Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Check Point Research

Kaspersky Security Blog

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Insikt Group uncovered new infrastructure linked to GrayAlpha, a threat actor associated with FIN7. They identified a custom PowerShell loader named PowerNet that deploys NetSupport RAT, and another loader called MaskBat. Three main infection vectors were discovered: fake browser updates, fake 7-Zip download sites, and the TAG-124 traffic distribution system. While all three methods were used simultaneously, only the fake 7-Zip sites remained active at the time of writing. The analysis also led to the identification of a potential individual involved in GrayAlpha operations. The group's sophisticated tactics highlight the need for comprehensive security measures, including application allow-listing, employee training, and advanced detection techniques.

The threat described involves a newly uncovered infrastructure linked to GrayAlpha, a threat actor associated with the financially motivated cybercrime group FIN7. The key technical components include a custom PowerShell loader named PowerNet, which is used to deploy the NetSupport Remote Access Trojan (RAT), and another loader called MaskBat. These loaders facilitate the covert installation and execution of malicious payloads on victim systems. The attackers employ three primary infection vectors: fake browser updates, fake 7-Zip download sites, and the TAG-124 traffic distribution system. These vectors are designed to socially engineer victims into executing malicious code by masquerading as legitimate software updates or downloads. At the time of analysis, only the fake 7-Zip download sites remained active, indicating a possible shift in attacker tactics or operational focus.

The PowerNet loader leverages PowerShell, a legitimate Windows scripting environment, to evade detection and execute payloads in-memory, complicating traditional signature-based defenses. The NetSupport RAT deployed by PowerNet provides attackers with extensive remote control capabilities, including data exfiltration, credential theft, and lateral movement within networks. MaskBat likely serves as an additional loader or persistence mechanism, although specific technical details are limited. The use of multiple infection vectors and loaders demonstrates the adversary's sophistication and adaptability.

The TAG-124 traffic distribution system is a known infrastructure component used to manage and distribute malicious traffic, further indicating a well-resourced and organized campaign. The threat actor employs various MITRE ATT&CK techniques such as T1218.011 (signed binary proxy execution), T1204.002 (user execution via malicious file), T1583.001 (establishing infrastructure), T1055 (process injection), T1059.001 and T1059.003 (PowerShell and command-line interface), T1547.001 (registry run keys for persistence), T1102.002 (web service communication), T1071.001 (application layer protocol), T1204.001 (user execution via malicious link), T1569.002 (service execution), and T1584.001 (compromise infrastructure). This indicates a multi-faceted attack chain involving social engineering, code execution, persistence, and command and control.

The identification of a potential individual involved in GrayAlpha operations suggests ongoing intelligence efforts to attribute and disrupt this threat actor. Overall, this campaign highlights the need for layered security controls, including behavioral detection, application allow-listing, and continuous user awareness training to mitigate the risk posed by such advanced threats.

Detailed information about New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks. Get real-time updates, technical details, and mitigation st

New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

Threats Tagged 'fin7'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'fin7'

Lead Pen Test Professional