Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

SANS ISC Handlers Diary

Threatpost

SecurityWeek

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Dissecting PlugX to Extract Its Crown Jewels - Live Threat Intelligence - Threat Radar | OffSeq.com

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm

BumbleBee is a modular backdoor malware that evolved from the previously known BookWorm backdoor. It employs a variety of sophisticated techniques to maintain persistence, evade detection, and facilitate remote control by threat actors. BumbleBee uses process injection (MITRE ATT&CK T1055) to execute malicious code within legitimate processes, thereby hiding its presence. It hijacks execution flow (T1574) and modifies system processes (T1543) to establish persistence, including through boot or logon autostart execution (T1547) and initialization scripts (T1037). The malware also incorporates execution guardrails (T1480) to limit its activity to specific environments, reducing the chance of accidental discovery. BumbleBee performs indicator removal on the host (T1070) to erase traces of its activity and uses keylogging and input capture techniques (T1056.001, T1056, T1417) to steal sensitive information. It gathers victim host information (T1592) to tailor its operations and uses web protocols (T1071.001) for command and control communications, often employing proxies (T1090) to obfuscate network traffic. Symmetric cryptography (T1573.001) is used to secure communications and payloads, complicating detection and analysis. BumbleBee’s modular architecture allows it to load and execute various payloads dynamically, increasing its flexibility and adaptability. Although no known exploits in the wild have been reported, its medium threat level and extensive use of stealth and persistence techniques make it a significant threat to targeted environments.

Detailed information about Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm. Get real-time updates, technical details, and mit

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm - Live Threat Intelligence - Threat Radar | OffSeq.com

The CERT-FR report highlights an extended campaign by the Sandworm intrusion set targeting Centreon systems. Centreon is an IT infrastructure monitoring software widely used to oversee network, server, and application performance. The Sandworm group, known for its sophisticated cyber-espionage and sabotage operations, exploits public-facing Centreon applications to gain unauthorized access. The attack techniques align with MITRE ATT&CK patterns such as exploiting public-facing applications (T1190), leveraging server software components (T1505), and creating or modifying system processes (T1543) to establish persistence. The adversaries also use scheduled tasks or jobs (T1053) and command and scripting interpreters (T1059) to execute malicious payloads. They abuse elevation control mechanisms (T1548) to gain higher privileges and employ deobfuscation techniques (T1140) to evade detection. Post-compromise activities include file and directory discovery (T1083), establishing encrypted command and control channels (T1573), using application layer protocols for communication (T1071), and exfiltrating data over these channels (T1041). Although no specific affected versions or patches are listed, the campaign's high confidence and almost-certain likelihood suggest active targeting of Centreon deployments, particularly in France. The threat level is moderate (4), and no known exploits in the wild have been reported yet, indicating a potential for future exploitation if mitigations are not applied.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems affecting misp-galaxy target-information. Get re

The reported threat involves a campaign by the Sandworm intrusion set targeting Centreon systems, as identified by CERT-FR and CIRCL. Sandworm is a well-known advanced persistent threat (APT) group associated with sophisticated cyber espionage and sabotage activities. Centreon is an IT infrastructure monitoring software widely used in enterprise environments, including Linux-based systems. The campaign exploits public-facing applications (MITRE ATT&CK T1190), likely leveraging vulnerabilities or misconfigurations in Centreon's web interface to gain initial access. Post-compromise activities include deploying web shells (T1505.003) for persistent remote control, performing file and directory discovery (T1083) to map the environment, and creating or modifying system processes or Windows services (T1543, T1543.003) to maintain persistence and escalate privileges. The attackers use symmetric and asymmetric cryptography (T1573.001, T1573.002) and encrypted channels (T1573) to secure command and control communications, complicating detection and analysis. Data exfiltration is conducted over these encrypted C2 channels (T1041). The threat targets Linux systems predominantly in Western Europe, with high confidence in the indicators of compromise (IOCs) accuracy. Although the severity is classified as low by CERT-FR, the involvement of a high-profile APT group and the use of advanced techniques indicate a targeted espionage campaign rather than widespread destructive attacks. No known exploits in the wild or patches are currently documented, suggesting either a zero-day or exploitation of configuration weaknesses. The campaign aligns with historical Sandworm tactics, including stealthy infiltration and long-term presence in victim networks.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems affecting fr-classif non-classifiees. Get real-time updates, tec

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="create or modify system process - t1543"'

Stop chasing alerts. Route them.

Filter Threats