Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The XCTDH Crypto Heist Part 2 is a medium-severity threat involving multiple MITRE ATT&CK techniques such as exploitation of external remote services, automated data exfiltration, user execution, and compromise of software dependencies. It appears linked to North Korean threat actors and involves persistence, payload delivery, and network activity. No specific affected products or versions are identified, and no patches or known exploits in the wild are reported. The attack likely leverages social engineering and supply chain compromise to infiltrate targets and exfiltrate sensitive data. European organizations could be impacted if targeted via compromised software dependencies or remote service vulnerabilities. Mitigation requires enhanced supply chain security, strict remote access controls, user awareness training, and network monitoring for unusual exfiltration patterns. Countries with significant financial sectors and software development industries, such as Germany, France, and the UK, are more likely to be affected. The threat is assessed as medium severity due to the complexity of exploitation, potential data loss, and moderate ease of execution requiring user interaction and supply chain compromise.

The XCTDH Crypto Heist Part 2 threat is characterized by a combination of attack techniques mapped to MITRE ATT&CK patterns including T1133 (External Remote Services), T1020 (Automated Exfiltration), T1204 (User Execution), and T1195.001 (Compromise Software Dependencies and Development Tools). This indicates a multi-faceted attack involving initial access through external remote services, likely exploiting weak or compromised credentials or vulnerabilities in remote access infrastructure. The attacker then delivers payloads that require user execution, suggesting social engineering or phishing tactics to trick users into running malicious code. The compromise of software dependencies and development tools points to a supply chain attack vector, where attackers inject malicious code into widely used libraries or development environments, enabling persistence and widespread impact. Automated exfiltration techniques imply that once inside, the attacker systematically extracts sensitive data, potentially cryptocurrency assets or related credentials. The threat is associated with North Korean actors, known for sophisticated cyber operations targeting financial assets and intellectual property. No specific affected software versions or patches are available, and no known exploits in the wild have been reported, indicating this may be an emerging or observed campaign rather than a disclosed vulnerability. The threat involves persistence mechanisms and network activity, suggesting long-term presence and stealthy data theft. The lack of concrete technical indicators limits precise detection but highlights the need for vigilance in monitoring remote services, software supply chains, and user behavior.

Detailed information about XCTDH Crypto Heist Part 2 - Ellis Stannard. Get real-time updates, technical details, and mitigation strategies.

XCTDH Crypto Heist Part 2 - Ellis Stannard - Live Threat Intelligence - Threat Radar | OffSeq.com

XCTDH Crypto Heist Part 2 - Ellis Stannard

The Backmydata ransomware, associated with the Phobos ransomware family, targets organizations by exploiting public-facing applications and external remote services such as RDP. This threat is particularly relevant to the healthcare sector, where attackers leverage exposed remote desktop services to gain unauthorized access and deploy ransomware payloads. Although no specific patch is available and no known exploits in the wild have been reported, the threat remains medium severity due to its potential impact on confidentiality, integrity, and availability of critical systems. European organizations with exposed RDP services or vulnerable public-facing applications are at risk, especially in countries with significant healthcare infrastructure. Mitigation requires proactive hardening of remote access services, network segmentation, and continuous monitoring for indicators of compromise. Given the ransomware’s operational tactics, organizations should prioritize restricting RDP exposure and implementing multi-factor authentication. Countries like Germany, France, the UK, Italy, and Spain are likely most affected due to their large healthcare sectors and frequent targeting by ransomware groups. The threat’s medium severity reflects moderate ease of exploitation combined with significant potential operational disruption if successful.

Backmydata ransomware is linked to the Phobos ransomware family, known for targeting external remote services, particularly publicly accessible Remote Desktop Protocol (RDP) services, to gain initial access. The threat actors exploit vulnerabilities or weak configurations in public-facing applications (MITRE ATT&CK T1190) and external remote services (T1133) to deploy ransomware payloads. The healthcare sector is specifically highlighted as a target, indicating attackers may focus on critical infrastructure with sensitive data and operational dependencies. While no patches or specific exploits are currently documented, the ransomware’s modus operandi involves leveraging exposed RDP endpoints, which are commonly exploited due to weak authentication or lack of network restrictions. The absence of known exploits in the wild suggests this is an emerging or monitored threat rather than an active widespread campaign. Indicators of compromise (IOCs) are referenced but not detailed, implying defenders should rely on threat intelligence feeds for detection. The ransomware’s impact includes encryption of data, disruption of services, and potential data exfiltration, which can severely affect healthcare operations. The threat is disseminated via OSINT sources such as CIRCL, emphasizing the importance of open-source intelligence in early detection and response. The medium severity rating reflects the balance between the threat’s potential impact and the current lack of widespread exploitation.

Detailed information about OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro. Get real-time updates, technical details, and mitig

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro

The Dharma ransomware is a malware family known for encrypting victims' data to extort ransom payments. It primarily targets systems through the exploitation of external remote services (MITRE ATT&CK T1133) and the use of valid accounts (T1078), indicating that attackers often gain initial access by compromising legitimate credentials or leveraging exposed remote access protocols such as RDP. Once inside the network, Dharma employs scripting techniques (T1064) to automate its malicious activities, including file and directory discovery (T1083) and network share discovery (T1135), to identify valuable data and propagate across networked systems. The ransomware then encrypts data for impact (T1486), rendering files inaccessible and demanding payment for decryption keys. Despite its impactful behavior, the threat is currently assessed with a low severity rating, possibly due to limited exploitation in the wild or the availability of defensive measures. No patches are available for this ransomware, as it exploits access vectors rather than software vulnerabilities. Indicators of compromise are not provided, which may complicate detection efforts. The attack chain suggests that initial access is often gained through compromised credentials or exposed remote services, followed by lateral movement and encryption activities. The lack of known exploits in the wild and absence of a CVSS score indicate that while the ransomware is a known threat, its current operational impact may be limited or targeted.

Detailed information about Dharma Ransomware Event. Get real-time updates, technical details, and mitigation strategies.

Dharma Ransomware Event - Live Threat Intelligence - Threat Radar | OffSeq.com

Dharma Ransomware Event

The provided information pertains to the Backmydata ransomware threat, specifically focusing on Indicators of Compromise (IOCs) related to the Phobos ransomware family. This threat is characterized by exploitation of publicly accessible remote services, particularly Remote Desktop Protocol (RDP) services, which are commonly targeted entry points for ransomware campaigns. The attack vectors align with MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services), indicating that attackers leverage vulnerabilities or weak configurations in externally facing services to gain unauthorized access. Once access is obtained, the Phobos ransomware payload is deployed, encrypting victim data and demanding ransom payments. The threat is notably associated with the healthcare sector, which is a frequent target due to the critical nature of its operations and the high value of its data. The absence of specific affected versions or patch availability suggests that this is an ongoing threat relying on exploitation of configuration weaknesses rather than software vulnerabilities with patches. The presence of known exploits in the wild and active ransomware campaigns underscores the immediacy and real-world impact of this threat. The OSINT nature of the data indicates that these IOCs and alerts are publicly accessible, facilitating detection and response efforts but also enabling threat actors to adapt. Overall, this threat represents a medium-severity risk focused on leveraging exposed remote services to deliver ransomware payloads, with significant implications for targeted organizations.

Detailed information about OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro affecting type osint. Get real-time updates, technic

CVE-2024-24919 is a vulnerability in Check Point Remote Access VPN currently under active exploitation, targeting public-facing VPN services. Although no confirmed exploits in the wild exist, the threat is rated as low severity with a 50% certainty of exploitation. The vulnerability enables attackers to exploit remote access mechanisms, aligning with MITRE ATT&CK techniques T1190 and T1133. European organizations using Check Point VPNs, especially those with critical infrastructure, should prioritize mitigation. Immediate actions include applying patches when available, restricting VPN access, and enhancing monitoring for suspicious activity. The lack of a CVSS score and limited technical details necessitate cautious monitoring and proactive defense. Countries with significant Check Point VPN deployments and strategic infrastructure are at higher risk. The threat impacts confidentiality and integrity primarily, with moderate ease of exploitation and no user interaction required. Overall, the suggested severity is medium due to potential impact and exploitation likelihood.

CVE-2024-24919 is a recently disclosed vulnerability affecting Check Point Remote Access VPN products, which provide secure remote connectivity to enterprise networks. This vulnerability targets public-facing VPN services, potentially allowing attackers to exploit weaknesses in the remote access mechanisms. Although the advisory from CIRCL indicates active exploitation, no confirmed exploits have been observed in the wild, and the severity is currently rated as low. The vulnerability maps to MITRE ATT&CK techniques T1190 (exploit public-facing application) and T1133 (external remote services), indicating attackers may leverage this flaw to gain unauthorized access or escalate privileges via the VPN. The lack of detailed technical information and absence of a CVSS score suggest that the vulnerability might be complex or limited in scope, but the 50% certainty of exploitation implies a moderate threat level. Check Point VPNs are widely used in European enterprises and critical infrastructure sectors, making this vulnerability particularly relevant. The threat primarily affects confidentiality and integrity by potentially allowing unauthorized access to sensitive internal resources. The advisory recommends immediate mitigation steps such as applying vendor patches once available, restricting VPN access to trusted IPs, and enhancing network monitoring to detect suspicious activities related to VPN usage. Given the active exploitation reports, organizations should prioritize these mitigations to reduce risk exposure. The threat level is currently moderate, but could escalate if exploitation becomes widespread or more technical details emerge.

Detailed information about OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919) affecting type osint. Get real-

OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919) - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919)

OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices

The ArcaneDoor campaign is a newly identified espionage-focused threat targeting perimeter network devices, as reported by CIRCL and attributed to the threat actor ArcaneDoor. This campaign leverages external remote services (MITRE ATT&CK T1133) to gain unauthorized access and maintain persistence within targeted networks. Perimeter network devices, such as firewalls, VPN gateways, and routers, serve as critical entry points and control points for network traffic, making them high-value targets for espionage activities. The campaign's focus on these devices suggests an intent to intercept, manipulate, or exfiltrate sensitive information by exploiting remote access capabilities. Although no specific affected versions or exploits in the wild have been reported, the high severity rating indicates significant potential risk. The lack of patch information implies that the threat may exploit configuration weaknesses, default credentials, or zero-day vulnerabilities in external remote services. The campaign's perpetual nature, as indicated by the OSINT lifetime tag, suggests ongoing activity or persistent targeting. The involvement of Cisco Talos Intelligence Group as a producer of related intelligence underscores the credibility and seriousness of this threat. Overall, ArcaneDoor represents a sophisticated espionage campaign that targets critical network infrastructure to compromise confidentiality and integrity of organizational data through external remote service exploitation.

Detailed information about OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Get real-time updates, technical detai

OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - #StopRansomware: Akira Ransomware

The Akira ransomware is a medium-severity threat identified through open-source intelligence (OSINT) and tracked by CIRCL under the #StopRansomware initiative. This ransomware employs multiple sophisticated attack techniques consistent with known ransomware behaviors, as mapped to MITRE ATT&CK patterns. Initial access vectors include spearphishing via attachments and links (T1566.001, T1566.002), exploitation of public-facing applications (T1190), and use of valid accounts (T1078). Post-compromise, Akira ransomware performs extensive reconnaissance activities such as system information discovery (T1082), network configuration discovery (T1016), domain trust discovery (T1482), process discovery (T1057), and enumeration of local and domain groups (T1069.001, T1069.002). Credential access techniques include harvesting credentials from LSASS memory (T1003.001) and from critical system files like /etc/passwd and /etc/shadow (T1003.008). The ransomware also manipulates domain accounts (T1136.002) and disables or modifies defensive tools (T1562.001) to evade detection. For lateral movement and persistence, it leverages remote access software (T1219) and connection proxies (T1090). Data exfiltration is conducted via alternative protocols (T1048) and cloud storage or cloud accounts (T1567.002, T1537). Finally, the ransomware encrypts data for impact (T1486) and inhibits system recovery mechanisms (T1490), effectively locking victims out of their data and demanding ransom. Although no known exploits are currently reported in the wild, the threat level is moderate, and the attack techniques indicate a well-rounded and potentially impactful ransomware campaign targeting both Europe and North America.

Detailed information about OSINT - #StopRansomware: Akira Ransomware affecting misp-galaxy ransomware. Get real-time updates, technical details, and mitigation 

OSINT - #StopRansomware: Akira Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-3400 is a critical zero-day vulnerability in GlobalProtect VPN that allows unauthenticated remote code execution on public-facing portals. Attackers can exploit this flaw without any authentication, potentially gaining full control over affected systems. Although no active exploits have been observed in the wild yet, the vulnerability poses a significant risk to confidentiality, integrity, and availability of systems. European organizations using GlobalProtect for remote access are particularly at risk of data breaches and service disruptions. No official patches are currently available, so immediate mitigation through network-level protections, strict access controls, and enhanced monitoring is essential. Countries with high adoption of Palo Alto Networks products and critical infrastructure relying on secure VPN access are most likely to be targeted. Defenders should prioritize detection, network segmentation, and restrict GlobalProtect portal exposure until patches are released.

CVE-2024-3400 is a zero-day vulnerability affecting GlobalProtect, a widely deployed VPN solution by Palo Alto Networks. The vulnerability allows unauthenticated remote code execution (RCE) on public-facing GlobalProtect portals, meaning attackers can execute arbitrary code on the underlying system without needing credentials or user interaction. This type of vulnerability is particularly dangerous because it directly compromises the confidentiality, integrity, and availability of the targeted systems. The flaw resides in the external-facing GlobalProtect service, which is commonly used by organizations to provide secure remote access to their internal networks. Exploiting this vulnerability could allow attackers to gain full control over affected systems, potentially leading to data breaches, lateral movement within networks, disruption of services, or deployment of ransomware. Although no known exploits have been observed in the wild at the time of reporting, the critical nature of the vulnerability and its ease of exploitation make it a high-priority threat. No official patches or fixes have been released yet, so organizations must rely on compensating controls such as network segmentation, restricting access to GlobalProtect portals, and deploying advanced monitoring to detect exploitation attempts. The vulnerability aligns with MITRE ATT&CK techniques T1190 (exploit public-facing application) and T1133 (external remote services), emphasizing the attack vector through exposed external services. Given the widespread use of GlobalProtect in enterprise environments, especially in sectors requiring secure remote access, this vulnerability represents a significant risk.

Detailed information about OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) affecting misp-

OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)

OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks

This threat concerns a high-severity vulnerability in Fortinet's SSL-VPN implementation that allows for pre-authentication remote code execution (RCE). The vulnerability enables an attacker to exploit the SSL-VPN service without requiring prior authentication, potentially gaining full control over the affected system remotely. The vulnerability is publicly known through OSINT sources, with Fortinet confirming active exploitation attempts. The attack vector involves exploiting a flaw in the SSL-VPN service, which is a critical component used to provide secure remote access to corporate networks. Successful exploitation could allow attackers to execute arbitrary code, leading to full system compromise, data exfiltration, lateral movement within networks, and disruption of services. Although no specific affected versions or patches are listed, the vulnerability is tagged with MITRE ATT&CK patterns T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services), indicating that the attack targets externally exposed services accessible over the internet. The certainty of the information is moderate (50%), and no known exploits in the wild have been officially confirmed, but Fortinet's advisory suggests active exploitation attempts. The lack of detailed technical specifics and patch information implies that organizations using Fortinet SSL-VPN solutions should urgently assess their exposure and apply any available mitigations or updates from Fortinet. Given the critical role of SSL-VPNs in secure remote access, this vulnerability poses a significant risk to confidentiality, integrity, and availability of affected systems.

Detailed information about OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks affecting type osint. Get real-time updates, technical details

OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information pertains to an OSINT report analyzing a breach and attack campaign targeting Uber, focusing on various MITRE ATT&CK techniques observed during the incident. The campaign involves multiple tactics and techniques typically used in credential theft and lateral movement within compromised environments. Key attack patterns include spearphishing via service (T1566.003, T1194), which indicates attackers used targeted phishing campaigns through trusted services to gain initial access. The use of valid accounts (T1078) and domain accounts (T1078.002, T1087.002, T1136.002) suggests attackers leveraged compromised credentials to move laterally and maintain persistence. Techniques such as credentials in files (T1552.001, T1081) and network share discovery (T1135) further indicate attempts to harvest credentials and explore network resources. External remote services (T1133) were likely exploited to facilitate remote access. The attackers also attempted to bypass multi-factor authentication by generating MFA requests (T1621), a sophisticated method to circumvent additional security layers. Data exfiltration was conducted over alternative protocols (T1048), implying the use of non-standard channels to evade detection. The campaign is classified as a system compromise with a low severity rating by the source, though the complexity of techniques used indicates a well-orchestrated attack. No known exploits in the wild or patches are associated, and the certainty of the OSINT is moderate (50%). The threat level is rated 4 on an unspecified scale, suggesting a notable but not critical threat. Overall, the attack demonstrates a combination of social engineering, credential theft, lateral movement, and data exfiltration techniques consistent with advanced persistent threat (APT) behavior targeting a high-profile organization.

Detailed information about OSINT - Uber Breach & Attack Analysis. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="external remote services - t1133"'

Stop chasing alerts. Route them.

Filter Threats