Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control

The threat identified as AA22-138B involves threat actors chaining multiple VMware vulnerabilities to achieve full system control. This attack technique leverages a sequence of exploits targeting VMware products, which are widely used virtualization platforms in enterprise environments. The chaining of vulnerabilities allows attackers to escalate privileges, execute arbitrary code, and ultimately gain complete control over the affected system. The attack patterns associated with this threat include Unix shell command execution (T1059.004), modification of Linux and macOS file and directory permissions (T1222.002), ingress tool transfer (T1105), use of symmetric cryptography (T1573.001), malware deployment (T1588.001), exploitation for privilege escalation (T1068), AppleScript execution (T1059.002), clearing command history (T1070.003), use of web protocols for command and control (T1071.001), connection proxying (T1090), targeting of sensitive files like /etc/passwd and /etc/shadow (T1003.008), data archiving (T1560), exploitation for client execution (T1203), and deployment of web shells (T1505.003). Although no specific affected versions or patches are listed, the threat level is noted as moderate (3), and no known exploits are currently observed in the wild. The severity is marked as low in the source, but the technical details and attack complexity suggest a more nuanced risk profile. The attack requires chaining multiple vulnerabilities, indicating a sophisticated adversary capable of multi-stage exploitation. The absence of known exploits in the wild may reflect limited public exposure or recent discovery. Overall, this threat represents a complex, multi-vector attack against VMware virtualization environments that could lead to full system compromise if successfully executed.

Detailed information about AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control affecting tlp white. Get real-time updates, technical

AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - new sample of operation lagtime TA428

The provided information pertains to a new sample related to Operation Lagtime, attributed to the threat actor TA428. Operation Lagtime is a known cyber espionage campaign historically linked to TA428, which is believed to be a state-sponsored group. The campaign typically involves spearphishing attacks using malicious attachments (MITRE ATT&CK T1193) and exploitation for client execution (T1203), aiming to deliver malware payloads to targeted victims. The sample referenced here is categorized under OSINT (Open Source Intelligence) and is noted as a vulnerability type, although no specific affected software versions or patches are listed. The threat actor employs spearphishing attachments to exploit client-side vulnerabilities, likely leveraging zero-day or known exploits to execute malicious code on victim machines. The technical details indicate a threat level of 3 (on an unspecified scale) and a certainty of 50%, suggesting moderate confidence in the attribution and impact. No known exploits in the wild are reported for this sample, and no direct indicators of compromise (IOCs) are provided. The attack vectors align with social engineering combined with exploitation of client execution vulnerabilities, which can lead to unauthorized access, data exfiltration, and persistent footholds within targeted networks.

Detailed information about OSINT - new sample of operation lagtime TA428 affecting type osint. Get real-time updates, technical details, and mitigation strategi

OSINT - new sample of operation lagtime TA428 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

CVE-2019-13720 is a zero-day vulnerability affecting Google Chrome, identified as being exploited in the context of Operation WizardOpium, a threat actor campaign. This vulnerability allows for exploitation via client-side execution, specifically categorized under the MITRE ATT&CK technique T1203 (Exploitation for Client Execution). Although detailed technical specifics of the exploit are not provided in the available information, zero-day vulnerabilities in Chrome typically involve memory corruption or sandbox escape flaws that enable attackers to execute arbitrary code on the victim's machine upon visiting a malicious or compromised website. The exploit was publicly noted in OSINT reports by CIRCL in late 2019, but no public patch or remediation was linked at the time of reporting. The threat level is moderate (3 out of an unspecified scale), with an analysis confidence level of 2, indicating some uncertainty or limited data. The exploit is associated with Operation WizardOpium, a known threat actor group, suggesting targeted or strategic use rather than widespread indiscriminate attacks. No known exploits in the wild were confirmed at the time, and the severity was initially rated as low by the source, though this may reflect limited impact or exploitation scope at that time. The vulnerability's exploitation requires client interaction (e.g., visiting a malicious webpage), and no authentication is needed, which increases the attack surface. However, the lack of a patch and the zero-day nature imply a significant risk if leveraged by attackers. The absence of affected versions and patch information limits precise technical mitigation guidance but highlights the need for vigilance and rapid patching once updates become available.

Detailed information about OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium affecting type osint. Get real-time updates, technical deta

OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium - Live Threat Intelligence - Threat Radar | OffSeq.com

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="exploitation for client execution - t1203"'

Filter Threats

Threats Tagged 'misp-galaxy:mitre-attack-pattern="exploitation for client execution - t1203"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility