Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities

Prynt Stealer is a recently identified information-stealing malware campaign observed in the wild, primarily designed to perform clipper and keylogger activities. This malware targets user credentials and sensitive information by capturing keystrokes and manipulating clipboard data to intercept cryptocurrency wallet addresses or other copied sensitive data. The stealer leverages multiple MITRE ATT&CK techniques, including user execution (T1204), system and process discovery (T1497.001, T1057), account discovery (T1087), software discovery (T1518), and system service and location discovery (T1007, T1614). It also performs credential theft from password stores (T1555), steals web session cookies (T1539), and application access tokens (T1528), indicating a broad scope of data exfiltration. The malware captures screen content (T1113) and exfiltrates data over command and control (C2) channels and web services (T1041, T1567). Prynt Stealer’s infection vector relies on user execution, meaning it requires victims to run malicious files or scripts, often delivered via phishing or social engineering. Although no known exploits are currently reported in the wild, the malware’s capabilities to harvest credentials, session tokens, and clipboard data pose significant risks to confidentiality and integrity of user data. The campaign’s perpetual lifetime and moderate certainty level (50%) suggest ongoing monitoring is necessary. The absence of affected versions implies it targets general Windows environments rather than specific software vulnerabilities.

Detailed information about Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities. Get real-time updates, technical 

Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "Trickbot to Ryuk in Two Hours" describes a rapid attack chain leveraging the Trickbot malware to deploy Ryuk ransomware within a very short timeframe, approximately two hours. Trickbot is a modular banking Trojan that has evolved into a versatile malware platform used for credential theft, lateral movement, and network reconnaissance. In this campaign, Trickbot is used to gain initial access, perform extensive network and system discovery, credential dumping, and disable security tools to evade detection. The attack employs multiple MITRE ATT&CK techniques such as scheduled tasks (T1053) for persistence, disabling security tools (T1089), group policy modification (T1484), process injection (T1055), and obfuscated files or information (T1027) to maintain stealth and control. The adversaries leverage valid accounts (T1078) and credential dumping (T1003) to escalate privileges and move laterally across the network. Discovery techniques include system network connections (T1049), software and security software discovery (T1518, T1063), remote system discovery (T1018), and network share discovery (T1135). Remote services (T1021), remote desktop protocol (T1076), and remote file copy (T1105) facilitate lateral movement and payload deployment. The final stage involves deploying Ryuk ransomware, which encrypts data for impact (T1486), causing significant operational disruption. The campaign is known to utilize tools like Cobalt Strike and PowerView for post-exploitation activities. The rapid progression from initial compromise to ransomware deployment underscores the high operational tempo and sophistication of the threat actors behind this campaign.

Detailed information about Trickbot to Ryuk in Two Hours. Get real-time updates, technical details, and mitigation strategies.

Trickbot to Ryuk in Two Hours - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot to Ryuk in Two Hours

The provided information describes a reconnaissance campaign involving an "Interesting Recon Script" identified by CIRCL under the kill-chain project. This campaign is characterized by the use of scripting techniques (MITRE ATT&CK T1064) executed via command-line interfaces (T1059) and requiring user execution (T1204). The script performs extensive discovery activities across multiple domains: account discovery (T1087), domain trust discovery (T1482), file and directory discovery (T1083), network share discovery (T1135), permission groups discovery (T1069), process discovery (T1057), registry queries (T1012), remote system discovery (T1018), software discovery (T1518), system information discovery (T1082), and system network connections discovery (T1049). These activities indicate a comprehensive reconnaissance phase aimed at gathering detailed information about the target environment, including user accounts, network topology, permissions, running processes, installed software, and system configurations. The campaign does not specify affected product versions, and no known exploits in the wild have been reported. The threat level is moderate (3), with a low severity rating assigned by the source. The attack requires user interaction to execute the script, which suggests it may be delivered via phishing or social engineering. The campaign's focus on discovery techniques aligns with early-stage intrusion activities, potentially preceding more impactful attacks such as lateral movement or data exfiltration.

Detailed information about Interesting Recon Script. Get real-time updates, technical details, and mitigation strategies.

Interesting Recon Script - Live Threat Intelligence - Threat Radar | OffSeq.com

Interesting Recon Script

Emotet is a sophisticated and modular malware strain primarily known for its use in large-scale spam campaigns and as a delivery mechanism for other malware families. The provided information details an Emotet campaign characterized by a variety of Tactics, Techniques, and Procedures (TTPs) aligned with the MITRE ATT&CK framework. Key techniques include spearphishing attachments (T1193) as the initial infection vector, leveraging malicious email attachments to compromise victims. Once executed, Emotet employs command-line interfaces (T1059), scheduled tasks (T1053), scripting (T1064), and Windows Management Instrumentation (WMI) (T1047) to maintain persistence and execute payloads. It also uses registry run keys and startup folders (T1060) to ensure execution upon system reboot. Process injection (T1055) is utilized to evade detection and maintain stealth by running malicious code within legitimate processes. Emotet conducts extensive reconnaissance activities such as account discovery (T1087), domain trust discovery (T1482), and system owner/user discovery (T1033) to map the environment and identify valuable targets. For command and control (C2) communication, it uses commonly used ports (T1043), standard application layer protocols (T1071), and standard cryptographic protocols (T1032) to blend in with normal network traffic and evade network defenses. The campaign also references tools like Empire and Cobalt Strike, which are often used post-compromise for lateral movement and privilege escalation. The threat level is medium, reflecting Emotet's widespread impact but also the availability of detection and mitigation strategies. No known exploits in the wild are indicated, but the campaign's persistence and modularity make it a continuing risk. Overall, this Emotet campaign demonstrates a multi-stage attack lifecycle from initial phishing to lateral movement and data exfiltration capabilities, leveraging a broad spectrum of Windows-based techniques to maintain stealth and persistence.

Detailed information about Emotet in Depth TTP 10-07-19. Get real-time updates, technical details, and mitigation strategies.

Emotet in Depth TTP 10-07-19 - Live Threat Intelligence - Threat Radar | OffSeq.com

Emotet in Depth TTP 10-07-19

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="account discovery - t1087"'

Filter Threats