Threats Tagged 'misp-galaxy:mitre-attack-pattern="application layer protocol - t1071"'

The XCTDH Crypto Heist Part 4 is a medium-severity cyber threat linked to North Korean actors targeting software supply chains and development tools. It involves compromising software dependencies and development environments to facilitate unauthorized access or manipulation, leveraging application layer protocols for communication or data exfiltration. Although no specific affected product versions or patches are identified, the threat highlights risks associated with supply chain attacks. European organizations relying on affected software development tools or dependencies could face risks of intellectual property theft, operational disruption, or unauthorized access. Mitigation requires enhanced supply chain security practices, including rigorous code and dependency auditing, network segmentation, and monitoring for anomalous application layer traffic. Countries with significant software development sectors and historical exposure to North Korean cyber activities, such as the UK, Germany, and France, are more likely to be impacted. Given the medium severity, the threat poses a moderate risk that demands proactive defense but does not indicate immediate critical exploitation. Defenders should prioritize supply chain security and monitor for related attack patterns to reduce exposure.

MediumUnknownGermanyFranceNetherlands+2#misp-galaxy:country="north korea"#misp-galaxy:mitre-attack-pattern="compromise software dependencies and development tools - t1195.001"#misp-galaxy:mitre-attack-pattern="compromise software supply chain - t1195.002"

Sha1-Hulud is a newly identified cyber threat involving supply chain compromise and covert command and control (C2) communications using application layer protocols. Attackers exploit link-local IP addresses such as 169.254.169.254 and 169.254.170.2, commonly associated with cloud metadata services, to bypass perimeter defenses and blend malicious traffic with legitimate communications. A JavaScript component named bun_environment.js has been identified as part of the attack chain.

MediumUnknownGermanyFranceNetherlands+2#shai-hulud#osint#misp-galaxy:mitre-attack-pattern="supply chain compromise - t1195"

HardBit 4.0 Investigation by Reyben Cortes

MediumUnknownGermanyFranceUnited Kingdom+3#misp-galaxy:mitre-attack-pattern="data encrypted for impact - t1486"#misp-galaxy:mitre-attack-pattern="data compressed - t1002"#misp-galaxy:mitre-attack-pattern="data encrypted - t1022"

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

MediumMalwareUnited KingdomGermanyFrance+4#type:osint#osint:lifetime="perpetual"#osint:certainty="50"

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

MediumCampaignFranceGermanyUnited Kingdom+4#misp-galaxy:target-information="france"#type:osint#osint:lifetime="perpetual"