Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious Excel file using steganography was analyzed, revealing embedded XLS sheets and a complex infection chain. The file downloads an HTA file that creates a BAT file, which in turn generates and executes a VBS file. The VBS file fetches a VBA script that creates and runs a PowerShell script. The PowerShell script downloads an image containing a hidden payload delimited by specific tags. The payload is a Base64-encoded PE file, which is decoded and executed as a DLL. The final payload appears to be a Katz stealer. This analysis highlights the use of multiple file types and steganography techniques to evade detection.

The analyzed threat involves a sophisticated multi-stage malware infection chain initiated by a malicious Microsoft Excel file employing steganography to embed hidden XLS sheets. Upon opening, the Excel file triggers a download of an HTA (HTML Application) file from a remote server. This HTA file executes a BAT (batch) script, which subsequently generates and runs a VBS (Visual Basic Script) file. The VBS script fetches a VBA (Visual Basic for Applications) script that creates and executes a PowerShell script. The PowerShell script downloads an image file containing a hidden payload embedded using steganography, delimited by specific tags to isolate the malicious content. This payload is a Base64-encoded Portable Executable (PE) file, decoded and executed as a DLL (Dynamic Link Library) in memory. The final payload is identified as a Katz stealer, a known credential theft malware that targets stored passwords and authentication tokens. The infection chain leverages multiple scripting languages and file formats (Excel, HTA, BAT, VBS, VBA, PowerShell) and uses steganography to evade traditional signature-based detection mechanisms. The use of living-off-the-land binaries and scripts (LOLBins) such as PowerShell and VBS, combined with steganographic payload delivery, complicates detection and analysis. The attack techniques correspond to MITRE ATT&CK tactics and techniques including command and scripting interpreter (T1059 variants), user execution (T1204.002), steganography (T1140), process injection (T1055), and persistence (T1547.001). Indicators of compromise include multiple file hashes and a known malicious URL hosting the HTA file. No known exploits in the wild or specific threat actors are currently attributed to this campaign, but the complexity and stealthy nature suggest a targeted or financially motivated operation aiming to steal credentials for further exploitation.

Detailed information about More Steganography!. Get real-time updates, technical details, and mitigation strategies.

More Steganography! - Live Threat Intelligence - Threat Radar | OffSeq.com

More Steganography!

Threats Tagged 'excel'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'excel'

Lead Pen Test Professional