Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - #StopRansomware: Akira Ransomware

The Akira ransomware is a medium-severity threat identified through open-source intelligence (OSINT) and tracked by CIRCL under the #StopRansomware initiative. This ransomware employs multiple sophisticated attack techniques consistent with known ransomware behaviors, as mapped to MITRE ATT&CK patterns. Initial access vectors include spearphishing via attachments and links (T1566.001, T1566.002), exploitation of public-facing applications (T1190), and use of valid accounts (T1078). Post-compromise, Akira ransomware performs extensive reconnaissance activities such as system information discovery (T1082), network configuration discovery (T1016), domain trust discovery (T1482), process discovery (T1057), and enumeration of local and domain groups (T1069.001, T1069.002). Credential access techniques include harvesting credentials from LSASS memory (T1003.001) and from critical system files like /etc/passwd and /etc/shadow (T1003.008). The ransomware also manipulates domain accounts (T1136.002) and disables or modifies defensive tools (T1562.001) to evade detection. For lateral movement and persistence, it leverages remote access software (T1219) and connection proxies (T1090). Data exfiltration is conducted via alternative protocols (T1048) and cloud storage or cloud accounts (T1567.002, T1537). Finally, the ransomware encrypts data for impact (T1486) and inhibits system recovery mechanisms (T1490), effectively locking victims out of their data and demanding ransom. Although no known exploits are currently reported in the wild, the threat level is moderate, and the attack techniques indicate a well-rounded and potentially impactful ransomware campaign targeting both Europe and North America.

Detailed information about OSINT - #StopRansomware: Akira Ransomware affecting misp-galaxy ransomware. Get real-time updates, technical details, and mitigation 

OSINT - #StopRansomware: Akira Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control

The threat identified as AA22-138B involves threat actors chaining multiple VMware vulnerabilities to achieve full system control. This attack technique leverages a sequence of exploits targeting VMware products, which are widely used virtualization platforms in enterprise environments. The chaining of vulnerabilities allows attackers to escalate privileges, execute arbitrary code, and ultimately gain complete control over the affected system. The attack patterns associated with this threat include Unix shell command execution (T1059.004), modification of Linux and macOS file and directory permissions (T1222.002), ingress tool transfer (T1105), use of symmetric cryptography (T1573.001), malware deployment (T1588.001), exploitation for privilege escalation (T1068), AppleScript execution (T1059.002), clearing command history (T1070.003), use of web protocols for command and control (T1071.001), connection proxying (T1090), targeting of sensitive files like /etc/passwd and /etc/shadow (T1003.008), data archiving (T1560), exploitation for client execution (T1203), and deployment of web shells (T1505.003). Although no specific affected versions or patches are listed, the threat level is noted as moderate (3), and no known exploits are currently observed in the wild. The severity is marked as low in the source, but the technical details and attack complexity suggest a more nuanced risk profile. The attack requires chaining multiple vulnerabilities, indicating a sophisticated adversary capable of multi-stage exploitation. The absence of known exploits in the wild may reflect limited public exposure or recent discovery. Overall, this threat represents a complex, multi-vector attack against VMware virtualization environments that could lead to full system compromise if successfully executed.

Detailed information about AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control affecting tlp white. Get real-time updates, technical

AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -

The threat described is an ongoing cyber attack campaign identified by the German Federal Office for the Protection of the Constitution (BfV) and reported via OSINT sources. The campaign is attributed to the threat actor group known as Axiom, which is known for sophisticated cyber espionage activities. The attack leverages a wide range of advanced techniques mapped to MITRE ATT&CK patterns, indicating a multi-faceted and persistent intrusion approach. Key tactics include exploitation of external remote services (T1133), command-line interface usage (T1059), execution through APIs (T1106), and execution via rundll32 (T1085). The attackers also employ service execution (T1035), user execution (T1204), and DLL search order hijacking (T1038) to maintain persistence and evade detection. Kernel modules and extensions (T1215) and rootkits (T1014) suggest deep system compromise capabilities. Additional evasion techniques include disabling security tools (T1089), timestomping (T1099), binary padding (T1009), and software packing (T1045). The campaign uses custom command and control protocols (T1094), connection proxies (T1090), and fallback channels (T1008) to maintain resilient communications. The use of port knocking (T1205) and commonly used ports (T1043) further complicates detection. The campaign also manipulates system registries (T1112), deletes files (T1107), and employs process injection (T1055) to hide malicious activities. Execution guardrails (T1480) indicate targeted execution based on environment checks. Code signing (T1116) and deobfuscation techniques (T1140) are used to bypass security mechanisms. The campaign’s high severity rating and the broad spectrum of sophisticated techniques suggest a well-resourced and highly capable adversary focused on stealth, persistence, and data exfiltration. No specific affected software versions are listed, and no known exploits in the wild are reported, but the campaign’s complexity and persistence pose a significant threat to targeted organizations.

Detailed information about OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -. Get real-time updates, technical details, and mitigati

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne - - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="connection proxy - t1090"'

Filter Threats