Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group

The Winnti Group is a well-documented advanced persistent threat (APT) actor known for sophisticated cyber espionage and supply chain compromise operations. This OSINT report details the arsenal and methods employed by the Winnti Group, specifically focusing on their malware toolkit often referred to as "ShadowPad." The group leverages multiple advanced techniques to infiltrate targeted environments, maintain persistence, and exfiltrate sensitive data. Key attack patterns include supply chain compromise (MITRE ATT&CK T1195), where the adversary injects malicious code into legitimate software updates or installers, enabling widespread distribution of malware to downstream victims. The group also uses DLL search order hijacking (T1038) and hooking (T1179) to manipulate legitimate processes and evade detection. Code signing (T1116) is abused to make their malware appear trustworthy, while obfuscation techniques (T1027, T1140) and hidden files/directories (T1158) help conceal their presence. Process injection (T1055) and disabling security tools (T1089) further enhance stealth and persistence. The malware communicates using both standard application layer protocols (T1071) and custom cryptographic protocols (T1024), often over commonly used ports (T1043), complicating network detection. Multi-stage command and control channels (T1104) and data exfiltration over these channels (T1041) enable the group to siphon sensitive information covertly. Additionally, resource hijacking (T1496) and stored data manipulation (T1492) indicate potential for sabotage or disruption beyond espionage. The threat actor behind Winnti, also known as Axiom, has historically targeted technology, gaming, pharmaceutical, and telecommunications sectors, often focusing on supply chain vectors to maximize impact. Despite the lack of a patch or known exploits in the wild for this specific malware variant, the complexity and breadth of techniques suggest a highly capable adversary with significant operational security and persistence capabilities.

Detailed information about OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group. Get real-time updates, technical details, and miti

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group - Live Threat Intelligence - Threat Radar | OffSeq.com

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

The SNOWYAMBER campaign represents a sophisticated malware operation characterized by a multi-stage attack leveraging a variety of well-known tactics, techniques, and procedures (TTPs) as classified by the MITRE ATT&CK framework. The campaign employs phishing and spearphishing (T1566, T1566.001, T1566.002) as primary initial infection vectors, utilizing malicious attachments and links that require user execution (T1204, T1204.001, T1204.002). The attackers use advanced evasion techniques such as HTML smuggling (T1027.006) and right-to-left override (T1036.002) to bypass security controls and trick users into executing malicious payloads. Once executed, the malware establishes persistence through registry run keys and startup folder modifications (T1547.001) and employs DLL search order hijacking and side-loading (T1574.001, T1574.002) to maintain stealth and evade detection. The campaign also involves infrastructure compromise (T1584) and the use of virtual private servers and web services (T1583.003, T1583.006) to host command and control (C2) infrastructure. Communication with C2 servers is conducted via web services (T1102) and one-way communication channels (T1102.003), which may limit detection opportunities. The malware also incorporates techniques to bypass the 'mark-of-the-web' security feature (T1553.005) and deobfuscate or decode files or information (T1140), indicating a high level of sophistication in payload delivery and execution. The campaign is tagged with a threat level of 1 (high) and a certainty of 50%, suggesting ongoing analysis and partial confidence in attribution and impact assessment. No patches or known exploits are currently available, indicating that mitigation relies heavily on detection and prevention strategies rather than remediation of a specific vulnerability. The campaign's use of OSINT tools and infrastructure suggests a focus on reconnaissance and targeted attacks, potentially aimed at high-value targets through spearphishing and infrastructure compromise.

phishing email mimicking diplomatic correspondence. The link hidden under “here” leads to the ENVYSCOUT

Used to distribute phishing emails with a link to ENVYSCOUT

Used to distribute phishing emails with a link to i.php (reconnaissance?)

Detailed information about SNOWYAMBER - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

SNOWYAMBER - Malware Analysis Report - Live Threat Intelligence - Threat Radar | OffSeq.com

SNOWYAMBER - Malware Analysis Report

CustomerLoader: a new malware distributing a wide variety of payloads

CustomerLoader is a recently identified malware loader that functions as a distribution mechanism for a wide variety of malicious payloads. Classified as a downloader-type malware, CustomerLoader facilitates the delivery and execution of multiple secondary malware families, including well-known stealers and remote access trojans (RATs) such as Vidar, XLoader, Agent Tesla, AsyncRAT, Ave Maria, DarkCloud Stealer, RedLine Stealer, and others. The malware employs various sophisticated techniques to evade detection and hinder defensive measures, including symmetric cryptography for payload encryption (MITRE T1573.001), disabling or modifying security tools (T1562.001), obfuscation of files and information (T1027), dynamic API resolution (T1027.007), reflective code loading (T1620), and data obfuscation (T1001). It also leverages common infection vectors such as spearphishing attachments (T1566.001) and ingress tool transfer (T1105) to infiltrate target systems. CustomerLoader is notable for its modular design, allowing it to load and execute diverse payloads, thereby increasing its versatility and threat potential. Despite its medium severity rating and no known exploits in the wild at the time of reporting, its association with multiple high-profile malware families and advanced evasion techniques mark it as a significant threat. The malware’s capability to impair defenses and its use of web protocols for command and control communications further complicate detection and mitigation efforts.

Detailed information about CustomerLoader: a new malware distributing a wide variety of payloads. Get real-time updates, technical details, and mitigation strat

CustomerLoader: a new malware distributing a wide variety of payloads - Live Threat Intelligence - Threat Radar | OffSeq.com

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

QUARTERRIG is a sophisticated malware campaign characterized by its multi-faceted attack techniques, primarily targeting infrastructure through phishing and spearphishing methods. The campaign leverages a variety of MITRE ATT&CK techniques, including the use of virtual private servers (VPS) for infrastructure compromise (T1583.003, T1584), and employs phishing vectors such as spearphishing attachments (T1566.001) and links (T1566.002) to initiate user execution (T1204). The malware uses malicious files (T1204.002) delivered via HTML smuggling (T1027.006), a technique that bypasses traditional email and web security filters by embedding malicious payloads within seemingly benign HTML content. Once executed, QUARTERRIG establishes persistence through registry run keys and startup folder modifications (T1547.001), and employs DLL search order hijacking (T1574.001) and DLL side-loading (T1574.002) to evade detection and maintain execution within the victim environment. The campaign also utilizes deobfuscation and decoding techniques (T1140) to conceal its payloads and bypass mark-of-the-web protections (T1553.005), which are designed to warn users about potentially unsafe files downloaded from the internet. The absence of known exploits in the wild suggests that this campaign relies heavily on social engineering and user interaction to propagate. The threat level is assessed as high due to the combination of advanced persistence mechanisms, evasion techniques, and the exploitation of user trust via phishing. The campaign's use of VPS infrastructure indicates a well-resourced adversary capable of maintaining operational security and flexibility in attack delivery.

Detailed information about QUARTERRIG - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

QUARTERRIG - Malware Analysis Report - Live Threat Intelligence - Threat Radar | OffSeq.com

QUARTERRIG - Malware Analysis Report

The HALFRIG campaign represents a sophisticated malware operation primarily targeting infrastructure through a combination of phishing techniques and advanced persistence mechanisms. The campaign leverages spearphishing attachments (MITRE ATT&CK T1566.001) and user execution of malicious files (T1204.002) to initially compromise victims. The use of HTML smuggling (T1027.006) indicates that attackers embed malicious payloads within HTML content to bypass traditional email security filters and user suspicion. Once executed, HALFRIG employs registry run keys and startup folder modifications (T1547.001) to maintain persistence on infected systems. Additionally, the malware utilizes DLL search order hijacking (T1574.001) and DLL side-loading (T1574.002) techniques to evade detection and load malicious code under the guise of legitimate processes. The campaign also includes deobfuscation and decoding routines (T1140) to conceal its true nature and bypass security controls. The attackers exploit mark-of-the-web bypass techniques (T1553.005) to circumvent Windows security warnings that typically alert users to potentially unsafe files downloaded from the internet. The campaign infrastructure is supported by virtual private servers (T1583.003), indicating a well-resourced adversary capable of maintaining and rotating command and control (C2) assets. Although no known exploits are currently reported in the wild, the high confidence and almost-certain likelihood tags suggest active and ongoing operations. The campaign’s complexity and use of multiple advanced techniques highlight a targeted approach aimed at compromising organizational infrastructure, likely for espionage or data exfiltration purposes. The absence of specific affected versions or products implies a broad targeting scope, potentially affecting any organization susceptible to phishing and lacking robust endpoint protections.

Detailed information about HALFRIG - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

HALFRIG - Malware Analysis Report - Live Threat Intelligence - Threat Radar | OffSeq.com

HALFRIG - Malware Analysis Report

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="deobfuscate/decode files or information - t1140"'

Filter Threats