Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Supply chain attacks represent a sophisticated and increasingly prevalent threat vector wherein attackers compromise a trusted third-party vendor or software provider to infiltrate downstream organizations. This attack pattern leverages multiple tactics, including exploiting public-facing applications (MITRE ATT&CK T1190), leveraging valid accounts (T1078), spearphishing via attachments (T1193) or links (T1192), account manipulation (T1098), and creation of new accounts (T1136). Attackers often deploy application deployment software (T1017) to propagate malicious payloads within the victim environment. Tools commonly associated with these attacks include wmiexec for remote command execution, mimikatz for credential harvesting, certmig for certificate migration, netscan for network reconnaissance, and procdump for memory dumping. The absence of a patch and the presence of known exploits in the wild underscore the active risk posed by these attacks. The attack chain typically begins with initial access through compromised software updates or vendor systems, followed by lateral movement facilitated by credential theft and account manipulation. The ultimate goal often involves persistent access, data exfiltration, or disruption of critical services. The complexity and stealth of supply chain attacks make detection challenging, as the malicious code originates from trusted sources, bypassing traditional security controls. The threat level is moderate (3 on the provided scale), reflecting the significant impact potential despite the low severity rating assigned, which likely reflects the broad and variable nature of supply chain compromises rather than a single vulnerability. Given the tools and techniques involved, these attacks can compromise confidentiality, integrity, and availability of targeted systems.

Detailed information about SUPPLY CHAIN ATTACKS affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, and mitigation strategies.

SUPPLY CHAIN ATTACKS - Live Threat Intelligence - Threat Radar | OffSeq.com

SUPPLY CHAIN ATTACKS

OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo

The Amavaldo malware is a backdoor Trojan primarily categorized as spyware and keylogger, with capabilities that include masquerading, spearphishing via service, screen capture, input capture, video capture, forced authentication, and deployment through application deployment software. It is identified as a Remote Access Trojan (RAT) with a focus on banking-related espionage activities. The malware employs multiple MITRE ATT&CK techniques such as T1036 (Masquerading), T1194 (Spearphishing via Service), T1113 (Screen Capture), T1056 (Input Capture), T1125 (Video Capture), T1187 (Forced Authentication), and T1017 (Application Deployment Software), indicating a sophisticated approach to infiltrate and maintain persistence within targeted systems. The threat is characterized by a low severity rating but is persistent and capable of continuous espionage, capturing sensitive user inputs and screen data, which can lead to credential theft and unauthorized access to financial accounts. The malware's distribution vector includes spearphishing, which exploits social engineering to gain initial access, and it can masquerade as legitimate software to evade detection. Although no known exploits in the wild are reported, the malware's capabilities suggest it is designed for targeted attacks, especially against financial institutions or users with banking privileges. The threat level and analysis scores indicate moderate confidence in the technical details, with a 50% certainty rating, suggesting some gaps in full attribution or behavioral understanding. The malware's perpetual lifetime implies ongoing risk if not detected and removed.

Detailed information about OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo. Get real-time updates, technical details, and mitigation strategi

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="application deployment software - t1017"'

Filter Threats