Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In April 2019, we discovered new malware that compromises encrypted web communications in an impressive way. Analysis of the malware allowed us to confirm that the operators have some control over the target’s network channel and could replace legitimate installers with infected ones on the fly. That places the actor in a very exclusive club, with capabilities that few other actors in the world have.

We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers.

The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.

The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.

We registered two initial infection schemes: Reductor spreads by either infecting popular software distributions (Internet Downloader Manager, WinRAR, etc. and, for at least one victim, through a popular warez website over HTTP); or its decryptor/dropper is spread using COMpfun’s ability to download files on already infected hosts.

The Reductor malware, identified as a successor to the COMpfun Trojan, represents a sophisticated threat primarily targeting encrypted web communications by compromising TLS traffic. Discovered in April 2019, Reductor is notable for its advanced capabilities that allow operators to exert control over the target's network channel. This control enables the attackers to perform man-in-the-middle style manipulations, such as replacing legitimate software installers with infected versions in real time. The malware includes typical Remote Access Trojan (RAT) functionalities, such as uploading, downloading, and executing files on compromised systems. However, its distinguishing feature lies in its manipulation of digital certificates and the marking of outbound TLS traffic with unique host-related identifiers, which could facilitate persistent tracking and targeted interception of encrypted communications.

Technical analysis reveals strong code similarities between Reductor and the earlier COMpfun Trojan, which was first documented in 2014 and tentatively attributed to the Turla Advanced Persistent Threat (APT) group based on victimology. Reductor appears to be distributed through two primary infection vectors: first, by infecting popular software distributions such as Internet Downloader Manager and WinRAR, including distribution via a popular warez website over unencrypted HTTP; second, by leveraging COMpfun's downloader capabilities on already infected hosts to deploy Reductor's decryptor/dropper modules. This multi-stage infection approach indicates a well-resourced and persistent actor with the ability to compromise supply chains and exploit existing footholds.

The campaign using Reductor has been active since at least April 2019, with confirmed targets in Russia and Belarus. The malware's ability to compromise TLS traffic is particularly concerning because it undermines the confidentiality and integrity of encrypted communications, which are generally trusted as secure. The lack of available patches and absence of known exploits in the wild suggest that the threat relies on targeted infection methods rather than widespread exploitation of software vulnerabilities.

Overall, Reductor exemplifies a high level of operational sophistication, combining supply chain compromise, advanced network manipulation, and stealthy RAT capabilities to maintain persistence and exfiltrate sensitive information from high-value targets.

Detailed information about COMpfun successor Reductor: compromise TLS traffic. Get real-time updates, technical details, and mitigation strategies.

COMpfun successor Reductor: compromise TLS traffic - Live Threat Intelligence - Threat Radar | OffSeq.com

COMpfun successor Reductor: compromise TLS traffic

OSINT - DearCry ransomware (abusing Exchange Server)

The DearCry ransomware campaign targets Microsoft Exchange Server environments by exploiting vulnerabilities to deploy ransomware that encrypts data for impact. This campaign was publicly identified around March 2021 and is associated with post-exploitation activities following initial compromise of Exchange Servers. DearCry ransomware encrypts files on compromised systems, rendering data inaccessible and causing significant operational disruption. The attack leverages weaknesses in Exchange Server configurations or unpatched vulnerabilities to gain unauthorized access, then executes ransomware payloads to encrypt critical data. The campaign is characterized by data destruction and encryption tactics aligned with MITRE ATT&CK techniques T1485 (Data Destruction) and T1486 (Data Encrypted for Impact). Although no specific affected Exchange Server versions are listed, the threat is linked to Exchange Server exploitation, implying that unpatched or misconfigured Exchange environments are at risk. The campaign is assessed with high confidence and likelihood, indicating active or imminent threats to vulnerable systems. No known exploits in the wild were reported at the time of publication, but the threat remains relevant due to the widespread use of Exchange Servers and the persistent nature of ransomware campaigns targeting enterprise email infrastructure.

Detailed information about OSINT - DearCry ransomware (abusing Exchange Server). Get real-time updates, technical details, and mitigation strategies.

OSINT - DearCry ransomware (abusing Exchange Server) - Live Threat Intelligence - Threat Radar | OffSeq.com

Gamaredon Group (common notes from McAfee and other sources)

The Gamaredon Group is a known cyber threat actor primarily associated with persistent cyber espionage campaigns targeting Ukrainian entities. This group is recognized for its long-term, ongoing operations, often leveraging spear-phishing emails and custom malware to infiltrate targeted networks. The campaign referenced here is a collection of common notes from multiple sources including McAfee and CIRCL, indicating a moderate confidence in the analytic judgment and a very likely probability of continued activity. While specific technical details or exploits are not provided in this dataset, the Gamaredon Group typically employs tactics such as credential harvesting, backdoor deployment, and lateral movement within compromised networks. Their operations are characterized by low to moderate threat levels, focusing on information gathering rather than destructive attacks. The absence of known exploits in the wild and the low severity rating suggest that while the group remains active, their current campaigns may not pose an immediate high-impact threat but should be monitored due to their persistence and targeting of strategic geopolitical interests.

Detailed information about Gamaredon Group (common notes from McAfee and other sources). Get real-time updates, technical details, and mitigation strategies.

Gamaredon Group (common notes from McAfee and other sources) - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat described involves a campaign utilizing the malware known as revengeRAT, which is a Remote Access Trojan (RAT) designed to provide attackers with persistent unauthorized access to compromised systems. The campaign is specifically targeting France, as indicated by the OSINT (Open Source Intelligence) information. revengeRAT is typically distributed via spearphishing links (MITRE ATT&CK technique T1192), where victims receive targeted emails containing malicious links that, when clicked, download and execute the RAT payload. Once installed, revengeRAT can enable attackers to perform a variety of malicious activities including data exfiltration, system reconnaissance, credential theft, and potentially lateral movement within a network. The campaign is characterized by a low severity rating and moderate confidence in the analytic judgment, with a 50% certainty level. There are no known exploits in the wild associated with this campaign, and no specific affected software versions are listed. The threat level is moderate (3 on an unspecified scale), and the attack vector relies on social engineering through spearphishing, which requires user interaction. The campaign appears to be ongoing or perpetual in nature, as indicated by the OSINT lifetime tag. The lack of detailed technical indicators or patches suggests that the campaign is primarily identified through behavioral patterns and open-source intelligence rather than specific vulnerabilities in software products.

Detailed information about OSINT - revengeRAT targeting France. Get real-time updates, technical details, and mitigation strategies.

OSINT - revengeRAT targeting France - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - revengeRAT targeting France

The provided information pertains to OSINT (Open Source Intelligence) data related to Hancitor domains. Hancitor, also known as Chanitor or Tordal, is a known malware downloader and loader primarily used to distribute other malware families such as ransomware and banking Trojans. The data indicates a collection or listing of domains associated with Hancitor activity, which can be used for threat intelligence and detection purposes. However, the information is categorized as 'unknown' type with low severity and moderate confidence, suggesting that this is an intelligence report rather than a direct vulnerability or active exploit. The absence of affected versions, patch links, or known exploits in the wild further supports that this is an informational resource rather than a direct technical threat. The threat level is marked as 3 (on an unspecified scale), and the certainty of the analytic judgment is moderate, indicating that while the domains are likely linked to Hancitor campaigns, definitive attribution or impact details are limited. The report is tagged with 'tlp:white', meaning it is intended for public sharing and awareness. Overall, this OSINT data serves as a resource for security teams to identify and block malicious infrastructure related to Hancitor malware campaigns but does not describe a new vulnerability or exploit vector by itself.

Detailed information about OSINT - Hancitor domains. Get real-time updates, technical details, and mitigation strategies.

OSINT - Hancitor domains - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Hancitor domains

OSINT - New traces of Hacking Team in the wild

The provided information references new traces of the Hacking Team in the wild, as reported by CIRCL (Computer Incident Response Center Luxembourg). Hacking Team is a well-known Italian company that developed offensive intrusion and surveillance software, often used by law enforcement and intelligence agencies. The mention of "new traces" suggests that indicators or artifacts related to Hacking Team's tools or infrastructure have been detected in operational environments, potentially indicating ongoing or renewed activity by actors using or linked to Hacking Team's capabilities. However, the details are sparse: no specific affected products or versions are identified, no technical indicators are provided, and no known exploits in the wild are confirmed. The threat level and analysis scores are moderate (both 2), and the severity is marked as medium. The lack of detailed technical data or confirmed exploitation suggests this is an intelligence report highlighting the probable presence or use of Hacking Team tools rather than a direct vulnerability or active exploit campaign. The term "OSINT" (Open Source Intelligence) indicates that the information was gathered from publicly available sources, which may include network traffic, malware samples, or other forensic evidence. Overall, this points to a medium-level threat scenario involving surveillance or intrusion capabilities associated with Hacking Team, with a likelihood assessed as very likely but without concrete evidence of active exploitation or impact at the time of reporting.

Detailed information about OSINT - New traces of Hacking Team in the wild. Get real-time updates, technical details, and mitigation strategies.

OSINT - New traces of Hacking Team in the wild - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups

Operation Honeybee is a malicious document campaign uncovered by McAfee that specifically targets humanitarian aid groups. The campaign involves the use of malicious documents designed to infiltrate targeted organizations by exploiting common attack vectors such as code signing abuse, scripting, and command-line interface execution. The attackers employ techniques including service modification, execution of malicious code via rundll32, and bypassing User Account Control (UAC) to escalate privileges and maintain persistence. The campaign also involves discovery activities such as system information and process discovery, which help attackers understand the environment and tailor their actions. Data exfiltration is automated, and the attackers encrypt data to evade detection and hinder forensic analysis. The campaign leverages obfuscation and deobfuscation techniques to conceal malicious payloads within documents, making detection more difficult. Although no known exploits are reported in the wild, the campaign's sophistication and targeted nature indicate a focused threat against organizations involved in humanitarian aid, which often handle sensitive information and operate in complex environments. The threat level is assessed as low based on available information, but the campaign's tactics align with advanced persistent threat (APT) behaviors, emphasizing the need for vigilance.

Detailed information about OSINT - McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Get real-time updates, t

OSINT - McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Alert (TA17-117A) Intrusions Affecting Multiple Victims Across Multiple Sectors

The alert titled 'OSINT - Alert (TA17-117A) Intrusions Affecting Multiple Victims Across Multiple Sectors' references a set of intrusions attributed to a threat actor or campaign identified as TA17-117A. The alert is based on Open Source Intelligence (OSINT) and highlights the use of known malware tools such as PlugX and RedLeaves, which are commonly associated with advanced persistent threat (APT) groups. PlugX is a remote access Trojan (RAT) known for its modular architecture, allowing attackers to execute arbitrary code, steal data, and maintain persistence on compromised systems. RedLeaves is another malware family used for espionage and data exfiltration. The alert indicates that multiple victims across various sectors have been targeted, suggesting a broad and possibly opportunistic campaign. However, the alert lacks detailed technical indicators such as specific vulnerabilities exploited, attack vectors, or indicators of compromise (IOCs). There are no known exploits in the wild linked to this alert, and no patches or version-specific information is provided. The threat level is rated low, and the source reliability and information credibility are moderate to high. The alert's date is from 2017, which may affect the current relevance of the threat. Overall, this alert signals ongoing intrusion activity by a threat actor using sophisticated malware tools to compromise multiple sectors, but with limited technical details and no immediate exploit information.

Detailed information about OSINT - Alert (TA17-117A) Intrusions Affecting Multiple Victims Across Multiple Sectors. Get real-time updates, technical details, an

OSINT - Alert (TA17-117A) Intrusions Affecting Multiple Victims Across Multiple Sectors - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Doctor Web detects several thousand infected Linux devices  Linux.Proxy.10

The threat identified as Linux.Proxy.10 is a malware campaign detected by Doctor Web that has infected several thousand Linux devices. This malware operates primarily as a proxy, leveraging compromised Linux systems to relay malicious traffic or anonymize attacker activities. The infection of Linux devices suggests that the malware targets systems running Linux operating systems, which are commonly used in servers, embedded devices, and network infrastructure. The malware's presence on these devices can facilitate unauthorized network traffic routing, potentially enabling attackers to conduct further malicious activities such as distributed denial-of-service (DDoS) attacks, data exfiltration, or concealment of command and control communications. Although the severity is reported as low and no known exploits are currently active in the wild, the widespread infection scale indicates a persistent threat that could be leveraged for larger-scale attacks. The lack of specific affected versions or patch links suggests that the malware exploits general vulnerabilities or weak configurations rather than a particular software flaw. The technical details indicate a moderate threat level (3) and analysis score (2), reflecting a recognized but not critical risk. Given the malware's Linux platform focus, it likely targets devices with network exposure and insufficient security hardening, such as IoT devices, routers, or poorly maintained servers.

Detailed information about OSINT - Doctor Web detects several thousand infected Linux devices  Linux.Proxy.10. Get real-time updates, technical details, and mit

OSINT - Doctor Web detects several thousand infected Linux devices  Linux.Proxy.10 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - EITest Nabbing Chrome Users with a â€œChrome Fontâ€ Social Engineering Scheme

The reported threat involves a social engineering scheme targeting users of the Google Chrome browser, referred to as the "Chrome Font" scam, associated with the EITest campaign. EITest is known for distributing malicious content through compromised websites and malvertising. In this particular scheme, attackers attempt to deceive Chrome users by presenting a fake prompt or notification related to fonts in the Chrome browser, likely to trick users into downloading malicious files or granting permissions that compromise their security. The attack leverages social engineering tactics rather than exploiting a technical vulnerability in Chrome itself. The lack of specific affected versions or technical exploit details suggests the threat relies primarily on user deception rather than software flaws. The threat level is assessed as low, with no known exploits in the wild at the time of reporting, and the attack requires user interaction to be successful. This type of attack is typical in phishing and drive-by download campaigns, where users are manipulated into executing malicious payloads under the guise of legitimate browser functionality.

Detailed information about OSINT - EITest Nabbing Chrome Users with a â€œChrome Fontâ€ Social Engineering Scheme. Get real-time updates, technical details, and

Title	Severity	Type	Source	Date

Threats Tagged 'estimative-language:likelihood-probability="very-likely"'

Filter Threats

Threats Tagged 'estimative-language:likelihood-probability="very-likely"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility