Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

The SNOWYAMBER campaign represents a sophisticated malware operation characterized by a multi-stage attack leveraging a variety of well-known tactics, techniques, and procedures (TTPs) as classified by the MITRE ATT&CK framework. The campaign employs phishing and spearphishing (T1566, T1566.001, T1566.002) as primary initial infection vectors, utilizing malicious attachments and links that require user execution (T1204, T1204.001, T1204.002). The attackers use advanced evasion techniques such as HTML smuggling (T1027.006) and right-to-left override (T1036.002) to bypass security controls and trick users into executing malicious payloads. Once executed, the malware establishes persistence through registry run keys and startup folder modifications (T1547.001) and employs DLL search order hijacking and side-loading (T1574.001, T1574.002) to maintain stealth and evade detection. The campaign also involves infrastructure compromise (T1584) and the use of virtual private servers and web services (T1583.003, T1583.006) to host command and control (C2) infrastructure. Communication with C2 servers is conducted via web services (T1102) and one-way communication channels (T1102.003), which may limit detection opportunities. The malware also incorporates techniques to bypass the 'mark-of-the-web' security feature (T1553.005) and deobfuscate or decode files or information (T1140), indicating a high level of sophistication in payload delivery and execution. The campaign is tagged with a threat level of 1 (high) and a certainty of 50%, suggesting ongoing analysis and partial confidence in attribution and impact assessment. No patches or known exploits are currently available, indicating that mitigation relies heavily on detection and prevention strategies rather than remediation of a specific vulnerability. The campaign's use of OSINT tools and infrastructure suggests a focus on reconnaissance and targeted attacks, potentially aimed at high-value targets through spearphishing and infrastructure compromise.

phishing email mimicking diplomatic correspondence. The link hidden under “here” leads to the ENVYSCOUT

Used to distribute phishing emails with a link to ENVYSCOUT

Used to distribute phishing emails with a link to i.php (reconnaissance?)

Detailed information about SNOWYAMBER - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

SNOWYAMBER - Malware Analysis Report - Live Threat Intelligence - Threat Radar | OffSeq.com

SNOWYAMBER - Malware Analysis Report

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

The threat campaign attributed to the advanced persistent threat (APT) group known as NOBELIUM (also tracked as UNC2452 and APT29) leverages a geopolitical event—Poland's Ambassador’s visit to the United States—to target European Union governments that are providing assistance to Ukraine. This campaign is characterized by sophisticated spearphishing techniques, including spearphishing links and malicious file attachments delivered via HTML smuggling and obfuscated payloads to evade detection. The attackers exploit trusted relationships and use native APIs to execute code, enabling persistence through mechanisms such as registry run keys and autostart execution. The campaign employs drive-by compromises and web services for command and control, facilitating bidirectional communication with compromised systems. The use of obfuscation techniques and infrastructure compromise further complicates detection and mitigation efforts. The attack chain requires user execution, typically through social engineering, and targets high-value government entities involved in geopolitical support activities. Although no specific software vulnerabilities or affected product versions are listed, the campaign's reliance on social engineering and trusted relationships indicates a focus on human factors and supply chain attack vectors rather than direct exploitation of software flaws. The campaign is ongoing as of the publication date in March 2023, with no patches available, underscoring the need for heightened vigilance and tailored defensive measures.

Detailed information about NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine. Get real-time updates, technical de

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

QUARTERRIG is a sophisticated malware campaign characterized by its multi-faceted attack techniques, primarily targeting infrastructure through phishing and spearphishing methods. The campaign leverages a variety of MITRE ATT&CK techniques, including the use of virtual private servers (VPS) for infrastructure compromise (T1583.003, T1584), and employs phishing vectors such as spearphishing attachments (T1566.001) and links (T1566.002) to initiate user execution (T1204). The malware uses malicious files (T1204.002) delivered via HTML smuggling (T1027.006), a technique that bypasses traditional email and web security filters by embedding malicious payloads within seemingly benign HTML content. Once executed, QUARTERRIG establishes persistence through registry run keys and startup folder modifications (T1547.001), and employs DLL search order hijacking (T1574.001) and DLL side-loading (T1574.002) to evade detection and maintain execution within the victim environment. The campaign also utilizes deobfuscation and decoding techniques (T1140) to conceal its payloads and bypass mark-of-the-web protections (T1553.005), which are designed to warn users about potentially unsafe files downloaded from the internet. The absence of known exploits in the wild suggests that this campaign relies heavily on social engineering and user interaction to propagate. The threat level is assessed as high due to the combination of advanced persistence mechanisms, evasion techniques, and the exploitation of user trust via phishing. The campaign's use of VPS infrastructure indicates a well-resourced adversary capable of maintaining operational security and flexibility in attack delivery.

Detailed information about QUARTERRIG - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

QUARTERRIG - Malware Analysis Report - Live Threat Intelligence - Threat Radar | OffSeq.com

QUARTERRIG - Malware Analysis Report

The HALFRIG campaign represents a sophisticated malware operation primarily targeting infrastructure through a combination of phishing techniques and advanced persistence mechanisms. The campaign leverages spearphishing attachments (MITRE ATT&CK T1566.001) and user execution of malicious files (T1204.002) to initially compromise victims. The use of HTML smuggling (T1027.006) indicates that attackers embed malicious payloads within HTML content to bypass traditional email security filters and user suspicion. Once executed, HALFRIG employs registry run keys and startup folder modifications (T1547.001) to maintain persistence on infected systems. Additionally, the malware utilizes DLL search order hijacking (T1574.001) and DLL side-loading (T1574.002) techniques to evade detection and load malicious code under the guise of legitimate processes. The campaign also includes deobfuscation and decoding routines (T1140) to conceal its true nature and bypass security controls. The attackers exploit mark-of-the-web bypass techniques (T1553.005) to circumvent Windows security warnings that typically alert users to potentially unsafe files downloaded from the internet. The campaign infrastructure is supported by virtual private servers (T1583.003), indicating a well-resourced adversary capable of maintaining and rotating command and control (C2) assets. Although no known exploits are currently reported in the wild, the high confidence and almost-certain likelihood tags suggest active and ongoing operations. The campaign’s complexity and use of multiple advanced techniques highlight a targeted approach aimed at compromising organizational infrastructure, likely for espionage or data exfiltration purposes. The absence of specific affected versions or products implies a broad targeting scope, potentially affecting any organization susceptible to phishing and lacking robust endpoint protections.

Detailed information about HALFRIG - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="compromise infrastructure - t1584"'

Filter Threats