Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report details a cyberattack where threat actors gained initial access through a password spray attack on an exposed RDP server. They used Mimikatz and Nirsoft for credential harvesting, and employed living-off-the-land techniques along with tools like Advanced IP Scanner for network discovery. The attackers utilized Rclone for data exfiltration via SFTP and deployed RansomHub ransomware across the network using SMB and remote services. The intrusion lasted six days, culminating in widespread encryption and ransom demands. Key phases included initial access, lateral movement, credential theft, data exfiltration, and ransomware deployment, demonstrating a sophisticated and multi-staged attack methodology.

This threat report describes a sophisticated multi-stage cyberattack leveraging exposed Remote Desktop Protocol (RDP) servers as the initial attack vector. The attackers employed a password spray technique to gain unauthorized access to vulnerable RDP endpoints. Password spraying involves systematically attempting commonly used passwords across many accounts to avoid account lockouts and detection. Once initial access was achieved, the adversaries used credential harvesting tools such as Mimikatz and Nirsoft utilities to extract plaintext credentials and hashes from compromised systems. This credential theft facilitated lateral movement within the network, allowing the attackers to escalate privileges and expand their foothold.

The attackers utilized living-off-the-land (LotL) techniques, leveraging legitimate system tools and utilities to avoid detection. For network discovery, they used Advanced IP Scanner, enabling them to map the internal network and identify additional targets. Data exfiltration was conducted using Rclone, a legitimate cloud storage synchronization tool, configured to transfer stolen data via SFTP to attacker-controlled infrastructure. The final stage involved deploying RansomHub ransomware across the network, using SMB and remote services to propagate and encrypt files on multiple systems. The entire intrusion persisted for six days, culminating in widespread encryption of organizational data and ransom demands.

This attack chain highlights the threat actor’s operational sophistication, combining brute-force initial access, credential theft, stealthy lateral movement, data exfiltration, and ransomware deployment. The use of common administrative tools and legitimate software complicates detection and response efforts. The absence of a CVSS score notwithstanding, the attack demonstrates significant risk due to its multi-vector approach and potential for severe operational disruption.

Detailed information about Hide Your RDP: Password Spray Leads to RansomHub Deployment. Get real-time updates, technical details, and mitigation strategies.

Hide Your RDP: Password Spray Leads to RansomHub Deployment - Live Threat Intelligence - Threat Radar | OffSeq.com

Hide Your RDP: Password Spray Leads to RansomHub Deployment

A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communication, and perform remote administration. They forge file signatures to disguise their toolset and mask malicious activities. The attackers are suspected to be acting as initial access brokers, creating footholds in financial institutions to sell access on darknet markets. Their playbook includes lateral movement techniques such as creating remote services, executing through DCOM, and using PsExec. The threat actor also employs evasion methods like using packers and signing tools with stolen signatures.

Since July 2023, a cybercriminal group identified as CL-CRI-1014 has been conducting targeted attacks against financial institutions across Africa. This threat actor leverages open-source and publicly available tools such as PoshC2, Chisel, and Classroom Spy to build flexible attack frameworks. PoshC2 is a well-known post-exploitation framework used for command and control (C2), Chisel is used to create encrypted tunnels for network communication, and Classroom Spy is a remote administration tool. By combining these tools, the attackers establish persistent footholds within victim networks, enabling remote control and data exfiltration. To evade detection, the attackers forge file signatures, making their malicious tools appear legitimate, and use packers and stolen digital signatures to mask their malware binaries. Their operational playbook includes lateral movement techniques such as creating remote services, executing commands via Distributed Component Object Model (DCOM), and leveraging PsExec for remote code execution. These techniques allow the threat actor to move laterally within compromised networks, escalating privileges and expanding access. The group is suspected to act as initial access brokers, compromising financial organizations and then selling access on darknet markets to other malicious actors. The attack chain involves sophisticated evasion and persistence mechanisms, including the use of scheduled tasks (T1053.005), masquerading (T1036.005), and code injection (T1055). Although no known exploits are currently reported in the wild for specific vulnerabilities, the use of legitimate tools and stolen signatures complicates detection and mitigation efforts. The threat is categorized as medium severity, reflecting the moderate but significant risk posed by these targeted intrusions.

Detailed information about Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector. Get real-time updates, technical details, and mitigation 

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The attackers deploy their custom backdoor, WizardNet, which can load additional modules and gather system information. TheWizards targets individuals, gambling companies, and other entities in several Asian countries and the UAE. The group is linked to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), known for supplying malware to other threat actors. TheWizards' sophisticated toolset and tactics demonstrate their advanced capabilities in compromising networks and evading detection.

TheWizards is a China-aligned advanced persistent threat (APT) group that has developed and deployed a sophisticated lateral movement toolset centered around IPv6 SLAAC (Stateless Address Autoconfiguration) spoofing to conduct adversary-in-the-middle (AiTM) attacks. Their tool, Spellbinder, manipulates the IPv6 network environment by spoofing SLAAC messages, allowing the attackers to intercept and redirect network traffic within compromised environments. This technique enables TheWizards to hijack legitimate network communications, notably redirecting software update requests from Chinese software vendors to attacker-controlled malicious servers. By doing so, they can deliver their custom backdoor, WizardNet, which is capable of loading additional malicious modules and performing extensive system reconnaissance. WizardNet facilitates persistent access and lateral movement within targeted networks. The group’s targets include individuals and gambling companies primarily in Asia and the UAE, indicating a strategic focus on high-value commercial and personal data in these regions. TheWizards are linked to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), a known malware supplier, underscoring their access to advanced malware development resources. Their use of IPv6 SLAAC spoofing is notable because it exploits a relatively less monitored network protocol, allowing stealthy interception of traffic and evasion of traditional detection mechanisms. The attack chain involves network-level manipulation without requiring user interaction, increasing the risk of undetected compromise. TheWizards’ tactics, techniques, and procedures (TTPs) include software update hijacking, process injection, credential dumping, and use of custom malware modules, demonstrating a high level of operational sophistication and adaptability.

Detailed information about TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks. Get real-time updates, technical details, and mi

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned APT group, employs Spellbinder, a lateral movement tool for adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows them to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The group targets individuals, gambling companies, and entities in Southeast Asia, UAE, China, and Hong Kong. Their malware chain includes the WizardNet backdoor and utilizes DNS hijacking to deliver malicious updates. Evidence links TheWizards to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), suggesting it may be a digital quartermaster for this APT group. The attackers use sophisticated tools and techniques to evade detection and maintain persistence on compromised systems.

TheWizards is a China-aligned advanced persistent threat (APT) group that has been observed employing a sophisticated attack technique involving IPv6 SLAAC (Stateless Address Autoconfiguration) spoofing to conduct adversary-in-the-middle (AiTM) attacks. Their toolset includes Spellbinder, which facilitates lateral movement within compromised networks by exploiting IPv6 network configuration protocols. By spoofing SLAAC messages, TheWizards can manipulate network traffic flows, intercepting and redirecting legitimate software update requests—specifically targeting Chinese software updates—to malicious servers under their control. This redirection enables the delivery of malicious payloads disguised as legitimate updates, thereby compromising targeted systems without raising immediate suspicion. The malware chain used by TheWizards includes the WizardNet backdoor, which provides persistent remote access and control over infected hosts. Additionally, the group leverages DNS hijacking techniques to further ensure the delivery of malicious updates and maintain control over network communications. The campaign targets individuals and organizations primarily in Southeast Asia, the UAE, China, and Hong Kong, with a focus on gambling companies among other entities. Attribution evidence links TheWizards to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), suggesting a possible front or digital quartermaster role supporting the group’s operations. The attackers demonstrate advanced operational security and evasion capabilities, making detection and mitigation challenging. This attack vector is notable for exploiting IPv6 network protocols, which are increasingly deployed but often less monitored than IPv4, thereby expanding the attack surface for lateral movement and network traffic interception.

Title	Severity	Type	Source	Date

Threats Tagged 'lateral movement'

Filter Threats

Threats Tagged 'lateral movement'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility