Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Potential abuse by Lazarus group using LinkedIn to spread malware

This threat intelligence report highlights a potential abuse campaign by the Lazarus Group, a well-known North Korean state-sponsored threat actor, leveraging LinkedIn as a vector to spread malware. The malware identified in this context is the remote access trojan (RAT) known as 'NukeSped.' The Lazarus Group has a history of targeting various sectors globally, including employment and professional networking platforms, to conduct espionage, data theft, and financial crimes. The use of LinkedIn suggests a social engineering approach, where attackers may create fake profiles or compromise legitimate accounts to connect with targets, subsequently delivering malicious payloads through links or attachments. The campaign is characterized by low confidence in analytic judgment (50%) and no confirmed exploits in the wild, indicating that this is an observed potential threat rather than a confirmed widespread attack. No specific affected software versions or patches are available, which aligns with the nature of social engineering and malware delivery via a third-party platform rather than exploiting a software vulnerability. The threat is tagged with TLP:WHITE and TLP:CLEAR, indicating that the information is intended for broad sharing and transparency. Overall, this represents a high-severity threat due to the reputation of the Lazarus Group and the potential impact of the NukeSped RAT if successfully deployed through a trusted professional network like LinkedIn.

Detailed information about OSINT - Potential abuse by Lazarus group using LinkedIn to spread malware. Get real-time updates, technical details, and mitigation s

OSINT - Potential abuse by Lazarus group using LinkedIn to spread malware - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat involves the Lazarus group, a well-known advanced persistent threat (APT) actor with a history of cyber espionage, financial crime, and destructive cyberattacks. According to open-source intelligence (OSINT) reported by CIRCL, there is potential abuse of LinkedIn by the Lazarus group to spread malware, specifically leveraging the social networking platform's employment sector focus. The malware associated with this campaign is linked to the 'NukeSped' remote access trojan (RAT), which is capable of providing attackers with persistent access to compromised systems, enabling data exfiltration, lateral movement, and further payload deployment. The attack vector likely involves social engineering tactics such as malicious LinkedIn messages, connection requests, or job offers that entice targets to execute malware-laden attachments or links. Given LinkedIn's professional context, targets are probably employees in sensitive roles or industries, increasing the potential impact. The reported confidence in this analytic judgment is low (50%), and no active exploits have been confirmed in the wild, but the threat level is assessed as high due to the actor's capabilities and historical targeting patterns. The lack of specific affected software versions or technical indicators suggests this is an emerging or ongoing campaign rather than a vulnerability-based exploit. The threat leverages social engineering rather than technical vulnerabilities, making it harder to detect and prevent without user awareness and behavioral monitoring.

OSINT - Poison Ivy Group and the Cyberespionage Campaign Against Chinese Military and Goverment

The provided information describes an OSINT report concerning the Poison Ivy Group and their cyberespionage campaign targeting the Chinese military and government entities. Poison Ivy is a well-known Remote Access Trojan (RAT) historically used by various threat actors for espionage and data exfiltration. This campaign appears to focus on intelligence gathering against high-value targets within China, leveraging Poison Ivy's capabilities to maintain persistent access, execute remote commands, and steal sensitive information. The report is based on open-source intelligence (OSINT) and is tagged with low confidence in analytic judgment, indicating limited or inconclusive evidence about the campaign's scope or effectiveness. No specific affected versions, vulnerabilities, or exploits are mentioned, and no active exploitation in the wild is reported. The threat level is rated low, and the campaign's technical details are sparse, suggesting this is more of an informational disclosure rather than an active, widespread threat. The absence of indicators of compromise (IOCs) and patch links further limits actionable technical insights. Overall, this report highlights the continued use of Poison Ivy RAT in targeted espionage against Chinese governmental bodies but does not provide detailed technical or operational data to assess immediate risk or exploitation vectors.

Detailed information about OSINT - Poison Ivy Group and the Cyberespionage Campaign Against Chinese Military and Goverment. Get real-time updates, technical det

Title	Severity	Type	Source	Date

Threats Tagged 'estimative-language:confidence-in-analytic-judgment="low"'

Filter Threats