Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat campaign titled "Trickbot to Ryuk in Two Hours" describes a rapid attack chain leveraging the Trickbot malware to deploy Ryuk ransomware within a very short timeframe, approximately two hours. Trickbot is a modular banking Trojan that has evolved into a versatile malware platform used for credential theft, lateral movement, and network reconnaissance. In this campaign, Trickbot is used to gain initial access, perform extensive network and system discovery, credential dumping, and disable security tools to evade detection. The attack employs multiple MITRE ATT&CK techniques such as scheduled tasks (T1053) for persistence, disabling security tools (T1089), group policy modification (T1484), process injection (T1055), and obfuscated files or information (T1027) to maintain stealth and control. The adversaries leverage valid accounts (T1078) and credential dumping (T1003) to escalate privileges and move laterally across the network. Discovery techniques include system network connections (T1049), software and security software discovery (T1518, T1063), remote system discovery (T1018), and network share discovery (T1135). Remote services (T1021), remote desktop protocol (T1076), and remote file copy (T1105) facilitate lateral movement and payload deployment. The final stage involves deploying Ryuk ransomware, which encrypts data for impact (T1486), causing significant operational disruption. The campaign is known to utilize tools like Cobalt Strike and PowerView for post-exploitation activities. The rapid progression from initial compromise to ransomware deployment underscores the high operational tempo and sophistication of the threat actors behind this campaign.

Detailed information about Trickbot to Ryuk in Two Hours. Get real-time updates, technical details, and mitigation strategies.

Trickbot to Ryuk in Two Hours - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot to Ryuk in Two Hours

OSINT - Letâ€™s play (again) with Predator the thief â€“ Fumik0_'s box

The threat described pertains to "Predator the thief," a known malware family focused on credential theft. The information is derived from OSINT sources and is cataloged within the MISP Galaxy framework under the Malpedia project. Predator the thief is designed to extract sensitive credentials from compromised systems by leveraging multiple attack techniques aligned with MITRE ATT&CK patterns, including credential dumping (T1003), exploitation for credential access (T1212), stealing credentials from web browsers (T1503), extracting credentials stored in files (T1081), and accessing credentials stored in the Windows registry (T1214). These techniques enable the malware to harvest a wide range of authentication data, such as saved passwords, session tokens, and other secrets that can be used for lateral movement or further compromise. The threat level is indicated as moderate (3 out of an unspecified scale), with a low severity rating assigned by the source. No specific affected product versions are listed, and there are no known exploits in the wild tied to this particular report. The information is primarily OSINT-based, originating from blog posts and public analysis, which suggests that the threat is known but not currently widespread or actively exploited at scale. The malware's capability to steal credentials from multiple sources within a system makes it a persistent risk for organizations that do not have adequate endpoint protection and credential management strategies in place.

Detailed information about OSINT - Letâ€™s play (again) with Predator the thief â€“ Fumik0_'s box affecting misp-galaxy malpedia. Get real-time updates, technic

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="credential dumping - t1003"'

Filter Threats