Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Dissecting PlugX to Extract Its Crown Jewels - Live Threat Intelligence - Threat Radar | OffSeq.com

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free

The threat involves the Lorenz ransomware group exploiting vulnerabilities related to Mitel MiVoice, a unified communications platform widely used in enterprise telephony. The group reportedly cracked MiVoice systems, enabling them to make unauthorized calls without cost to themselves, indicating a compromise of telephony infrastructure. Lorenz ransomware is known for its sophisticated attack techniques, including exploitation of public-facing applications, deployment of web shells, use of encrypted communication channels, and credential harvesting from LSASS memory. The attack chain involves multiple MITRE ATT&CK techniques such as exploitation of public-facing applications (T1190), use of proxy tools (T1090), execution of PowerShell and Windows command shells (T1059.001, T1059.003), modification of registry keys (T1112), scheduled task creation for persistence (T1053, T1053.005), and discovery of system network configurations and security software (T1016, T1518.001). The ransomware encrypts data for impact (T1486) and may perform system shutdown or reboot to enforce encryption effects (T1529), while also clearing Windows event logs (T1070.001) to cover tracks. The use of chisel tools (both ELF and Windows variants) suggests tunneling or proxying capabilities to maintain covert communication channels. Although no known exploits in the wild are reported, the threat level is assessed as moderate (4 out of 10), with a low severity rating assigned by the source. The attack requires initial access to public-facing applications, which may be facilitated by misconfigurations or unpatched vulnerabilities. The lack of specific affected versions and patch links indicates that this is an open investigation or an intelligence report based on OSINT with moderate certainty (50%).

Detailed information about Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free affecting type osint. Get real-time updates, technical d

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free - Live Threat Intelligence - Threat Radar | OffSeq.com

The CERT-FR report highlights an extended campaign by the Sandworm intrusion set targeting Centreon systems. Centreon is an IT infrastructure monitoring software widely used to oversee network, server, and application performance. The Sandworm group, known for its sophisticated cyber-espionage and sabotage operations, exploits public-facing Centreon applications to gain unauthorized access. The attack techniques align with MITRE ATT&CK patterns such as exploiting public-facing applications (T1190), leveraging server software components (T1505), and creating or modifying system processes (T1543) to establish persistence. The adversaries also use scheduled tasks or jobs (T1053) and command and scripting interpreters (T1059) to execute malicious payloads. They abuse elevation control mechanisms (T1548) to gain higher privileges and employ deobfuscation techniques (T1140) to evade detection. Post-compromise activities include file and directory discovery (T1083), establishing encrypted command and control channels (T1573), using application layer protocols for communication (T1071), and exfiltrating data over these channels (T1041). Although no specific affected versions or patches are listed, the campaign's high confidence and almost-certain likelihood suggest active targeting of Centreon deployments, particularly in France. The threat level is moderate (4), and no known exploits in the wild have been reported yet, indicating a potential for future exploitation if mitigations are not applied.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems affecting misp-galaxy target-information. Get re

The reported threat involves a campaign by the Sandworm intrusion set targeting Centreon systems, as identified by CERT-FR and CIRCL. Sandworm is a well-known advanced persistent threat (APT) group associated with sophisticated cyber espionage and sabotage activities. Centreon is an IT infrastructure monitoring software widely used in enterprise environments, including Linux-based systems. The campaign exploits public-facing applications (MITRE ATT&CK T1190), likely leveraging vulnerabilities or misconfigurations in Centreon's web interface to gain initial access. Post-compromise activities include deploying web shells (T1505.003) for persistent remote control, performing file and directory discovery (T1083) to map the environment, and creating or modifying system processes or Windows services (T1543, T1543.003) to maintain persistence and escalate privileges. The attackers use symmetric and asymmetric cryptography (T1573.001, T1573.002) and encrypted channels (T1573) to secure command and control communications, complicating detection and analysis. Data exfiltration is conducted over these encrypted C2 channels (T1041). The threat targets Linux systems predominantly in Western Europe, with high confidence in the indicators of compromise (IOCs) accuracy. Although the severity is classified as low by CERT-FR, the involvement of a high-profile APT group and the use of advanced techniques indicate a targeted espionage campaign rather than widespread destructive attacks. No known exploits in the wild or patches are currently documented, suggesting either a zero-day or exploitation of configuration weaknesses. The campaign aligns with historical Sandworm tactics, including stealthy infiltration and long-term presence in victim networks.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems affecting fr-classif non-classifiees. Get real-time updates, tec

OSINT - Kobalos – A complex Linux threat to high performance computing infrastructure

Kobalos is a sophisticated Linux-based threat specifically targeting high performance computing (HPC) infrastructure. It is characterized by its complexity and stealth, designed to compromise client software binaries within HPC environments. The threat employs multiple advanced techniques including software packing to evade detection, timestomping and clearing command history to cover tracks, and establishing encrypted communication channels to securely exfiltrate data or receive commands. It also uses proxy mechanisms and traffic signaling to maintain persistence and communicate covertly within the network. The attack patterns align with MITRE ATT&CK techniques such as T1554 (compromise client software binary), T1205 (traffic signaling), T1070.003 (clear command history), T1070.006 (timestomp), T1027.002 (software packing), T1573 (encrypted channel), and T1090 (proxy). Although no known exploits are reported in the wild, the threat is considered medium severity due to its targeted nature and potential impact on critical HPC systems. The threat’s focus on HPC environments suggests it aims at organizations relying on large-scale computational resources, which are often used in scientific research, financial modeling, and critical infrastructure simulations. The complexity and stealth techniques indicate a well-resourced adversary capable of long-term covert operations within targeted networks.

Detailed information about OSINT - Kobalos – A complex Linux threat to high performance computing infrastructure. Get real-time updates, technical details, and 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="encrypted channel - t1573"'

Filter Threats