Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -

The threat described is an ongoing cyber attack campaign identified by the German Federal Office for the Protection of the Constitution (BfV) and reported via OSINT sources. The campaign is attributed to the threat actor group known as Axiom, which is known for sophisticated cyber espionage activities. The attack leverages a wide range of advanced techniques mapped to MITRE ATT&CK patterns, indicating a multi-faceted and persistent intrusion approach. Key tactics include exploitation of external remote services (T1133), command-line interface usage (T1059), execution through APIs (T1106), and execution via rundll32 (T1085). The attackers also employ service execution (T1035), user execution (T1204), and DLL search order hijacking (T1038) to maintain persistence and evade detection. Kernel modules and extensions (T1215) and rootkits (T1014) suggest deep system compromise capabilities. Additional evasion techniques include disabling security tools (T1089), timestomping (T1099), binary padding (T1009), and software packing (T1045). The campaign uses custom command and control protocols (T1094), connection proxies (T1090), and fallback channels (T1008) to maintain resilient communications. The use of port knocking (T1205) and commonly used ports (T1043) further complicates detection. The campaign also manipulates system registries (T1112), deletes files (T1107), and employs process injection (T1055) to hide malicious activities. Execution guardrails (T1480) indicate targeted execution based on environment checks. Code signing (T1116) and deobfuscation techniques (T1140) are used to bypass security mechanisms. The campaign’s high severity rating and the broad spectrum of sophisticated techniques suggest a well-resourced and highly capable adversary focused on stealth, persistence, and data exfiltration. No specific affected software versions are listed, and no known exploits in the wild are reported, but the campaign’s complexity and persistence pose a significant threat to targeted organizations.

Detailed information about OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -. Get real-time updates, technical details, and mitigati

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne - - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils

The Aggah malspam campaign is a low-severity threat involving the distribution of malicious spam emails that employ a diverse set of attack techniques to compromise targeted systems. The campaign leverages multiple MITRE ATT&CK techniques, including execution via scheduled tasks (T1053), command-line interface usage (T1059), scripting (T1064), PowerShell execution (T1086), API-based execution (T1106), and mshta (T1170). Persistence mechanisms include registry run keys and startup folder manipulation (T1060). The campaign also uses process injection (T1055) to evade detection and maintain stealth. To obfuscate its activities, it employs deobfuscation and decoding of files or information (T1140). Credential theft is facilitated through credentials stored in files (T1081), and input capture (T1056) and screen capture (T1113) techniques are used for espionage or data exfiltration. Communication may occur over uncommonly used ports (T1065), potentially bypassing standard network monitoring. The campaign is characterized by its diversification of tools and techniques, making detection and mitigation more challenging. Although no known exploits in the wild are reported, the campaign's use of multiple attack vectors and persistence methods indicates a sophisticated approach to compromise and maintain access to victim systems. The threat level is assessed as low, with a certainty of 50%, indicating moderate confidence in the intelligence. The campaign was first reported in October 2019 by CIRCL and is cataloged under the MISP galaxy with multiple MITRE ATT&CK patterns.

Detailed information about OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils. Get real-time updates, technical details, 

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Operation Ghost - White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost - White Paper

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

SectorJ04 Groupâ€™s Increased Activity in 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

The Gamaredon group is a known cyber espionage threat actor primarily associated with persistent and targeted campaigns. This OSINT report highlights the group's use of various MITRE ATT&CK techniques including command-line interface execution (T1059), execution through API (T1106), scripting (T1064), scheduled tasks (T1053), and registry modifications and queries (T1112, T1012). These techniques indicate a sophisticated approach to maintaining persistence, executing malicious code, and evading detection within compromised environments. The group typically leverages scripting and scheduled tasks to automate malicious activities, while registry modifications help in persistence and evasion. The absence of known exploits in the wild suggests that the group relies more on custom or targeted tools rather than publicly known vulnerabilities. The threat level is moderate (3 out of an unspecified scale), and the certainty of the intelligence is moderate (50%). The campaign is perpetual, indicating ongoing activity rather than a one-time event. Overall, Gamaredon is a persistent threat actor employing a combination of living-off-the-land techniques and custom malware to achieve its objectives, which often include espionage and data exfiltration.

Detailed information about OSINT - Gamaredon group. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="execution through api - t1106"'

Filter Threats