Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control

The threat identified as AA22-138B involves threat actors chaining multiple VMware vulnerabilities to achieve full system control. This attack technique leverages a sequence of exploits targeting VMware products, which are widely used virtualization platforms in enterprise environments. The chaining of vulnerabilities allows attackers to escalate privileges, execute arbitrary code, and ultimately gain complete control over the affected system. The attack patterns associated with this threat include Unix shell command execution (T1059.004), modification of Linux and macOS file and directory permissions (T1222.002), ingress tool transfer (T1105), use of symmetric cryptography (T1573.001), malware deployment (T1588.001), exploitation for privilege escalation (T1068), AppleScript execution (T1059.002), clearing command history (T1070.003), use of web protocols for command and control (T1071.001), connection proxying (T1090), targeting of sensitive files like /etc/passwd and /etc/shadow (T1003.008), data archiving (T1560), exploitation for client execution (T1203), and deployment of web shells (T1505.003). Although no specific affected versions or patches are listed, the threat level is noted as moderate (3), and no known exploits are currently observed in the wild. The severity is marked as low in the source, but the technical details and attack complexity suggest a more nuanced risk profile. The attack requires chaining multiple vulnerabilities, indicating a sophisticated adversary capable of multi-stage exploitation. The absence of known exploits in the wild may reflect limited public exposure or recent discovery. Overall, this threat represents a complex, multi-vector attack against VMware virtualization environments that could lead to full system compromise if successfully executed.

Detailed information about AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control affecting tlp white. Get real-time updates, technical

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="archive collected data - t1560"'

Stop chasing alerts. Route them.

Filter Threats