Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

The APT36 malware campaign is a targeted threat operation that utilizes a combination of social engineering and technical evasion techniques to infiltrate victim networks. The primary infection vector is phishing (MITRE T1566), where malicious desktop entry files are delivered to victims, often via Google Drive links, to bypass traditional email filtering and security controls. These desktop entry files act as a launcher for malicious scripts (T1064) that execute payloads on the victim’s system. The malware employs masquerading (T1036) and hides files and directories (T1564.001) to evade detection. Persistence is achieved through the creation or manipulation of Windows services (T1543.003), allowing the malware to survive reboots and maintain control. The attackers use binary padding (T1027.001) to obfuscate payloads and avoid signature-based detection. Brute force techniques (T1110) are used to gain access to additional systems or escalate privileges. The campaign also involves software discovery (T1518) to map the environment and identify valuable targets. Communication with command and control servers occurs over both application layer protocols (T1071) and non-application layer protocols (T1095), often utilizing non-standard ports (T1571) to evade network monitoring. Tools and additional payloads are transferred using ingress tool transfer techniques (T1105). The campaign is linked to the threat actor group Operation C-Major, known for targeting South Asian and European entities. No patches or direct fixes exist for this campaign, as it relies on social engineering and custom malware rather than exploiting software vulnerabilities. The campaign’s complexity and use of multiple evasion techniques make it a persistent threat requiring layered defense strategies.

seemysitelive.store: Enriched via the dns module

Detailed information about Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery. Get real-time updates, tech

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="brute force - t1110"'

Stop chasing alerts. Route them.

Filter Threats