Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif

BatLoader is a malware loader that has been observed abusing Google Search Ads as a distribution vector to deliver two prominent information-stealing malware families: Vidar Stealer and Ursnif. BatLoader operates by leveraging malicious advertisements appearing in Google Search results, which entice users to click and subsequently download the malware payloads. Vidar Stealer is known for harvesting sensitive information such as credentials, browser data, cryptocurrency wallets, and system information. Ursnif, also known as Gozi, is a banking Trojan that primarily targets financial information and can also facilitate further malware deployment or lateral movement within compromised networks. The use of Google Search Ads as a delivery mechanism is notable because it exploits a trusted platform, increasing the likelihood of user interaction and successful infection. The malware employs scripting techniques, including PowerShell and Python, to execute commands and maintain persistence. The threat leverages network traffic capture or redirection techniques to intercept sensitive data. Although no specific affected product versions are listed, the threat targets end-user systems that interact with Google Search and download malicious payloads. There are no known exploits in the wild beyond this delivery method, but the campaign's reliance on social engineering and trusted advertising platforms makes it a persistent medium-risk threat. The technical details indicate a moderate threat level, with the malware categorized as a loader that facilitates the installation of stealer and banking Trojan malware.

Detailed information about BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif. Get real-time updates, technical details, and mit

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Dissecting PlugX to Extract Its Crown Jewels - Live Threat Intelligence - Threat Radar | OffSeq.com

The CERT-FR report highlights an extended campaign by the Sandworm intrusion set targeting Centreon systems. Centreon is an IT infrastructure monitoring software widely used to oversee network, server, and application performance. The Sandworm group, known for its sophisticated cyber-espionage and sabotage operations, exploits public-facing Centreon applications to gain unauthorized access. The attack techniques align with MITRE ATT&CK patterns such as exploiting public-facing applications (T1190), leveraging server software components (T1505), and creating or modifying system processes (T1543) to establish persistence. The adversaries also use scheduled tasks or jobs (T1053) and command and scripting interpreters (T1059) to execute malicious payloads. They abuse elevation control mechanisms (T1548) to gain higher privileges and employ deobfuscation techniques (T1140) to evade detection. Post-compromise activities include file and directory discovery (T1083), establishing encrypted command and control channels (T1573), using application layer protocols for communication (T1071), and exfiltrating data over these channels (T1041). Although no specific affected versions or patches are listed, the campaign's high confidence and almost-certain likelihood suggest active targeting of Centreon deployments, particularly in France. The threat level is moderate (4), and no known exploits in the wild have been reported yet, indicating a potential for future exploitation if mitigations are not applied.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems affecting misp-galaxy target-information. Get re

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="command and scripting interpreter - t1059"'

Filter Threats