Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT -Advisory: Turla group exploits Iranian APT to expand coverage of victims

The Turla group, a sophisticated and well-known advanced persistent threat (APT) actor, has been observed leveraging Iranian APT infrastructure to expand its victim base. This campaign, identified through open-source intelligence (OSINT) and reported by CIRCL, demonstrates Turla's strategic exploitation of existing Iranian APT tools and networks to broaden operational reach. Turla is recognized for targeting governmental, diplomatic, and critical infrastructure entities globally, employing advanced cyber espionage techniques. The group uses custom command and control (C2) protocols, specifically MITRE ATT&CK technique T1094, to maintain stealthy and resilient communications with compromised hosts. The malware families associated with this campaign, 'Nautilus' and 'Neuron,' facilitate data exfiltration and remote control of infected systems. The exploitation of Iranian APT infrastructure suggests either operational collaboration or opportunistic use of compromised assets, enabling Turla to mask its activities or leverage existing footholds within targeted networks. Although the advisory rates the severity as low and no patches or known exploits in the wild are currently reported, the campaign's perpetual nature and moderate certainty (50%) indicate ongoing monitoring is necessary. The technical details remain limited, but the use of custom C2 protocols and sophisticated malware underscores Turla's advanced capabilities. The advisory and supporting documents, including a UK National Cyber Security Centre (NCSC) report, provide further context on Turla's tactics and infrastructure exploitation methods.

Detailed information about OSINT -Advisory: Turla group exploits Iranian APT to expand coverage of victims. Get real-time updates, technical details, and mitiga

OSINT -Advisory: Turla group exploits Iranian APT to expand coverage of victims - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -

The threat described is an ongoing cyber attack campaign identified by the German Federal Office for the Protection of the Constitution (BfV) and reported via OSINT sources. The campaign is attributed to the threat actor group known as Axiom, which is known for sophisticated cyber espionage activities. The attack leverages a wide range of advanced techniques mapped to MITRE ATT&CK patterns, indicating a multi-faceted and persistent intrusion approach. Key tactics include exploitation of external remote services (T1133), command-line interface usage (T1059), execution through APIs (T1106), and execution via rundll32 (T1085). The attackers also employ service execution (T1035), user execution (T1204), and DLL search order hijacking (T1038) to maintain persistence and evade detection. Kernel modules and extensions (T1215) and rootkits (T1014) suggest deep system compromise capabilities. Additional evasion techniques include disabling security tools (T1089), timestomping (T1099), binary padding (T1009), and software packing (T1045). The campaign uses custom command and control protocols (T1094), connection proxies (T1090), and fallback channels (T1008) to maintain resilient communications. The use of port knocking (T1205) and commonly used ports (T1043) further complicates detection. The campaign also manipulates system registries (T1112), deletes files (T1107), and employs process injection (T1055) to hide malicious activities. Execution guardrails (T1480) indicate targeted execution based on environment checks. Code signing (T1116) and deobfuscation techniques (T1140) are used to bypass security mechanisms. The campaign’s high severity rating and the broad spectrum of sophisticated techniques suggest a well-resourced and highly capable adversary focused on stealth, persistence, and data exfiltration. No specific affected software versions are listed, and no known exploits in the wild are reported, but the campaign’s complexity and persistence pose a significant threat to targeted organizations.

Detailed information about OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -. Get real-time updates, technical details, and mitigati

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne - - Live Threat Intelligence - Threat Radar | OffSeq.com

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

SectorJ04 Groupâ€™s Increased Activity in 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Threat Spotlight: Ratsnif - New Network Vermin from OceanLotus

Ratsnif is a malware campaign attributed to the advanced persistent threat (APT) group OceanLotus, also known as APT32. This threat actor is known for targeting organizations primarily in Southeast Asia but has global reach. Ratsnif is described as a 'network vermin,' indicating it is a stealthy, persistent network-based malware designed for command and control (C2) communications and data exfiltration. The malware uses custom command and control protocols (MITRE ATT&CK T1094) and operates over commonly used network ports (T1043), which helps it evade detection by blending in with normal network traffic. The campaign was publicly spotlighted in 2019 by CIRCL, with a high confidence level (93%) in the analytic judgment. Although the severity is rated low, this likely reflects the limited scope or impact observed at the time rather than the intrinsic capabilities of the malware. No known exploits in the wild have been reported, and no specific affected software versions are listed, suggesting that Ratsnif is a targeted tool rather than a widespread vulnerability exploitation. The malware’s stealthy network behavior and custom C2 protocol make it a sophisticated tool for espionage and persistent access, consistent with OceanLotus’s known tactics of targeting government, diplomatic, and corporate entities to gather sensitive intelligence.

Detailed information about OSINT - Threat Spotlight: Ratsnif - New Network Vermin from OceanLotus. Get real-time updates, technical details, and mitigation stra

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="custom command and control protocol - t1094"'

Stop chasing alerts. Route them.

Filter Threats