Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - 2018-10-09 - HANCITOR INFECTION WITH ZEUS PANDA BANKER

The threat described involves a campaign observed around October 2018, where the Hancitor malware was used to deliver the Zeus Panda banking Trojan, also known as Panda Banker. Hancitor is a downloader malware typically distributed via spearphishing emails containing malicious attachments (MITRE ATT&CK T1193). Once executed, Hancitor downloads and installs additional payloads, in this case, the Zeus Panda banking Trojan. Zeus Panda is a sophisticated banking malware designed to steal sensitive financial information by capturing user inputs (MITRE ATT&CK T1056) such as credentials and banking session data. The infection chain begins with targeted spearphishing emails that entice victims to open malicious attachments, leading to the installation of Hancitor, which subsequently fetches Zeus Panda. This Trojan is known for its capability to intercept and manipulate banking transactions, enabling attackers to conduct fraudulent transfers or steal login credentials. The campaign's high confidence and almost certain likelihood tags indicate a strong analytic consensus on the threat's existence and activity. Although the severity is marked as low in the source, this likely reflects the campaign's scope or impact at the time rather than the technical danger posed by the malware itself. No known exploits or patches are associated, as the attack vector relies on social engineering rather than software vulnerabilities. The absence of affected versions suggests this is not a vulnerability in software but a malware campaign exploiting user behavior and social engineering.

Detailed information about OSINT - 2018-10-09 - HANCITOR INFECTION WITH ZEUS PANDA BANKER. Get real-time updates, technical details, and mitigation strategies.

OSINT - 2018-10-09 - HANCITOR INFECTION WITH ZEUS PANDA BANKER - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan

The Panda Banker Trojan is a type of banking malware primarily designed to steal financial information from infected users by employing techniques such as 'man-in-the-browser' (MITB) attacks. This malware intercepts and manipulates web traffic between the user and banking websites, allowing attackers to capture credentials, session cookies, and other sensitive data without the user's knowledge. The Trojan is known to target banking customers in the US, Canada, and Japan, leveraging social engineering and possibly other malware like Emotet and Geodo to propagate. Although the provided information does not specify affected software versions or detailed infection vectors, the association with MITRE ATT&CK technique T1185 indicates that the Trojan operates by injecting malicious code into web browsers to intercept and alter banking transactions in real time. The threat level is indicated as low, and no known exploits in the wild are reported in this dataset, suggesting limited active campaigns or lower sophistication compared to other banking Trojans. However, the presence of multiple malware families and attack patterns in the tags implies a complex threat landscape where Panda Banker may be part of a broader malware ecosystem.

Detailed information about OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan. Get real-time updates, technical details, and mitigat

OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan - Live Threat Intelligence - Threat Radar | OffSeq.com

Hancitor, also known as Chanitor or Tordal, is a malware downloader primarily used to distribute various payloads such as banking Trojans, ransomware, and other malicious software. It is commonly delivered via phishing campaigns that use malicious Microsoft Office documents or archive files. Once executed, Hancitor establishes persistence on the infected system and communicates with its command and control (C2) infrastructure to download additional malware components. The reference to 'panda banker' in the tags suggests that Hancitor has been used to deliver the Panda Banker malware, a banking Trojan designed to steal financial credentials and sensitive information from infected hosts. The threat level indicated as 3 and analysis level 2 suggest moderate concern, but the overall severity is marked as low in the provided data. The lack of specific affected versions or patch links indicates that this is an intelligence report rather than a vulnerability disclosure. Hancitor's distribution method typically involves social engineering, exploiting user trust to execute malicious macros or scripts embedded in documents. The mention of 'pastie-website' as a source-type suggests that some indicators or intelligence related to Hancitor were gathered from public paste sites, which attackers sometimes use to share or leak information. Although no known exploits in the wild are reported here, Hancitor remains a relevant threat due to its role as a malware downloader facilitating multi-stage attacks. Its modular nature allows attackers to adapt payloads based on campaign goals, making it a persistent threat in the cybercrime ecosystem.

Detailed information about Hancitor Intel. Get real-time updates, technical details, and mitigation strategies.

Hancitor Intel - Live Threat Intelligence - Threat Radar | OffSeq.com

Hancitor Intel

The Panda malware, also known as Panda Banker, is a type of banking Trojan malware designed to steal sensitive financial information from infected systems. This malware family primarily targets banking credentials by intercepting user input, capturing screenshots, and potentially injecting malicious code into banking sessions to manipulate transactions or steal authentication data. The malware is distributed through various infection vectors, including phishing emails, malicious downloads, or exploit kits, although specific infection methods for Panda Banker are not detailed in the provided information. Once installed, Panda Banker operates stealthily to avoid detection by security software, aiming to exfiltrate banking credentials and other personal data to threat actors. The malware's capabilities typically include keylogging, form grabbing, and web injection, which allow attackers to bypass multi-factor authentication and other security controls by manipulating the victim's banking session in real time. The threat level and analysis scores provided (both at level 2) suggest a moderate but notable risk, consistent with the medium severity classification. While no specific affected versions or patches are mentioned, the malware's classification as a banker Trojan indicates it targets Windows-based systems, which are commonly used in corporate and personal banking environments. The absence of known exploits in the wild suggests that Panda Banker is not exploiting zero-day vulnerabilities but rather relies on social engineering or known infection vectors to compromise systems.

Detailed information about Panda Malware Broadens - F5 Blog. Get real-time updates, technical details, and mitigation strategies.

Panda Malware Broadens - F5 Blog - Live Threat Intelligence - Threat Radar | OffSeq.com

Panda Malware Broadens - F5 Blog

OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers

The Zeus Panda Banking Trojan is a type of malware specifically designed to target online banking users, with a particular focus on online holiday shoppers. This Trojan operates by infiltrating victim systems, typically through phishing campaigns or malicious downloads, and then intercepting banking credentials and other sensitive financial information. Once installed, Zeus Panda can perform web injection attacks, modifying banking websites in real-time to steal login credentials, two-factor authentication codes, and other personal data. The malware is known for its stealth and persistence, often evading detection by traditional antivirus solutions. Although the provided information does not specify affected versions or detailed technical mechanisms, Zeus Panda is categorized as a banker Trojan, indicating its primary function is financial theft. The targeting of holiday shoppers suggests attackers exploit increased online shopping activity during peak seasons to maximize infection rates and financial gain. Despite being reported in 2017 with a low severity rating and no known exploits in the wild at the time, the Trojan remains a relevant threat due to the ongoing prevalence of online banking and e-commerce.

Detailed information about OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers. Get real-time updates, technical details, and mitigation strategie

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:banker="panda banker"'

Filter Threats