Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Reddit NetSec

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Dharma ransomware is a malware family known for encrypting victims' data to extort ransom payments. It primarily targets systems through the exploitation of external remote services (MITRE ATT&CK T1133) and the use of valid accounts (T1078), indicating that attackers often gain initial access by compromising legitimate credentials or leveraging exposed remote access protocols such as RDP. Once inside the network, Dharma employs scripting techniques (T1064) to automate its malicious activities, including file and directory discovery (T1083) and network share discovery (T1135), to identify valuable data and propagate across networked systems. The ransomware then encrypts data for impact (T1486), rendering files inaccessible and demanding payment for decryption keys. Despite its impactful behavior, the threat is currently assessed with a low severity rating, possibly due to limited exploitation in the wild or the availability of defensive measures. No patches are available for this ransomware, as it exploits access vectors rather than software vulnerabilities. Indicators of compromise are not provided, which may complicate detection efforts. The attack chain suggests that initial access is often gained through compromised credentials or exposed remote services, followed by lateral movement and encryption activities. The lack of known exploits in the wild and absence of a CVSS score indicate that while the ransomware is a known threat, its current operational impact may be limited or targeted.

Detailed information about Dharma Ransomware Event. Get real-time updates, technical details, and mitigation strategies.

Dharma Ransomware Event - Live Threat Intelligence - Threat Radar | OffSeq.com

Dharma Ransomware Event

OSINT - Inside the Dragon: DragonForce Ransomware Group

The DragonForce ransomware group is a known threat actor specializing in ransomware attacks, leveraging a variety of sophisticated techniques to infiltrate and compromise targeted networks. This group employs multiple MITRE ATT&CK techniques, including the use of valid accounts (T1078) and domain accounts (T1078.002) to gain initial access and maintain persistence. They utilize PowerShell (T1059.001) for execution of malicious scripts, and establish persistence through registry run keys and startup folders (T1547.001) as well as Windows services (T1543.003). To evade detection and hinder forensic analysis, DragonForce clears Windows event logs (T1070.001) and extracts credentials from LSASS memory (T1003.001). The group conducts domain trust discovery (T1482), remote system discovery (T1018), system network configuration discovery (T1016), system information discovery (T1082), and file and directory discovery (T1083) to map the network environment and identify valuable targets. They also exploit remote desktop protocol (RDP) (T1021.001) and web protocols (T1071.001) for lateral movement and command and control communications. The final stage involves encrypting data for impact (T1486), effectively locking victims out of their systems and demanding ransom payments. Although no known exploits are currently reported in the wild for this group, their tactics indicate a high level of operational capability and adaptability. The threat level is assessed as moderate (3 out of an unspecified scale), but the overall severity is currently rated low by the source, possibly reflecting limited observed impact or activity at this time.

Detailed information about OSINT - Inside the Dragon: DragonForce Ransomware Group. Get real-time updates, technical details, and mitigation strategies.

OSINT - Inside the Dragon: DragonForce Ransomware Group - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - #StopRansomware: Akira Ransomware

The Akira ransomware is a medium-severity threat identified through open-source intelligence (OSINT) and tracked by CIRCL under the #StopRansomware initiative. This ransomware employs multiple sophisticated attack techniques consistent with known ransomware behaviors, as mapped to MITRE ATT&CK patterns. Initial access vectors include spearphishing via attachments and links (T1566.001, T1566.002), exploitation of public-facing applications (T1190), and use of valid accounts (T1078). Post-compromise, Akira ransomware performs extensive reconnaissance activities such as system information discovery (T1082), network configuration discovery (T1016), domain trust discovery (T1482), process discovery (T1057), and enumeration of local and domain groups (T1069.001, T1069.002). Credential access techniques include harvesting credentials from LSASS memory (T1003.001) and from critical system files like /etc/passwd and /etc/shadow (T1003.008). The ransomware also manipulates domain accounts (T1136.002) and disables or modifies defensive tools (T1562.001) to evade detection. For lateral movement and persistence, it leverages remote access software (T1219) and connection proxies (T1090). Data exfiltration is conducted via alternative protocols (T1048) and cloud storage or cloud accounts (T1567.002, T1537). Finally, the ransomware encrypts data for impact (T1486) and inhibits system recovery mechanisms (T1490), effectively locking victims out of their data and demanding ransom. Although no known exploits are currently reported in the wild, the threat level is moderate, and the attack techniques indicate a well-rounded and potentially impactful ransomware campaign targeting both Europe and North America.

Detailed information about OSINT - #StopRansomware: Akira Ransomware affecting misp-galaxy ransomware. Get real-time updates, technical details, and mitigation 

OSINT - #StopRansomware: Akira Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free

The threat involves the Lorenz ransomware group exploiting vulnerabilities related to Mitel MiVoice, a unified communications platform widely used in enterprise telephony. The group reportedly cracked MiVoice systems, enabling them to make unauthorized calls without cost to themselves, indicating a compromise of telephony infrastructure. Lorenz ransomware is known for its sophisticated attack techniques, including exploitation of public-facing applications, deployment of web shells, use of encrypted communication channels, and credential harvesting from LSASS memory. The attack chain involves multiple MITRE ATT&CK techniques such as exploitation of public-facing applications (T1190), use of proxy tools (T1090), execution of PowerShell and Windows command shells (T1059.001, T1059.003), modification of registry keys (T1112), scheduled task creation for persistence (T1053, T1053.005), and discovery of system network configurations and security software (T1016, T1518.001). The ransomware encrypts data for impact (T1486) and may perform system shutdown or reboot to enforce encryption effects (T1529), while also clearing Windows event logs (T1070.001) to cover tracks. The use of chisel tools (both ELF and Windows variants) suggests tunneling or proxying capabilities to maintain covert communication channels. Although no known exploits in the wild are reported, the threat level is assessed as moderate (4 out of 10), with a low severity rating assigned by the source. The attack requires initial access to public-facing applications, which may be facilitated by misconfigurations or unpatched vulnerabilities. The lack of specific affected versions and patch links indicates that this is an open investigation or an intelligence report based on OSINT with moderate certainty (50%).

Detailed information about Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free affecting type osint. Get real-time updates, technical d

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free - Live Threat Intelligence - Threat Radar | OffSeq.com

MedusaLocker is a ransomware strain identified as a ransomware-as-a-service (RaaS) threat, which means it is distributed and operated by affiliates who use the malware to extort victims. This ransomware employs multiple attack techniques aligned with MITRE ATT&CK patterns, including exploitation of external remote services (T1133), phishing campaigns (T1566), and execution through PowerShell scripts (T1059.001). MedusaLocker also uses advanced persistence and evasion tactics such as booting the system in safe mode (T1562.009) to inhibit detection and removal. The ransomware encrypts victim data to impact availability (T1486) and actively inhibits system recovery mechanisms (T1490), such as deleting shadow copies or disabling recovery options, to prevent victims from restoring their systems without paying the ransom. Although no specific affected software versions are listed, the malware targets Windows environments given the use of PowerShell and safe mode boot techniques. No known exploits in the wild have been reported, but the threat level is high due to its ransomware nature and the sophistication of its attack vectors. The ransomware is distributed via phishing and exploitation of external remote services, which indicates that initial access can be gained through social engineering or exploiting exposed services such as RDP or VPNs. The lack of a CVSS score requires an independent severity assessment, which is high given the potential for significant confidentiality, integrity, and availability impacts, ease of exploitation through phishing or exposed services, and the broad scope of affected systems. MedusaLocker’s RaaS model increases its threat surface as multiple affiliates can deploy it, increasing the likelihood of attacks.

Detailed information about #StopRansomware: MedusaLocker. Get real-time updates, technical details, and mitigation strategies.

#StopRansomware: MedusaLocker - Live Threat Intelligence - Threat Radar | OffSeq.com

#StopRansomware: MedusaLocker

Kaseya ransomware attack - indicators and information publicly available

The Kaseya ransomware attack refers to a significant cybersecurity incident involving the exploitation of vulnerabilities in Kaseya's IT management software, which led to widespread ransomware deployment. The ransomware involved is identified as Sodinokibi (also known as REvil), a notorious ransomware family known for encrypting data to extort victims. The attack leveraged the supply chain by compromising Kaseya's VSA software, which is used by managed service providers (MSPs) to remotely manage client networks. By infiltrating the VSA platform, attackers were able to distribute ransomware payloads to numerous downstream organizations simultaneously, causing extensive data encryption and operational disruption. The attack pattern aligns with the MITRE ATT&CK technique T1486, 'Data Encrypted for Impact,' indicating the primary goal was to encrypt data to disrupt availability and demand ransom payments. Although no specific affected versions or patch links are provided, the attack's high severity and the nature of the threat suggest a critical vulnerability was exploited. The publicly available information and indicators are limited, with a moderate certainty level (50%) regarding some details. The threat level and analysis scores are minimal (1), indicating early-stage or limited technical details in the source. No known exploits in the wild beyond this incident are reported. Overall, the Kaseya ransomware attack exemplifies a sophisticated supply chain ransomware campaign with significant operational and financial impacts on affected organizations.

Detailed information about Kaseya ransomware attack - indicators and information publicly available. Get real-time updates, technical details, and mitigation st

Kaseya ransomware attack - indicators and information publicly available - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - DearCry ransomware (abusing Exchange Server)

The DearCry ransomware campaign targets Microsoft Exchange Server environments by exploiting vulnerabilities to deploy ransomware that encrypts data for impact. This campaign was publicly identified around March 2021 and is associated with post-exploitation activities following initial compromise of Exchange Servers. DearCry ransomware encrypts files on compromised systems, rendering data inaccessible and causing significant operational disruption. The attack leverages weaknesses in Exchange Server configurations or unpatched vulnerabilities to gain unauthorized access, then executes ransomware payloads to encrypt critical data. The campaign is characterized by data destruction and encryption tactics aligned with MITRE ATT&CK techniques T1485 (Data Destruction) and T1486 (Data Encrypted for Impact). Although no specific affected Exchange Server versions are listed, the threat is linked to Exchange Server exploitation, implying that unpatched or misconfigured Exchange environments are at risk. The campaign is assessed with high confidence and likelihood, indicating active or imminent threats to vulnerable systems. No known exploits in the wild were reported at the time of publication, but the threat remains relevant due to the widespread use of Exchange Servers and the persistent nature of ransomware campaigns targeting enterprise email infrastructure.

Detailed information about OSINT - DearCry ransomware (abusing Exchange Server). Get real-time updates, technical details, and mitigation strategies.

OSINT - DearCry ransomware (abusing Exchange Server) - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "Trickbot to Ryuk in Two Hours" describes a rapid attack chain leveraging the Trickbot malware to deploy Ryuk ransomware within a very short timeframe, approximately two hours. Trickbot is a modular banking Trojan that has evolved into a versatile malware platform used for credential theft, lateral movement, and network reconnaissance. In this campaign, Trickbot is used to gain initial access, perform extensive network and system discovery, credential dumping, and disable security tools to evade detection. The attack employs multiple MITRE ATT&CK techniques such as scheduled tasks (T1053) for persistence, disabling security tools (T1089), group policy modification (T1484), process injection (T1055), and obfuscated files or information (T1027) to maintain stealth and control. The adversaries leverage valid accounts (T1078) and credential dumping (T1003) to escalate privileges and move laterally across the network. Discovery techniques include system network connections (T1049), software and security software discovery (T1518, T1063), remote system discovery (T1018), and network share discovery (T1135). Remote services (T1021), remote desktop protocol (T1076), and remote file copy (T1105) facilitate lateral movement and payload deployment. The final stage involves deploying Ryuk ransomware, which encrypts data for impact (T1486), causing significant operational disruption. The campaign is known to utilize tools like Cobalt Strike and PowerView for post-exploitation activities. The rapid progression from initial compromise to ransomware deployment underscores the high operational tempo and sophistication of the threat actors behind this campaign.

Detailed information about Trickbot to Ryuk in Two Hours. Get real-time updates, technical details, and mitigation strategies.

Trickbot to Ryuk in Two Hours - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot to Ryuk in Two Hours

Harma and Odveta are ransomware families identified as malware threats that employ several common tactics, techniques, and procedures (TTPs) associated with ransomware attacks. These ransomware variants utilize command-line interfaces (MITRE ATT&CK T1059) to execute malicious commands, which may facilitate automation and stealth during infection and propagation. They also leverage registry run keys or startup folders (T1060) to maintain persistence on infected systems, ensuring that the ransomware executes upon system reboot or user login. Communication with external remote services (T1133) suggests that these ransomware variants may receive commands or exfiltrate data to attacker-controlled infrastructure. The use of commonly used ports (T1043) indicates attempts to blend malicious network traffic with legitimate traffic, potentially evading network detection mechanisms. The primary impact of these ransomware families is data encryption for impact (T1486), which encrypts victim data to deny access and demands ransom payments for decryption keys. Despite being categorized with a low severity by the source, the ransomware's capabilities to encrypt data and maintain persistence pose significant risks to affected organizations. There are no known exploits in the wild specifically targeting vulnerabilities for initial infection, suggesting that infection vectors may rely on social engineering, phishing, or exploitation of external remote services. The lack of affected versions and patch links indicates that this ransomware targets general systems rather than specific software vulnerabilities. Overall, Harma and Odveta ransomware represent typical ransomware threats that combine persistence, encryption, and network communication to disrupt operations and extort victims.

Detailed information about Harma and Odveta Ransomware. Get real-time updates, technical details, and mitigation strategies.

Harma and Odveta Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

Harma and Odveta Ransomware

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="data encrypted for impact - t1486"'

Filter Threats