Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Malicious GitHub user and account - distributing malicious code and running  Sordeal-Stealer

This threat involves a malicious GitHub user account identified as 'okkz' that distributes malicious code repositories, notably including tools such as the Sordeal-Stealer malware. The campaign leverages GitHub as a platform to host and disseminate malicious payloads disguised as legitimate repositories, including 'Tiktok-Username-Checker', 'Steam-ID-Checker', 'Discord-Token-Checker', and others. The malicious code includes capabilities for keylogging (MITRE ATT&CK T1056.001), GUI input capture (T1056.002), browser session hijacking (T1185), and exfiltration of stolen data over alternative protocols (T1048). The threat actor uses PowerShell scripts to disable Windows Defender features such as real-time monitoring, intrusion prevention, script scanning, and controlled folder access, thereby evading detection and facilitating persistence. The malware collects sensitive user input, browser session tokens, and other credentials, then exfiltrates this data covertly. Indicators include multiple URLs hosted on rentry.co that serve raw payloads, which the malware fetches dynamically. No patches or fixes are currently available, and no known exploits in the wild have been reported. The campaign is assessed with medium severity due to its capability to steal sensitive information and evade endpoint defenses, though it requires user interaction to clone or run the malicious repositories. The threat is persistent, with a perpetual lifetime, and certainty of 50%, indicating moderate confidence in ongoing activity. The use of OSINT tools and social engineering to lure victims into executing the malware is a key tactic. Overall, this campaign represents a sophisticated supply chain and social engineering threat vector leveraging trusted development platforms to distribute credential-stealing malware.

Detailed information about Malicious GitHub user and account - distributing malicious code and running  Sordeal-Stealer. Get real-time updates, technical detail

Malicious GitHub user and account - distributing malicious code and running  Sordeal-Stealer - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - #StopRansomware: Akira Ransomware

The Akira ransomware is a medium-severity threat identified through open-source intelligence (OSINT) and tracked by CIRCL under the #StopRansomware initiative. This ransomware employs multiple sophisticated attack techniques consistent with known ransomware behaviors, as mapped to MITRE ATT&CK patterns. Initial access vectors include spearphishing via attachments and links (T1566.001, T1566.002), exploitation of public-facing applications (T1190), and use of valid accounts (T1078). Post-compromise, Akira ransomware performs extensive reconnaissance activities such as system information discovery (T1082), network configuration discovery (T1016), domain trust discovery (T1482), process discovery (T1057), and enumeration of local and domain groups (T1069.001, T1069.002). Credential access techniques include harvesting credentials from LSASS memory (T1003.001) and from critical system files like /etc/passwd and /etc/shadow (T1003.008). The ransomware also manipulates domain accounts (T1136.002) and disables or modifies defensive tools (T1562.001) to evade detection. For lateral movement and persistence, it leverages remote access software (T1219) and connection proxies (T1090). Data exfiltration is conducted via alternative protocols (T1048) and cloud storage or cloud accounts (T1567.002, T1537). Finally, the ransomware encrypts data for impact (T1486) and inhibits system recovery mechanisms (T1490), effectively locking victims out of their data and demanding ransom. Although no known exploits are currently reported in the wild, the threat level is moderate, and the attack techniques indicate a well-rounded and potentially impactful ransomware campaign targeting both Europe and North America.

Detailed information about OSINT - #StopRansomware: Akira Ransomware affecting misp-galaxy ransomware. Get real-time updates, technical details, and mitigation 

OSINT - #StopRansomware: Akira Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information pertains to an OSINT report analyzing a breach and attack campaign targeting Uber, focusing on various MITRE ATT&CK techniques observed during the incident. The campaign involves multiple tactics and techniques typically used in credential theft and lateral movement within compromised environments. Key attack patterns include spearphishing via service (T1566.003, T1194), which indicates attackers used targeted phishing campaigns through trusted services to gain initial access. The use of valid accounts (T1078) and domain accounts (T1078.002, T1087.002, T1136.002) suggests attackers leveraged compromised credentials to move laterally and maintain persistence. Techniques such as credentials in files (T1552.001, T1081) and network share discovery (T1135) further indicate attempts to harvest credentials and explore network resources. External remote services (T1133) were likely exploited to facilitate remote access. The attackers also attempted to bypass multi-factor authentication by generating MFA requests (T1621), a sophisticated method to circumvent additional security layers. Data exfiltration was conducted over alternative protocols (T1048), implying the use of non-standard channels to evade detection. The campaign is classified as a system compromise with a low severity rating by the source, though the complexity of techniques used indicates a well-orchestrated attack. No known exploits in the wild or patches are associated, and the certainty of the OSINT is moderate (50%). The threat level is rated 4 on an unspecified scale, suggesting a notable but not critical threat. Overall, the attack demonstrates a combination of social engineering, credential theft, lateral movement, and data exfiltration techniques consistent with advanced persistent threat (APT) behavior targeting a high-profile organization.

Detailed information about OSINT - Uber Breach & Attack Analysis. Get real-time updates, technical details, and mitigation strategies.

OSINT - Uber Breach & Attack Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Uber Breach & Attack Analysis

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

SectorJ04 Groupâ€™s Increased Activity in 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT -  New SLUB Backdoor Uses GitHub, Communicates via Slack

The SLUB backdoor is a newly identified malware campaign characterized by its use of unconventional communication channels for command and control (C2) operations. Specifically, this backdoor leverages GitHub repositories as a means to receive commands or updates, and it communicates via Slack, a popular team collaboration platform. This approach allows the malware to blend its traffic with legitimate network activity, potentially evading traditional detection mechanisms that monitor for suspicious outbound connections. The use of GitHub for hosting or retrieving payloads or commands is notable because GitHub is widely trusted and often whitelisted in enterprise environments, making it an effective vector for covert data exfiltration or command dissemination. Similarly, Slack communication channels can be exploited to send or receive data under the guise of normal organizational communications. The campaign is categorized under exfiltration over alternative protocols (MITRE ATT&CK T1048) and scripting (T1064), indicating that the malware likely uses script-based techniques to automate its operations and exfiltrate data through these non-standard channels. The threat level is assessed as low with a certainty of 50%, indicating moderate confidence in the intelligence. There are no known exploits in the wild, and no specific affected software versions are identified, suggesting this is an emerging or targeted campaign rather than a widespread vulnerability exploitation. The backdoor's reliance on legitimate platforms for communication complicates detection and mitigation efforts, requiring defenders to implement more nuanced monitoring of network traffic and application usage patterns.

Detailed information about OSINT -  New SLUB Backdoor Uses GitHub, Communicates via Slack. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="exfiltration over alternative protocol - t1048"'

Filter Threats

Threats Tagged 'misp-galaxy:mitre-attack-pattern="exfiltration over alternative protocol - t1048"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility