Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free

The threat involves the Lorenz ransomware group exploiting vulnerabilities related to Mitel MiVoice, a unified communications platform widely used in enterprise telephony. The group reportedly cracked MiVoice systems, enabling them to make unauthorized calls without cost to themselves, indicating a compromise of telephony infrastructure. Lorenz ransomware is known for its sophisticated attack techniques, including exploitation of public-facing applications, deployment of web shells, use of encrypted communication channels, and credential harvesting from LSASS memory. The attack chain involves multiple MITRE ATT&CK techniques such as exploitation of public-facing applications (T1190), use of proxy tools (T1090), execution of PowerShell and Windows command shells (T1059.001, T1059.003), modification of registry keys (T1112), scheduled task creation for persistence (T1053, T1053.005), and discovery of system network configurations and security software (T1016, T1518.001). The ransomware encrypts data for impact (T1486) and may perform system shutdown or reboot to enforce encryption effects (T1529), while also clearing Windows event logs (T1070.001) to cover tracks. The use of chisel tools (both ELF and Windows variants) suggests tunneling or proxying capabilities to maintain covert communication channels. Although no known exploits in the wild are reported, the threat level is assessed as moderate (4 out of 10), with a low severity rating assigned by the source. The attack requires initial access to public-facing applications, which may be facilitated by misconfigurations or unpatched vulnerabilities. The lack of specific affected versions and patch links indicates that this is an open investigation or an intelligence report based on OSINT with moderate certainty (50%).

Detailed information about Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free affecting type osint. Get real-time updates, technical d

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free - Live Threat Intelligence - Threat Radar | OffSeq.com

[TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

The threat involves the Maui ransomware, a malicious software variant attributed to North Korean state-sponsored cyber actors, targeting the Healthcare and Public Health (HPH) sector. Maui ransomware is a type of malware designed to encrypt files on infected systems, rendering data inaccessible until a ransom is paid. This ransomware strain has been linked to nation-state actors, indicating a high level of sophistication and persistence. The targeting of healthcare organizations is particularly concerning due to the critical nature of their operations and the sensitivity of patient data. The attack vector and infection methods are not detailed in the provided information; however, typical ransomware campaigns often leverage phishing emails, exploitation of unpatched vulnerabilities, or compromised remote access services. The lack of known exploits in the wild suggests that Maui ransomware may be deployed through targeted intrusion rather than widespread automated exploitation. The threat level is assessed as high, reflecting the potential disruption and data compromise risks. The attribution to North Korean actors aligns with historical patterns of cyber operations aimed at generating revenue through ransomware while also potentially disrupting critical infrastructure. The absence of specific affected versions or patch links indicates that the ransomware may exploit general security weaknesses rather than specific software vulnerabilities. Overall, Maui ransomware represents a significant threat to healthcare entities, capable of impacting confidentiality, integrity, and availability of critical health data and services.

Detailed information about [TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Secto

[TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

MedusaLocker is a ransomware strain identified as a ransomware-as-a-service (RaaS) threat, which means it is distributed and operated by affiliates who use the malware to extort victims. This ransomware employs multiple attack techniques aligned with MITRE ATT&CK patterns, including exploitation of external remote services (T1133), phishing campaigns (T1566), and execution through PowerShell scripts (T1059.001). MedusaLocker also uses advanced persistence and evasion tactics such as booting the system in safe mode (T1562.009) to inhibit detection and removal. The ransomware encrypts victim data to impact availability (T1486) and actively inhibits system recovery mechanisms (T1490), such as deleting shadow copies or disabling recovery options, to prevent victims from restoring their systems without paying the ransom. Although no specific affected software versions are listed, the malware targets Windows environments given the use of PowerShell and safe mode boot techniques. No known exploits in the wild have been reported, but the threat level is high due to its ransomware nature and the sophistication of its attack vectors. The ransomware is distributed via phishing and exploitation of external remote services, which indicates that initial access can be gained through social engineering or exploiting exposed services such as RDP or VPNs. The lack of a CVSS score requires an independent severity assessment, which is high given the potential for significant confidentiality, integrity, and availability impacts, ease of exploitation through phishing or exposed services, and the broad scope of affected systems. MedusaLocker’s RaaS model increases its threat surface as multiple affiliates can deploy it, increasing the likelihood of attacks.

Detailed information about #StopRansomware: MedusaLocker. Get real-time updates, technical details, and mitigation strategies.

#StopRansomware: MedusaLocker - Live Threat Intelligence - Threat Radar | OffSeq.com

#StopRansomware: MedusaLocker

OSINT - First Node.js-based Ransomware : Nodera

Nodera is identified as the first ransomware strain developed using Node.js, a popular JavaScript runtime environment primarily used for server-side applications. As ransomware, Nodera's primary malicious function is to encrypt victim files and demand a ransom payment for their decryption. The use of Node.js for ransomware is notable because it leverages a cross-platform runtime environment, potentially enabling the malware to operate on multiple operating systems where Node.js is supported, such as Windows, Linux, and macOS. This could increase the attack surface compared to ransomware built for a single platform. However, the available information indicates that Nodera is a relatively low-severity threat with limited analysis and no known exploits in the wild as of the published date (January 2020). The certainty of the threat is moderate (50%), suggesting that while Nodera has been identified and analyzed to some extent, it has not been widely observed or confirmed in active attacks. The technical details show a moderate threat level (3 out of an unspecified scale) and limited analysis depth (2), indicating that Nodera may be more of a proof-of-concept or emerging threat rather than a fully weaponized ransomware strain. The absence of affected versions and patch links further supports that this ransomware is not tied to a specific vulnerable software product but is rather a standalone malware type. Nodera's implementation in Node.js could allow attackers to evade some traditional detection mechanisms that focus on native binaries, but it also requires the presence of the Node.js runtime or bundling it with the malware, which might limit its stealth and propagation capabilities. Overall, Nodera represents an evolution in ransomware development by using modern development frameworks, but its practical impact and prevalence appear limited based on current intelligence.

Detailed information about OSINT - First Node.js-based Ransomware : Nodera. Get real-time updates, technical details, and mitigation strategies.

OSINT - First Node.js-based Ransomware : Nodera - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Iron Cybercrime Group Under The Scope

The Iron Cybercrime Group is identified as a threat actor associated with the deployment of malware tools, notably the 'Iron backdoor'. This group has been linked to various nefarious activities including cryptojacking and ransomware attacks. Cryptojacking involves unauthorized use of victims' computing resources to mine cryptocurrencies, which can degrade system performance and increase operational costs. Ransomware attacks typically involve encrypting victim data and demanding payment for decryption keys, posing significant risks to data availability and integrity. Although the specific malware variants and affected software versions are not detailed, the Iron backdoor tool implies a persistent remote access capability that can facilitate further malicious activities such as data exfiltration, lateral movement, and deployment of additional payloads. The threat level is moderate (level 3), with moderate confidence in the analytic judgment. There are no known exploits in the wild reported at the time of this analysis, and no specific indicators of compromise (IOCs) are provided. The information is sourced from CIRCL and categorized under OSINT with a blog-post origin, indicating open-source intelligence gathering rather than classified or proprietary data. Overall, the Iron Cybercrime Group represents a credible threat actor capable of conducting financially motivated cyberattacks leveraging backdoor malware to compromise systems.

Detailed information about OSINT - Iron Cybercrime Group Under The Scope. Get real-time updates, technical details, and mitigation strategies.

OSINT - Iron Cybercrime Group Under The Scope - Live Threat Intelligence - Threat Radar | OffSeq.com

Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor!

The Kirk ransomware is a malware strain themed around the Star Trek franchise, specifically referencing characters such as Kirk and Spock. This ransomware variant encrypts victims' files and demands payment in Monero, a privacy-focused cryptocurrency, which complicates tracing and attribution efforts. The inclusion of a 'Spock Decryptor' suggests that the malware authors may provide a decryption tool, potentially as a gimmick or to encourage ransom payment. Despite its thematic branding, the ransomware operates by encrypting data and holding it hostage until the ransom is paid. However, the available information indicates that this ransomware has a low severity level, with no known exploits in the wild and no specific affected product versions listed. The threat level and analysis scores are relatively low, suggesting limited sophistication or impact. The lack of detailed technical indicators or exploit mechanisms implies that this ransomware may not be widespread or particularly advanced. Its use of Monero for ransom payments aligns with common ransomware tactics to evade financial tracking. Overall, Kirk ransomware represents a low-level ransomware threat with a unique thematic approach but limited demonstrated impact or sophistication.

Detailed information about Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor!. Get real-time updates, technical details, and mitigation st

Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor! - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Crypt0l0cker (TorrentLocker): Old Dog, New Tricks

Crypt0l0cker, also known as TorrentLocker, is a ransomware family that emerged several years ago and has been observed evolving with new techniques despite its age. Ransomware like Crypt0l0cker typically encrypts victims' files and demands payment, often in cryptocurrencies, to provide the decryption key. This particular malware has been categorized as low severity by the source, but it remains a relevant threat due to its persistence and ability to adapt. TorrentLocker ransomware campaigns have historically targeted users through phishing emails, malicious attachments, or exploit kits, encrypting a wide range of file types to maximize impact. Although no specific affected versions or exploits in the wild are currently documented in this report, the malware's classification as ransomware indicates a direct threat to data confidentiality and availability. The technical details suggest a moderate threat level (3 out of an unspecified scale) and a moderate analysis confidence (2), indicating some uncertainty or limited new intelligence. The absence of patch links or known exploits in the wild suggests that this is an informational report rather than an alert about an active outbreak or zero-day vulnerability. However, the malware's continued presence in OSINT and threat intelligence feeds highlights the importance of awareness and preparedness against ransomware threats that may resurface or be repurposed by threat actors.

Detailed information about OSINT - Crypt0l0cker (TorrentLocker): Old Dog, New Tricks. Get real-time updates, technical details, and mitigation strategies.

OSINT - Crypt0l0cker (TorrentLocker): Old Dog, New Tricks - Live Threat Intelligence - Threat Radar | OffSeq.com

Erebus Ransomware Utilizes a UAC Bypass and Request a $90 Ransom Payment

Erebus ransomware is a type of malicious software that encrypts victims' files and demands a ransom payment for their release. This particular ransomware variant is notable for utilizing a User Account Control (UAC) bypass technique to elevate its privileges on Windows systems without requiring explicit user consent. By circumventing UAC, Erebus can execute with higher privileges, allowing it to encrypt files more effectively and potentially disable security mechanisms. The ransom demanded by Erebus is relatively low, approximately $90, which may be an attempt to increase the likelihood of payment by targeting less security-conscious victims or smaller organizations. Despite its low ransom demand and relatively low severity rating, Erebus ransomware still poses a significant threat as it can disrupt business operations by denying access to critical data. The lack of known exploits in the wild and absence of affected version specifics suggest that this ransomware may have limited propagation or targeting scope. However, the use of UAC bypass techniques indicates a moderate level of sophistication, making it harder to detect and prevent using standard user privilege controls. The technical details provided indicate a moderate threat level (3) and analysis confidence (2), but no CVSS score is available. Overall, Erebus ransomware represents a targeted malware threat that leverages privilege escalation to maximize its impact on infected systems.

Detailed information about Erebus Ransomware Utilizes a UAC Bypass and Request a $90 Ransom Payment. Get real-time updates, technical details, and mitigation st

Erebus Ransomware Utilizes a UAC Bypass and Request a $90 Ransom Payment - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles

The Ransoc Desktop Locking Ransomware is a type of malicious software that primarily targets local files on infected desktops and extends its impact by compromising social media profiles. As a ransomware variant, its main purpose is to deny user access to their data by encrypting or locking local files, thereby demanding a ransom payment for restoration. The ransomware's ability to 'ransack' social media profiles suggests it may also harvest credentials or leverage social media accounts to propagate itself or increase pressure on victims. Despite being identified in 2016 and classified with a low severity level by the source, the ransomware represents a multifaceted threat combining data encryption with potential social engineering or reputational damage through social media exploitation. The absence of known exploits in the wild and lack of affected version specifics indicate it might have had limited spread or impact historically. However, the technical details show a moderate threat level (3) and analysis score (2), implying some recognition of its potential harm. The ransomware's operation likely involves locking local files to disrupt availability and possibly exfiltrating or manipulating social media credentials, which could impact confidentiality and integrity of user accounts. Given the ransomware category, the attack vector is probably via phishing, malicious downloads, or compromised websites, common infection methods for desktop ransomware. The lack of patch information suggests no specific software vulnerability is exploited, but rather it relies on user interaction or social engineering to infect systems.

Detailed information about OSINT - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles. Get real-time updates, technical details, a

OSINT - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Hades Locker Ransomware Mimics Locky

Hades Locker is a ransomware strain identified in 2016 that notably mimics the behavior and appearance of the Locky ransomware. Ransomware is a type of malicious software designed to encrypt victims' files, rendering them inaccessible until a ransom is paid to the attacker. Hades Locker operates by infiltrating a victim's system, encrypting critical data, and then demanding payment for the decryption key. The mimicry of Locky suggests that Hades Locker attempts to leverage the notoriety and fear associated with Locky to increase the likelihood of ransom payment or to obfuscate attribution efforts. Although detailed technical specifics such as infection vectors, encryption algorithms, or propagation methods are not provided in the available information, the classification as ransomware and its low severity rating indicate that while it is a threat, it may not have exhibited widespread impact or advanced evasion techniques at the time of reporting. The absence of known exploits in the wild and lack of affected versions suggest that this ransomware was either newly identified or had limited distribution. The threat level and analysis scores (3 and 2 respectively) imply moderate confidence in the threat's existence but limited technical depth in the analysis. Overall, Hades Locker represents a ransomware threat that European organizations should be aware of, especially given its attempt to imitate a well-known ransomware family, potentially complicating detection and response efforts.

Detailed information about OSINT - Hades Locker Ransomware Mimics Locky. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'enisa:nefarious-activity-abuse="ransomware"'

Filter Threats

Threats Tagged 'enisa:nefarious-activity-abuse="ransomware"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility