Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free

The threat involves the Lorenz ransomware group exploiting vulnerabilities related to Mitel MiVoice, a unified communications platform widely used in enterprise telephony. The group reportedly cracked MiVoice systems, enabling them to make unauthorized calls without cost to themselves, indicating a compromise of telephony infrastructure. Lorenz ransomware is known for its sophisticated attack techniques, including exploitation of public-facing applications, deployment of web shells, use of encrypted communication channels, and credential harvesting from LSASS memory. The attack chain involves multiple MITRE ATT&CK techniques such as exploitation of public-facing applications (T1190), use of proxy tools (T1090), execution of PowerShell and Windows command shells (T1059.001, T1059.003), modification of registry keys (T1112), scheduled task creation for persistence (T1053, T1053.005), and discovery of system network configurations and security software (T1016, T1518.001). The ransomware encrypts data for impact (T1486) and may perform system shutdown or reboot to enforce encryption effects (T1529), while also clearing Windows event logs (T1070.001) to cover tracks. The use of chisel tools (both ELF and Windows variants) suggests tunneling or proxying capabilities to maintain covert communication channels. Although no known exploits in the wild are reported, the threat level is assessed as moderate (4 out of 10), with a low severity rating assigned by the source. The attack requires initial access to public-facing applications, which may be facilitated by misconfigurations or unpatched vulnerabilities. The lack of specific affected versions and patch links indicates that this is an open investigation or an intelligence report based on OSINT with moderate certainty (50%).

Detailed information about Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free affecting type osint. Get real-time updates, technical d

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free - Live Threat Intelligence - Threat Radar | OffSeq.com

[TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

The threat involves the Maui ransomware, a malicious software variant attributed to North Korean state-sponsored cyber actors, targeting the Healthcare and Public Health (HPH) sector. Maui ransomware is a type of malware designed to encrypt files on infected systems, rendering data inaccessible until a ransom is paid. This ransomware strain has been linked to nation-state actors, indicating a high level of sophistication and persistence. The targeting of healthcare organizations is particularly concerning due to the critical nature of their operations and the sensitivity of patient data. The attack vector and infection methods are not detailed in the provided information; however, typical ransomware campaigns often leverage phishing emails, exploitation of unpatched vulnerabilities, or compromised remote access services. The lack of known exploits in the wild suggests that Maui ransomware may be deployed through targeted intrusion rather than widespread automated exploitation. The threat level is assessed as high, reflecting the potential disruption and data compromise risks. The attribution to North Korean actors aligns with historical patterns of cyber operations aimed at generating revenue through ransomware while also potentially disrupting critical infrastructure. The absence of specific affected versions or patch links indicates that the ransomware may exploit general security weaknesses rather than specific software vulnerabilities. Overall, Maui ransomware represents a significant threat to healthcare entities, capable of impacting confidentiality, integrity, and availability of critical health data and services.

Detailed information about [TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Secto

[TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

MedusaLocker is a ransomware strain identified as a ransomware-as-a-service (RaaS) threat, which means it is distributed and operated by affiliates who use the malware to extort victims. This ransomware employs multiple attack techniques aligned with MITRE ATT&CK patterns, including exploitation of external remote services (T1133), phishing campaigns (T1566), and execution through PowerShell scripts (T1059.001). MedusaLocker also uses advanced persistence and evasion tactics such as booting the system in safe mode (T1562.009) to inhibit detection and removal. The ransomware encrypts victim data to impact availability (T1486) and actively inhibits system recovery mechanisms (T1490), such as deleting shadow copies or disabling recovery options, to prevent victims from restoring their systems without paying the ransom. Although no specific affected software versions are listed, the malware targets Windows environments given the use of PowerShell and safe mode boot techniques. No known exploits in the wild have been reported, but the threat level is high due to its ransomware nature and the sophistication of its attack vectors. The ransomware is distributed via phishing and exploitation of external remote services, which indicates that initial access can be gained through social engineering or exploiting exposed services such as RDP or VPNs. The lack of a CVSS score requires an independent severity assessment, which is high given the potential for significant confidentiality, integrity, and availability impacts, ease of exploitation through phishing or exposed services, and the broad scope of affected systems. MedusaLocker’s RaaS model increases its threat surface as multiple affiliates can deploy it, increasing the likelihood of attacks.

Detailed information about #StopRansomware: MedusaLocker. Get real-time updates, technical details, and mitigation strategies.

#StopRansomware: MedusaLocker - Live Threat Intelligence - Threat Radar | OffSeq.com

#StopRansomware: MedusaLocker

OSINT - First Node.js-based Ransomware : Nodera

Nodera is identified as the first ransomware strain developed using Node.js, a popular JavaScript runtime environment primarily used for server-side applications. As ransomware, Nodera's primary malicious function is to encrypt victim files and demand a ransom payment for their decryption. The use of Node.js for ransomware is notable because it leverages a cross-platform runtime environment, potentially enabling the malware to operate on multiple operating systems where Node.js is supported, such as Windows, Linux, and macOS. This could increase the attack surface compared to ransomware built for a single platform. However, the available information indicates that Nodera is a relatively low-severity threat with limited analysis and no known exploits in the wild as of the published date (January 2020). The certainty of the threat is moderate (50%), suggesting that while Nodera has been identified and analyzed to some extent, it has not been widely observed or confirmed in active attacks. The technical details show a moderate threat level (3 out of an unspecified scale) and limited analysis depth (2), indicating that Nodera may be more of a proof-of-concept or emerging threat rather than a fully weaponized ransomware strain. The absence of affected versions and patch links further supports that this ransomware is not tied to a specific vulnerable software product but is rather a standalone malware type. Nodera's implementation in Node.js could allow attackers to evade some traditional detection mechanisms that focus on native binaries, but it also requires the presence of the Node.js runtime or bundling it with the malware, which might limit its stealth and propagation capabilities. Overall, Nodera represents an evolution in ransomware development by using modern development frameworks, but its practical impact and prevalence appear limited based on current intelligence.

Detailed information about OSINT - First Node.js-based Ransomware : Nodera. Get real-time updates, technical details, and mitigation strategies.

OSINT - First Node.js-based Ransomware : Nodera - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Making a Ransomware Payment? It May Now Violate U.S. Sanctions

This threat intelligence report concerns the legal and regulatory implications associated with ransomware payments, specifically highlighting that making a ransomware payment may now violate U.S. sanctions. The ransomware referenced is the SamSam (also known as Samsam or Samas) ransomware, a malware family known for encrypting victims' files and demanding ransom payments for decryption keys. Although the technical details of the ransomware itself are not elaborated in this report, the focus is on the compliance risk posed by ransom payments under U.S. sanctions regimes. This means that organizations paying ransom to certain sanctioned entities or individuals could be violating U.S. laws, potentially exposing themselves to legal penalties. The report is categorized as low severity and does not indicate active exploitation or vulnerabilities in software versions. The threat level and analysis scores are moderate to low, and no direct technical exploit or patch information is provided. The key takeaway is that ransomware payments are not only a cybersecurity risk but also a legal risk, especially for organizations subject to U.S. jurisdiction or those with ties to the U.S. financial system. This adds a layer of complexity to incident response and ransom negotiation strategies, requiring organizations to carefully assess the legal ramifications before making any payments.

Detailed information about OSINT - Making a Ransomware Payment? It May Now Violate U.S. Sanctions. Get real-time updates, technical details, and mitigation stra

OSINT - Making a Ransomware Payment? It May Now Violate U.S. Sanctions - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New Fox Ransomware Matrix Variant Tries Its Best to Close All File Handles

The Fox ransomware Matrix variant is a malware strain identified in 2018 that attempts to maximize its impact by closing all open file handles on the infected system before encrypting files. This technique is designed to ensure that files are not locked by other processes, allowing the ransomware to gain exclusive access and successfully encrypt targeted files. By closing file handles, the ransomware can bypass certain file locks that might otherwise prevent encryption, increasing the likelihood of data compromise. Although the variant is categorized as ransomware, it appears to have a relatively low threat level and no known exploits in the wild have been reported. The lack of affected versions and patch information suggests that this variant may be either a proof-of-concept or a low-prevalence strain. The ransomware's operational method focuses on disrupting file availability by encrypting data, thereby impacting system availability and potentially confidentiality if sensitive files are encrypted and held hostage. The technical details indicate a moderate threat level (threatLevel: 3) and a low analysis score (analysis: 2), reflecting limited public information and possibly limited sophistication or deployment. The variant's ability to close all file handles is a notable technical behavior that distinguishes it from other ransomware strains, potentially increasing its effectiveness in file encryption but not necessarily its propagation or infection vector capabilities.

Detailed information about OSINT - New Fox Ransomware Matrix Variant Tries Its Best to Close All File Handles. Get real-time updates, technical details, and mit

OSINT - New Fox Ransomware Matrix Variant Tries Its Best to Close All File Handles - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New KeyPass Ransomware Campaign Underway

The KeyPass ransomware campaign represents a newly identified malware threat reported in August 2018. KeyPass is a ransomware family that encrypts victims' files and demands a ransom payment for decryption. Although detailed technical specifics such as infection vectors, encryption algorithms, or propagation methods are not provided in the available information, ransomware typically operates by encrypting critical user or system data, rendering it inaccessible until a ransom is paid, usually in cryptocurrency. The campaign is classified with a low severity by the source, indicating either limited impact or low sophistication at the time of reporting. No known exploits in the wild have been documented, suggesting that the ransomware may not have been widely deployed or that its infection mechanisms are not based on exploiting specific software vulnerabilities but rather rely on social engineering or other delivery methods. The absence of affected versions or patch links implies that this ransomware targets general systems rather than exploiting a particular software flaw. The threat level and analysis scores (3 and 2 respectively) indicate moderate concern but limited detailed analysis or impact assessment. Overall, KeyPass ransomware represents a typical ransomware threat that could impact organizations by encrypting data and demanding ransom, but with limited evidence of widespread or severe impact at the time of reporting.

Detailed information about OSINT - New KeyPass Ransomware Campaign Underway. Get real-time updates, technical details, and mitigation strategies.

OSINT - New KeyPass Ransomware Campaign Underway - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Sigma Ransomware Being Distributed Using Fake Craigslist Malspam

The Sigma ransomware is a type of malicious software designed to encrypt victims' files and demand a ransom payment for their release. This particular ransomware variant has been observed being distributed via a malspam campaign that impersonates Craigslist communications. Attackers send phishing emails that appear to be legitimate Craigslist messages, tricking recipients into opening malicious attachments or clicking on harmful links. These emails leverage social engineering tactics to exploit user trust in Craigslist, increasing the likelihood of user execution of the malware payload. The attack techniques align with MITRE ATT&CK patterns such as spearphishing links (T1192), spearphishing attachments (T1193), user execution (T1204), scripting (T1064), and obfuscated files or information (T1027). Once executed, Sigma ransomware encrypts user data, causing data corruption and loss of availability. The ransomware's obfuscation techniques hinder detection by traditional antivirus solutions. Although the threat level is marked as low and no known exploits in the wild have been reported, the use of social engineering and ransomware payloads poses a tangible risk to targeted users. The campaign's reliance on Craigslist-themed malspam suggests a focus on users who engage with online classifieds, potentially including small businesses and individuals. The absence of affected software versions indicates this is a malware distribution method rather than a vulnerability in a specific product. Overall, Sigma ransomware distributed via fake Craigslist malspam represents a targeted malware threat leveraging phishing to compromise systems and encrypt data.

Detailed information about OSINT - Sigma Ransomware Being Distributed Using Fake Craigslist Malspam. Get real-time updates, technical details, and mitigation st

OSINT - Sigma Ransomware Being Distributed Using Fake Craigslist Malspam - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New Bip Dharma Ransomware Variant Released

The Bip Dharma ransomware variant is a new iteration of the Dharma ransomware family, which is known for encrypting victims' files and demanding ransom payments for decryption keys. Dharma ransomware typically spreads through phishing emails, exploit kits, or unsecured Remote Desktop Protocol (RDP) connections. Once executed, it encrypts files on the infected system using strong encryption algorithms, rendering data inaccessible to the user. The ransomware then displays a ransom note demanding payment, often in cryptocurrency, to restore access. This variant, identified through OSINT sources and reported by CIRCL, does not have detailed technical indicators or affected versions listed, suggesting limited public technical analysis or detection signatures at the time of reporting. The threat level is marked as moderate (3 out of an unspecified scale), and no known exploits in the wild have been documented, indicating that while the ransomware is active, it may not be widely propagated or may be in early stages of distribution. The low severity rating assigned likely reflects limited impact or scope at the time of publication rather than the inherent danger of ransomware attacks. However, ransomware like Bip Dharma poses significant risks due to potential data loss, operational disruption, and financial costs associated with ransom payments and recovery efforts.

Detailed information about OSINT - New Bip Dharma Ransomware Variant Released. Get real-time updates, technical details, and mitigation strategies.

OSINT - New Bip Dharma Ransomware Variant Released - Live Threat Intelligence - Threat Radar | OffSeq.com

[TIA-REPO Consumption] KeyPass ransomware

KeyPass ransomware is a type of malicious software classified as ransomware, which typically encrypts victims' files and demands a ransom payment for the decryption key. The provided information indicates that KeyPass ransomware was documented by CIRCL and published in August 2018. However, the details are minimal, with no specific affected software versions or technical indicators provided. The threat level is noted as 3 (on an unspecified scale), and the severity is marked as low. There are no known exploits in the wild linked to this ransomware, suggesting it may not have been widely deployed or observed in active attacks. Ransomware like KeyPass generally operates by infiltrating systems through vectors such as phishing emails, malicious downloads, or exploiting vulnerabilities, then encrypting files to disrupt operations and extort victims. Without detailed technical indicators or attack vectors, it is difficult to provide a deep technical analysis, but the classification as ransomware implies the typical behavior of file encryption and ransom demands.

Detailed information about [TIA-REPO Consumption] KeyPass ransomware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'malware_classification:malware-category="ransomware"'

Filter Threats

Threats Tagged 'malware_classification:malware-category="ransomware"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility