downloads, or exploitation of vulnerable software, enabling attackers to stealthily maintain control over compromised endpoints. The malware’s capabilities often include screen capture, webcam access, password theft, and lateral movement within networks, which can facilitate broader compromise. Despite the lack of specific affected versions or patches, the threat remains relevant due to the general prevalence of RATs in cybercrime and espionage activities. The technical details suggest a moderate threat level (3) and analysis rating (2), indicating some recognition of its potential impact but limited active exploitation currently.

Detailed information about OSINT - LuminosityLink RAT. Get real-time updates, technical details, and mitigation strategies.

OSINT - LuminosityLink RAT - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - LuminosityLink RAT

OSINT - The Latest Android Overlay Malware Spreading via SMS Phishing in Europe

The threat described is an Android overlay malware variant that propagates through SMS phishing campaigns targeting users in Europe. Overlay malware on Android devices typically operates by displaying fake user interface elements over legitimate applications, tricking users into entering sensitive information such as credentials, banking details, or two-factor authentication codes. This particular malware spreads via SMS phishing, where victims receive malicious text messages containing links or prompts that lead to the installation of the malware. Once installed, the malware can intercept user inputs and manipulate the device's interface to steal confidential data or perform unauthorized actions. The campaign's focus on Europe suggests a targeted approach, leveraging social engineering via SMS to exploit the widespread use of Android devices. Although the severity is reported as low and no known exploits in the wild are documented, the threat remains relevant due to the persistent risk of overlay attacks on mobile platforms and the potential for financial and data theft. The lack of affected versions and patch links indicates this is a behavioral malware threat rather than a vulnerability in a specific software version. The technical details show a moderate threat level (3) and analysis rating (2), reflecting limited but credible intelligence. Overall, this malware represents a significant risk to mobile users, especially those who may be less vigilant about SMS phishing and app permissions.

Detailed information about OSINT - The Latest Android Overlay Malware Spreading via SMS Phishing in Europe. Get real-time updates, technical details, and mitiga

OSINT - The Latest Android Overlay Malware Spreading via SMS Phishing in Europe - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Mofang: A politically motivated information stealing adversary

The threat identified as 'Mofang' is a politically motivated malware adversary primarily focused on information stealing. This adversary operates with the intent to gather sensitive data, likely targeting entities of political interest. The malware is categorized under malicious code and is associated with open-source intelligence (OSINT) activities, indicating that it may leverage publicly available information or target data that can be used for intelligence purposes. Although specific affected versions or software products are not detailed, the nature of the threat suggests it could be deployed against systems that hold politically sensitive information or are part of governmental, diplomatic, or activist networks. The absence of known exploits in the wild and limited technical details imply that the malware might be either targeted or in limited circulation, but its medium severity rating indicates a credible risk. The threat level and analysis scores of 2 (on an unspecified scale) further support a moderate concern. Given its politically motivated nature, the malware likely aims to compromise confidentiality by exfiltrating data, potentially impacting the integrity of information if used to manipulate or falsify data. The lack of detailed indicators or patch information suggests that detection and mitigation rely heavily on behavioral analysis and threat intelligence sharing.

Detailed information about OSINT - Mofang: A politically motivated information stealing adversary. Get real-time updates, technical details, and mitigation stra

Title	Severity	Type	Source	Date

Threats Tagged 'ecsirt:malicious-code="malware"'

Filter Threats