Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

Marqueurs issus d'un blog post présentant un maliciel destructeur, IsaacWiper, ainsi qu'un mécanisme de propagation utilisé par HermeticWiper utilisant notamment du WMI et du SMB.

The threat described involves two malicious components: IsaacWiper, a destructive wiper malware, and HermeticWizard, a worm-like propagation mechanism. IsaacWiper is designed to irreversibly delete data on infected systems, causing significant damage to the confidentiality, integrity, and availability of data. HermeticWizard facilitates the spread of this destructive payload across networks by leveraging Windows Management Instrumentation (WMI) and Server Message Block (SMB) protocols. These propagation techniques allow the malware to move laterally within a network, exploiting administrative privileges and network shares to infect multiple systems rapidly. The use of WMI and SMB indicates a focus on Windows environments, particularly those with enabled remote management and file sharing capabilities. The malware was notably observed targeting Ukraine, suggesting a geopolitical motivation behind the attack. No patches or known exploits are currently available, and the threat level is assessed as medium by the source. The lack of CVSS scoring and limited technical details restrict a full vulnerability assessment, but the destructive nature of the wiper combined with worm-like propagation mechanisms indicates a significant risk to affected environments. The malware's ability to propagate without requiring user interaction, relying instead on network protocols and administrative access, increases its potential impact and speed of infection.

Detailed information about [ESET] IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine. Get real-time updates, technical details, and mitigation 

[ESET] IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

[ESET] IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine

Résultats de l'investigation sur l'infrastructure d'attaque de TA505

The provided information pertains to an investigation into the attack infrastructure used by the cybercriminal group TA505, as reported by CERT-FR and sourced from CIRCL. TA505 is a well-known financially motivated threat actor group recognized for deploying large-scale spam campaigns and distributing various malware families, including banking trojans, ransomware, and remote access trojans. The report focuses on the infrastructure supporting TA505's operations rather than a specific vulnerability or exploit. The investigation likely includes analysis of command and control (C2) servers, malware distribution points, and associated network activity used by TA505 to conduct their campaigns. Although no specific affected products or versions are identified, the threat actor's infrastructure is critical in enabling their attacks, which typically target financial institutions, retail, and other sectors globally. The report is classified as medium severity, with a threat level and analysis rating of 2 (on an unspecified scale), and no known exploits or patches are associated since this is an infrastructure-focused intelligence report rather than a vulnerability disclosure. The confidence in the data is moderate, with a 50% certainty indicated. The report is based on open-source intelligence (OSINT) with good reliability and is shared under a white traffic light protocol (TLP), meaning it is intended for broad distribution. The mention of FIN11 alongside TA505 suggests possible overlaps or related activity between these financially motivated groups. Overall, this intelligence highlights the ongoing monitoring and disruption efforts against TA505's infrastructure to mitigate their cybercrime campaigns.

Metasploit C2 server potentially linked to TA505 activity [2019-07-31:2019-07-31]

CobaltStrike C2 server potentially linked to TA505 activity [2019-07-17:2019-08-06]

CobaltStrike C2 server potentially linked to TA505 activity [2020-09-20:2021-02-04]

Metasploit C2 server potentially linked to TA505 activity [2019-09-23:2019-10-01]

Metasploit C2 server linked to TA505 activity [2020-03-06:2020-12-20]

Metasploit C2 server potentially linked to TA505 activity [2020-03-11:2020-11-13], CobaltStrike C2 server potentially linked to TA505 activity [2020-03-13:2020-11-08]

CobaltStrike C2 server potentially linked to TA505 activity [2020-11-23:2020-11-26]

Metasploit C2 server potentially linked to TA505 activity [2020-03-09:2020-05-16]

Metasploit C2 server potentially linked to TA505 activity [2020-04-12:2020-09-05]

Metasploit C2 server potentially linked to TA505 activity [2020-03-10:2020-12-22], CobaltStrike C2 server potentially linked to TA505 activity [2020-10-07:2020-10-07]

CobaltStrike C2 server potentially linked to TA505 activity [2020-05-08:2020-05-08]

CobaltStrike C2 server potentially linked to TA505 activity [2020-08-22:2021-01-31]

CobaltStrike C2 server potentially linked to TA505 activity [2020-07-28:2020-08-06]

Metasploit C2 server potentially linked to TA505 activity [2020-10-09:2021-01-15]

Metasploit C2 server potentially linked to TA505 activity [2020-11-05:2020-11-27]

Metasploit C2 server potentially linked to TA505 activity [2021-01-06:2021-01-14]

CobaltStrike C2 server potentially linked to TA505 activity [2020-08-19:2020-09-10], Metasploit C2 server potentially linked to TA505 activity [2020-03-21:2020-03-21]

Metasploit C2 server linked to TA505 activity [2020-06-03:2020-12-16]

Metasploit C2 server potentially linked to TA505 activity [2020-03-21:2020-12-18]

CobaltStrike C2 server potentially linked to TA505 activity [2020-10-06:2021-01-09]

CobaltStrike C2 server potentially linked to TA505 activity [2020-10-25:2021-01-30]

Metasploit C2 server potentially linked to TA505 activity [2019-10-07:2020-02-01]

Metasploit C2 server potentially linked to TA505 activity [2019-08-14:2019-10-15]

Metasploit C2 server linked to TA505 activity [2019-09-11:2020-02-07]

Metasploit C2 server potentially linked to TA505 activity [2019-10-04:2019-10-24]

Metasploit C2 server linked to TA505 activity [2019-12-19:2020-02-05]

Metasploit C2 server potentially linked to TA505 activity [2019-08-10:2019-11-03]

Metasploit C2 server linked to TA505 activity [2019-07-31:2020-02-03]

Metasploit C2 server potentially linked to TA505 activity [2019-09-03:2019-10-30]

Metasploit C2 server potentially linked to TA505 activity [2019-08-04:2020-01-10]

Metasploit C2 server potentially linked to TA505 activity [2020-01-29:2020-02-25]

Metasploit C2 server linked to TA505 activity [2019-11-13:2020-01-15], CobaltStrike C2 server potentially linked to TA505 activity [2019-12-21:2020-01-23]

Detailed information about [CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505. Get real-time updates, technical details, and mitigation strategies

[CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505 - Live Threat Intelligence - Threat Radar | OffSeq.com

[CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505

The threat identified as "Cyclops blink" is attributed to multiple advanced persistent threat (APT) groups, including Sandworm, Iridium, Telebots, and Electrum, all of which are known for their sophisticated cyber operations primarily linked to Russian state-sponsored activities. The designation of "Cyclops blink" as a threat actor rather than a specific vulnerability or malware suggests it represents a coordinated campaign or a set of tactics, techniques, and procedures (TTPs) employed by these groups. The lack of affected versions or specific product targets indicates that this threat is not tied to a particular software vulnerability but rather involves network activity consistent with espionage, sabotage, or disruption objectives. The threat level is rated as 4 on an unspecified scale, and the overall severity is medium. No patches or known exploits in the wild are reported, implying that this threat may rely on custom tools or zero-day exploits not publicly disclosed. The involvement of multiple threat actors known for targeting critical infrastructure, government, and private sector entities suggests that Cyclops blink may involve sophisticated network intrusion, lateral movement, and possibly the deployment of backdoors or botnets. The absence of technical details such as indicators of compromise (IOCs) or specific attack vectors limits the granularity of the analysis but confirms the threat's relevance to network security monitoring and incident response efforts.

Detailed information about [NCSC-UK] Cyclops blink. Get real-time updates, technical details, and mitigation strategies.

[NCSC-UK] Cyclops blink - Live Threat Intelligence - Threat Radar | OffSeq.com

[NCSC-UK] Cyclops blink

[CERT-FR] Campagnes d'hameçonnage du mode opératoire d'attaquants Nobelium

The provided information concerns phishing campaigns attributed to the threat actor group Nobelium, as reported by CERT-FR and sourced from CIRCL. Nobelium is a well-known advanced persistent threat (APT) group linked to sophisticated cyber espionage operations, notably the SolarWinds supply chain attack. The campaigns involve phishing as the primary attack vector, aiming to deceive targets into divulging sensitive information or delivering malware. Although specific technical details are limited in the provided data, the mention of phishing campaigns suggests the use of social engineering techniques such as spear-phishing emails crafted to mimic legitimate communications, potentially leveraging credential harvesting or malware delivery. The threat level is indicated as 4 (on an unspecified scale), and the severity is marked as low, with no known exploits in the wild at the time of reporting. The absence of affected versions or specific vulnerabilities implies that the threat is operational rather than a software vulnerability. The classification tags indicate good reliability of the information and a white traffic light protocol (TLP) classification, meaning the information is cleared for wide distribution. Overall, this threat represents a targeted phishing operation by a sophisticated actor, focusing on social engineering rather than exploiting software flaws.

Detailed information about [CERT-FR] Campagnes d'hameçonnage du mode opératoire d'attaquants Nobelium. Get real-time updates, technical details, and mitigation 

[CERT-FR] Campagnes d'hameçonnage du mode opératoire d'attaquants Nobelium - Live Threat Intelligence - Threat Radar | OffSeq.com

The reported threat involves a campaign by the Sandworm intrusion set targeting Centreon systems, as identified by CERT-FR and CIRCL. Sandworm is a well-known advanced persistent threat (APT) group associated with sophisticated cyber espionage and sabotage activities. Centreon is an IT infrastructure monitoring software widely used in enterprise environments, including Linux-based systems. The campaign exploits public-facing applications (MITRE ATT&CK T1190), likely leveraging vulnerabilities or misconfigurations in Centreon's web interface to gain initial access. Post-compromise activities include deploying web shells (T1505.003) for persistent remote control, performing file and directory discovery (T1083) to map the environment, and creating or modifying system processes or Windows services (T1543, T1543.003) to maintain persistence and escalate privileges. The attackers use symmetric and asymmetric cryptography (T1573.001, T1573.002) and encrypted channels (T1573) to secure command and control communications, complicating detection and analysis. Data exfiltration is conducted over these encrypted C2 channels (T1041). The threat targets Linux systems predominantly in Western Europe, with high confidence in the indicators of compromise (IOCs) accuracy. Although the severity is classified as low by CERT-FR, the involvement of a high-profile APT group and the use of advanced techniques indicate a targeted espionage campaign rather than widespread destructive attacks. No known exploits in the wild or patches are currently documented, suggesting either a zero-day or exploitation of configuration weaknesses. The campaign aligns with historical Sandworm tactics, including stealthy infiltration and long-term presence in victim networks.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems affecting fr-classif non-classifiees. Get real-time updates, tec

Title	Severity	Type	Source	Date

Threats Tagged 'fr-classif:non-classifiees="non-classifiees"'

Filter Threats