Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Dissecting PlugX to Extract Its Crown Jewels - Live Threat Intelligence - Threat Radar | OffSeq.com

Racoon Stealer is a low-severity information-stealing malware campaign primarily classified as a keylogger and infostealer. It operates by leveraging multiple attack techniques consistent with the MITRE ATT&CK framework, including spearphishing attachments (T1193) to deliver the payload, execution via PowerShell (T1086) and command-line interface (T1059), and use of commonly used ports (T1043) for communication. The malware performs remote file copying (T1105) to exfiltrate data and compresses collected information (T1002) before sending it over its command and control (C2) channels (T1041). Automated collection techniques (T1119) and gathering data from the local system (T1005) are also employed to maximize data theft. Despite the absence of known exploits in the wild and a low severity rating, Racoon Stealer poses a risk by stealthily harvesting sensitive information such as credentials, personal data, and potentially financial information. The use of PowerShell and command-line interfaces indicates an ability to evade traditional detection methods, while spearphishing remains the primary infection vector, relying on user interaction to open malicious attachments. The campaign's technical details suggest moderate threat level but limited analysis data is available, indicating a need for further investigation and monitoring.

Detailed information about Racoon Stealer. Get real-time updates, technical details, and mitigation strategies.

Racoon Stealer - Live Threat Intelligence - Threat Radar | OffSeq.com

Racoon Stealer

This threat involves malicious packages published on the Python Package Index (PyPI), a widely used repository for Python software libraries. Attackers upload malicious packages that appear legitimate but contain harmful code designed to compromise systems that install them. The campaign is categorized under supply chain compromise (MITRE ATT&CK T1195), indicating that attackers exploit the software supply chain by injecting malicious code into packages that developers and organizations trust and use in their projects. Once installed, these malicious packages can exfiltrate data from the local system (T1005) and transmit it over alternative network media (T1011), potentially bypassing traditional network monitoring. The threat leverages the trust developers place in PyPI packages, making it a potent vector for widespread compromise. Although no specific affected versions or exploits in the wild are documented, the high severity rating and the nature of the attack suggest a significant risk. The campaign was first identified in December 2019, and the certainty of the information is 100%, indicating confirmed malicious activity. The lack of patch links implies that mitigation relies primarily on detection and prevention rather than fixes to the PyPI platform itself. This threat underscores the risks inherent in open-source software supply chains, where malicious actors can insert harmful code into widely used libraries, potentially impacting any organization that uses Python packages without thorough vetting.

Detailed information about Malicious PyPI packages. Get real-time updates, technical details, and mitigation strategies.

Malicious PyPI packages - Live Threat Intelligence - Threat Radar | OffSeq.com

Malicious PyPI packages

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Operation Ghost - White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost - White Paper

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

SectorJ04 Groupâ€™s Increased Activity in 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "OSINT - Sharpening the Machete" is associated with the threat actor group "El Machete" and involves a range of sophisticated tactics, techniques, and procedures (TTPs) primarily centered around spear-phishing attacks. The campaign leverages spear-phishing via both attachments (MITRE ATT&CK T1193) and links (T1192) to initiate user execution (T1204), which is a critical step for initial compromise. Once inside the target environment, the threat actor employs scheduled tasks (T1053) to maintain persistence and uses various evasion techniques such as hiding files and directories (T1158), obfuscating files or information (T1027), software packing (T1045), and masquerading (T1036) to avoid detection by security tools. The campaign also involves credential theft techniques, including harvesting private keys (T1145) and credentials stored in files (T1081), which facilitate lateral movement and privilege escalation.

Reconnaissance and discovery activities are extensive, including system network connections discovery (T1049), peripheral device discovery (T1120), file and directory discovery (T1083), browser bookmark discovery (T1217), process discovery (T1057), and application window discovery (T1010). Data collection techniques include clipboard data capture (T1115), gathering data from local systems (T1005), and removable media (T1025). The adversary stages data (T1074) and captures input (T1056) and screen content (T1113) to maximize intelligence gathering.

For command and control (C2) and data exfiltration, the threat actor uses commonly used ports (T1043), fallback channels (T1008), and standard application layer protocols (T1071) to blend in with legitimate traffic. Remote file copy (T1105) and automated exfiltration (T1020) techniques are employed to transfer data stealthily. Data is often compressed (T1002) and encrypted (T1022) before exfiltration, which can occur over C2 channels (T1041), physical media (T1052), or scheduled transfers (T1029). The campaign is characterized by a moderate threat level and analysis confidence, with a low severity rating assigned by the source but involving a broad spectrum of attack vectors and techniques.

Overall, this campaign represents a targeted, multi-stage attack focusing on spear-phishing to gain initial access, followed by extensive reconnaissance, credential theft, persistence, and sophisticated data exfiltration methods. The use of obfuscation and masquerading techniques indicates a focus on evading detection and maintaining long-term presence within victim networks.

Detailed information about OSINT - Sharpening the Machete. Get real-time updates, technical details, and mitigation strategies.

OSINT - Sharpening the Machete - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Sharpening the Machete

Zebrocy is a malware family primarily classified as a backdoor, known for its use in targeted intrusion campaigns. It is associated with a range of sophisticated attack techniques as cataloged in the MITRE ATT&CK framework. Zebrocy typically employs spearphishing links (T1192) to initiate infection, relying on user execution (T1204) to activate its payload. The malware leverages Windows native utilities such as rundll32 (T1085) and Windows Management Instrumentation (WMI) (T1047) to execute malicious code and maintain persistence. Persistence mechanisms include scheduled tasks (T1053), registry run keys/startup folder modifications (T1060), and Component Object Model (COM) hijacking (T1122). Zebrocy also attempts to disable security tools (T1089) and delete files (T1107) to evade detection and hinder forensic analysis.

Once established, Zebrocy conducts extensive reconnaissance activities including process discovery (T1057), system information discovery (T1082), file and directory discovery (T1083), and registry queries (T1012). It collects data from local systems (T1005), network shared drives (T1039), and removable media (T1025), staging this data (T1074) for exfiltration. Zebrocy employs input capture (T1056) and screen capture (T1113) techniques to gather sensitive user information. Data exfiltration is performed over command and control (C2) channels (T1041) using commonly used ports (T1043) and custom cryptographic protocols (T1024), often with multilayer encryption (T1079) and data obfuscation (T1001) to avoid detection. The malware uses fallback channels (T1008) and standard application layer protocols (T1071) to maintain communication resilience.

Zebrocy is notable for its modularity and use of AutoIt scripting in some variants, facilitating rapid development and deployment. Although no known exploits are currently reported in the wild for this malware, its extensive use of legitimate Windows features and complex evasion techniques make it a persistent threat in targeted environments. The threat level is moderate (3/10), with a low severity rating assigned, reflecting the requirement for user interaction and the targeted nature of attacks rather than widespread automated exploitation.

Detailed information about OSINT - A journey to Zebrocy land. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="data from local system - t1005"'

Filter Threats