Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The provided information pertains to an OSINT report analyzing a breach and attack campaign targeting Uber, focusing on various MITRE ATT&CK techniques observed during the incident. The campaign involves multiple tactics and techniques typically used in credential theft and lateral movement within compromised environments. Key attack patterns include spearphishing via service (T1566.003, T1194), which indicates attackers used targeted phishing campaigns through trusted services to gain initial access. The use of valid accounts (T1078) and domain accounts (T1078.002, T1087.002, T1136.002) suggests attackers leveraged compromised credentials to move laterally and maintain persistence. Techniques such as credentials in files (T1552.001, T1081) and network share discovery (T1135) further indicate attempts to harvest credentials and explore network resources. External remote services (T1133) were likely exploited to facilitate remote access. The attackers also attempted to bypass multi-factor authentication by generating MFA requests (T1621), a sophisticated method to circumvent additional security layers. Data exfiltration was conducted over alternative protocols (T1048), implying the use of non-standard channels to evade detection. The campaign is classified as a system compromise with a low severity rating by the source, though the complexity of techniques used indicates a well-orchestrated attack. No known exploits in the wild or patches are associated, and the certainty of the OSINT is moderate (50%). The threat level is rated 4 on an unspecified scale, suggesting a notable but not critical threat. Overall, the attack demonstrates a combination of social engineering, credential theft, lateral movement, and data exfiltration techniques consistent with advanced persistent threat (APT) behavior targeting a high-profile organization.

Detailed information about OSINT - Uber Breach & Attack Analysis. Get real-time updates, technical details, and mitigation strategies.

OSINT - Uber Breach & Attack Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Uber Breach & Attack Analysis

OSINT - Letâ€™s play (again) with Predator the thief â€“ Fumik0_'s box

The threat described pertains to "Predator the thief," a known malware family focused on credential theft. The information is derived from OSINT sources and is cataloged within the MISP Galaxy framework under the Malpedia project. Predator the thief is designed to extract sensitive credentials from compromised systems by leveraging multiple attack techniques aligned with MITRE ATT&CK patterns, including credential dumping (T1003), exploitation for credential access (T1212), stealing credentials from web browsers (T1503), extracting credentials stored in files (T1081), and accessing credentials stored in the Windows registry (T1214). These techniques enable the malware to harvest a wide range of authentication data, such as saved passwords, session tokens, and other secrets that can be used for lateral movement or further compromise. The threat level is indicated as moderate (3 out of an unspecified scale), with a low severity rating assigned by the source. No specific affected product versions are listed, and there are no known exploits in the wild tied to this particular report. The information is primarily OSINT-based, originating from blog posts and public analysis, which suggests that the threat is known but not currently widespread or actively exploited at scale. The malware's capability to steal credentials from multiple sources within a system makes it a persistent risk for organizations that do not have adequate endpoint protection and credential management strategies in place.

Detailed information about OSINT - Letâ€™s play (again) with Predator the thief â€“ Fumik0_'s box affecting misp-galaxy malpedia. Get real-time updates, technic

OSINT - Letâ€™s play (again) with Predator the thief â€“ Fumik0_'s box - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils

The Aggah malspam campaign is a low-severity threat involving the distribution of malicious spam emails that employ a diverse set of attack techniques to compromise targeted systems. The campaign leverages multiple MITRE ATT&CK techniques, including execution via scheduled tasks (T1053), command-line interface usage (T1059), scripting (T1064), PowerShell execution (T1086), API-based execution (T1106), and mshta (T1170). Persistence mechanisms include registry run keys and startup folder manipulation (T1060). The campaign also uses process injection (T1055) to evade detection and maintain stealth. To obfuscate its activities, it employs deobfuscation and decoding of files or information (T1140). Credential theft is facilitated through credentials stored in files (T1081), and input capture (T1056) and screen capture (T1113) techniques are used for espionage or data exfiltration. Communication may occur over uncommonly used ports (T1065), potentially bypassing standard network monitoring. The campaign is characterized by its diversification of tools and techniques, making detection and mitigation more challenging. Although no known exploits in the wild are reported, the campaign's use of multiple attack vectors and persistence methods indicates a sophisticated approach to compromise and maintain access to victim systems. The threat level is assessed as low, with a certainty of 50%, indicating moderate confidence in the intelligence. The campaign was first reported in October 2019 by CIRCL and is cataloged under the MISP galaxy with multiple MITRE ATT&CK patterns.

Detailed information about OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils. Get real-time updates, technical details, 

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "OSINT - Sharpening the Machete" is associated with the threat actor group "El Machete" and involves a range of sophisticated tactics, techniques, and procedures (TTPs) primarily centered around spear-phishing attacks. The campaign leverages spear-phishing via both attachments (MITRE ATT&CK T1193) and links (T1192) to initiate user execution (T1204), which is a critical step for initial compromise. Once inside the target environment, the threat actor employs scheduled tasks (T1053) to maintain persistence and uses various evasion techniques such as hiding files and directories (T1158), obfuscating files or information (T1027), software packing (T1045), and masquerading (T1036) to avoid detection by security tools. The campaign also involves credential theft techniques, including harvesting private keys (T1145) and credentials stored in files (T1081), which facilitate lateral movement and privilege escalation.

Reconnaissance and discovery activities are extensive, including system network connections discovery (T1049), peripheral device discovery (T1120), file and directory discovery (T1083), browser bookmark discovery (T1217), process discovery (T1057), and application window discovery (T1010). Data collection techniques include clipboard data capture (T1115), gathering data from local systems (T1005), and removable media (T1025). The adversary stages data (T1074) and captures input (T1056) and screen content (T1113) to maximize intelligence gathering.

For command and control (C2) and data exfiltration, the threat actor uses commonly used ports (T1043), fallback channels (T1008), and standard application layer protocols (T1071) to blend in with legitimate traffic. Remote file copy (T1105) and automated exfiltration (T1020) techniques are employed to transfer data stealthily. Data is often compressed (T1002) and encrypted (T1022) before exfiltration, which can occur over C2 channels (T1041), physical media (T1052), or scheduled transfers (T1029). The campaign is characterized by a moderate threat level and analysis confidence, with a low severity rating assigned by the source but involving a broad spectrum of attack vectors and techniques.

Overall, this campaign represents a targeted, multi-stage attack focusing on spear-phishing to gain initial access, followed by extensive reconnaissance, credential theft, persistence, and sophisticated data exfiltration methods. The use of obfuscation and masquerading techniques indicates a focus on evading detection and maintaining long-term presence within victim networks.

Detailed information about OSINT - Sharpening the Machete. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="credentials in files - t1081"'

Stop chasing alerts. Route them.

Filter Threats