Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro

The provided information relates to the Backmydata ransomware, associated with the Phobos ransomware family, as identified through OSINT (Open Source Intelligence) indicators of compromise (IOCs). Phobos ransomware is known for targeting external remote services, particularly publicly accessible Remote Desktop Protocol (RDP) services, to gain unauthorized access to victim networks. The attack pattern involves exploiting public-facing applications (MITRE ATT&CK T1190) and leveraging external remote services (T1133) to deliver ransomware payloads. Once access is gained, the ransomware encrypts critical data, demanding payment for decryption keys. The threat is categorized under malware and ransomware, with a medium severity rating. The technical details are limited, with no specific affected versions or patches available, and no known exploits in the wild reported at this time. The sector tag indicates a focus on the health sector, which is often targeted due to the critical nature of its data and services. The lack of patch availability suggests that the attack vector is more about exploiting misconfigurations or weak security controls (such as exposed RDP services) rather than software vulnerabilities. Indicators of compromise are not detailed in the provided data, but the emphasis on publicly accessible RDP services and exploitation of public-facing applications highlights the attack surface. This threat underscores the importance of securing remote access points and monitoring for suspicious activity related to external remote services.

Detailed information about OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro. Get real-time updates, technical details, and mitig

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro - Live Threat Intelligence - Threat Radar | OffSeq.com

The Dharma ransomware is a malware family known for encrypting victims' data to extort ransom payments. It primarily targets systems through the exploitation of external remote services (MITRE ATT&CK T1133) and the use of valid accounts (T1078), indicating that attackers often gain initial access by compromising legitimate credentials or leveraging exposed remote access protocols such as RDP. Once inside the network, Dharma employs scripting techniques (T1064) to automate its malicious activities, including file and directory discovery (T1083) and network share discovery (T1135), to identify valuable data and propagate across networked systems. The ransomware then encrypts data for impact (T1486), rendering files inaccessible and demanding payment for decryption keys. Despite its impactful behavior, the threat is currently assessed with a low severity rating, possibly due to limited exploitation in the wild or the availability of defensive measures. No patches are available for this ransomware, as it exploits access vectors rather than software vulnerabilities. Indicators of compromise are not provided, which may complicate detection efforts. The attack chain suggests that initial access is often gained through compromised credentials or exposed remote services, followed by lateral movement and encryption activities. The lack of known exploits in the wild and absence of a CVSS score indicate that while the ransomware is a known threat, its current operational impact may be limited or targeted.

Detailed information about Dharma Ransomware Event. Get real-time updates, technical details, and mitigation strategies.

Dharma Ransomware Event - Live Threat Intelligence - Threat Radar | OffSeq.com

Dharma Ransomware Event

The provided information pertains to the Backmydata ransomware threat, specifically focusing on Indicators of Compromise (IOCs) related to the Phobos ransomware family. This threat is characterized by exploitation of publicly accessible remote services, particularly Remote Desktop Protocol (RDP) services, which are commonly targeted entry points for ransomware campaigns. The attack vectors align with MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services), indicating that attackers leverage vulnerabilities or weak configurations in externally facing services to gain unauthorized access. Once access is obtained, the Phobos ransomware payload is deployed, encrypting victim data and demanding ransom payments. The threat is notably associated with the healthcare sector, which is a frequent target due to the critical nature of its operations and the high value of its data. The absence of specific affected versions or patch availability suggests that this is an ongoing threat relying on exploitation of configuration weaknesses rather than software vulnerabilities with patches. The presence of known exploits in the wild and active ransomware campaigns underscores the immediacy and real-world impact of this threat. The OSINT nature of the data indicates that these IOCs and alerts are publicly accessible, facilitating detection and response efforts but also enabling threat actors to adapt. Overall, this threat represents a medium-severity risk focused on leveraging exposed remote services to deliver ransomware payloads, with significant implications for targeted organizations.

Detailed information about OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro affecting type osint. Get real-time updates, technic

OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919)

CVE-2024-24919 is a recently disclosed vulnerability affecting Check Point Remote Access VPN products. The advisory indicates active exploitation attempts, although no confirmed exploits in the wild have been reported yet. The vulnerability relates to a weakness in the remote access VPN service, which is a public-facing application, making it a target for attackers leveraging the MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services). While specific technical details and affected versions are not provided, the nature of the vulnerability suggests it could allow unauthorized remote access or privilege escalation through exploitation of the VPN service. The threat level is rated as moderate (3 out of an unspecified scale), with an analysis confidence of 2, indicating some uncertainty about the full impact or exploitation details. The advisory is based on OSINT sources with a 50% certainty rating, implying that the information is preliminary and should be treated cautiously. The severity is currently classified as low, but this may reflect limited information rather than the actual risk. The lack of patch links and detailed technical data means organizations must proactively monitor vendor communications and threat intelligence feeds for updates. Given the critical role of VPNs in securing remote access, exploitation could lead to unauthorized network access, data exfiltration, or lateral movement within corporate networks.

Detailed information about OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919) affecting type osint. Get real-

OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919) - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices

The ArcaneDoor campaign is a newly identified espionage-focused threat targeting perimeter network devices, as reported by CIRCL and attributed to the threat actor ArcaneDoor. This campaign leverages external remote services (MITRE ATT&CK T1133) to gain unauthorized access and maintain persistence within targeted networks. Perimeter network devices, such as firewalls, VPN gateways, and routers, serve as critical entry points and control points for network traffic, making them high-value targets for espionage activities. The campaign's focus on these devices suggests an intent to intercept, manipulate, or exfiltrate sensitive information by exploiting remote access capabilities. Although no specific affected versions or exploits in the wild have been reported, the high severity rating indicates significant potential risk. The lack of patch information implies that the threat may exploit configuration weaknesses, default credentials, or zero-day vulnerabilities in external remote services. The campaign's perpetual nature, as indicated by the OSINT lifetime tag, suggests ongoing activity or persistent targeting. The involvement of Cisco Talos Intelligence Group as a producer of related intelligence underscores the credibility and seriousness of this threat. Overall, ArcaneDoor represents a sophisticated espionage campaign that targets critical network infrastructure to compromise confidentiality and integrity of organizational data through external remote service exploitation.

Detailed information about OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Get real-time updates, technical detai

OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - #StopRansomware: Akira Ransomware

The Akira ransomware is a medium-severity threat identified through open-source intelligence (OSINT) and tracked by CIRCL under the #StopRansomware initiative. This ransomware employs multiple sophisticated attack techniques consistent with known ransomware behaviors, as mapped to MITRE ATT&CK patterns. Initial access vectors include spearphishing via attachments and links (T1566.001, T1566.002), exploitation of public-facing applications (T1190), and use of valid accounts (T1078). Post-compromise, Akira ransomware performs extensive reconnaissance activities such as system information discovery (T1082), network configuration discovery (T1016), domain trust discovery (T1482), process discovery (T1057), and enumeration of local and domain groups (T1069.001, T1069.002). Credential access techniques include harvesting credentials from LSASS memory (T1003.001) and from critical system files like /etc/passwd and /etc/shadow (T1003.008). The ransomware also manipulates domain accounts (T1136.002) and disables or modifies defensive tools (T1562.001) to evade detection. For lateral movement and persistence, it leverages remote access software (T1219) and connection proxies (T1090). Data exfiltration is conducted via alternative protocols (T1048) and cloud storage or cloud accounts (T1567.002, T1537). Finally, the ransomware encrypts data for impact (T1486) and inhibits system recovery mechanisms (T1490), effectively locking victims out of their data and demanding ransom. Although no known exploits are currently reported in the wild, the threat level is moderate, and the attack techniques indicate a well-rounded and potentially impactful ransomware campaign targeting both Europe and North America.

Detailed information about OSINT - #StopRansomware: Akira Ransomware affecting misp-galaxy ransomware. Get real-time updates, technical details, and mitigation 

OSINT - #StopRansomware: Akira Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)

CVE-2024-3400 is a recently disclosed zero-day vulnerability affecting GlobalProtect, a widely deployed VPN solution developed by Palo Alto Networks. This vulnerability enables unauthenticated remote code execution (RCE) against GlobalProtect's public-facing services, allowing attackers to execute arbitrary code on vulnerable systems without requiring any prior authentication or user interaction. The vulnerability falls under the MITRE ATT&CK patterns of exploiting public-facing applications (T1190) and targeting external remote services (T1133). Although no specific affected versions have been enumerated, the lack of patch availability and the zero-day status indicate that this vulnerability is currently unmitigated in production environments. The technical details provided indicate a high threat level and moderate analysis confidence, but no known exploits in the wild have been reported yet. Given GlobalProtect's role as a critical VPN gateway for secure remote access, exploitation of this vulnerability could allow attackers to bypass network perimeter defenses, gain unauthorized access to internal networks, deploy malware, or move laterally within targeted environments. The unauthenticated nature of the exploit significantly lowers the barrier to attack, increasing the risk of widespread abuse once exploit code becomes publicly available or weaponized. The absence of patches and the perpetual lifetime tag suggest that organizations must urgently implement compensating controls to reduce exposure until an official fix is released.

Detailed information about OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) affecting misp-

OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks

This threat concerns a high-severity vulnerability in Fortinet's SSL-VPN implementation that allows for pre-authentication remote code execution (RCE). The vulnerability enables an attacker to exploit the SSL-VPN service without requiring prior authentication, potentially gaining full control over the affected system remotely. The vulnerability is publicly known through OSINT sources, with Fortinet confirming active exploitation attempts. The attack vector involves exploiting a flaw in the SSL-VPN service, which is a critical component used to provide secure remote access to corporate networks. Successful exploitation could allow attackers to execute arbitrary code, leading to full system compromise, data exfiltration, lateral movement within networks, and disruption of services. Although no specific affected versions or patches are listed, the vulnerability is tagged with MITRE ATT&CK patterns T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services), indicating that the attack targets externally exposed services accessible over the internet. The certainty of the information is moderate (50%), and no known exploits in the wild have been officially confirmed, but Fortinet's advisory suggests active exploitation attempts. The lack of detailed technical specifics and patch information implies that organizations using Fortinet SSL-VPN solutions should urgently assess their exposure and apply any available mitigations or updates from Fortinet. Given the critical role of SSL-VPNs in secure remote access, this vulnerability poses a significant risk to confidentiality, integrity, and availability of affected systems.

Detailed information about OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks affecting type osint. Get real-time updates, technical details

OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information pertains to an OSINT report analyzing a breach and attack campaign targeting Uber, focusing on various MITRE ATT&CK techniques observed during the incident. The campaign involves multiple tactics and techniques typically used in credential theft and lateral movement within compromised environments. Key attack patterns include spearphishing via service (T1566.003, T1194), which indicates attackers used targeted phishing campaigns through trusted services to gain initial access. The use of valid accounts (T1078) and domain accounts (T1078.002, T1087.002, T1136.002) suggests attackers leveraged compromised credentials to move laterally and maintain persistence. Techniques such as credentials in files (T1552.001, T1081) and network share discovery (T1135) further indicate attempts to harvest credentials and explore network resources. External remote services (T1133) were likely exploited to facilitate remote access. The attackers also attempted to bypass multi-factor authentication by generating MFA requests (T1621), a sophisticated method to circumvent additional security layers. Data exfiltration was conducted over alternative protocols (T1048), implying the use of non-standard channels to evade detection. The campaign is classified as a system compromise with a low severity rating by the source, though the complexity of techniques used indicates a well-orchestrated attack. No known exploits in the wild or patches are associated, and the certainty of the OSINT is moderate (50%). The threat level is rated 4 on an unspecified scale, suggesting a notable but not critical threat. Overall, the attack demonstrates a combination of social engineering, credential theft, lateral movement, and data exfiltration techniques consistent with advanced persistent threat (APT) behavior targeting a high-profile organization.

Detailed information about OSINT - Uber Breach & Attack Analysis. Get real-time updates, technical details, and mitigation strategies.

OSINT - Uber Breach & Attack Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Uber Breach & Attack Analysis

MedusaLocker is a ransomware strain identified as a ransomware-as-a-service (RaaS) threat, which means it is distributed and operated by affiliates who use the malware to extort victims. This ransomware employs multiple attack techniques aligned with MITRE ATT&CK patterns, including exploitation of external remote services (T1133), phishing campaigns (T1566), and execution through PowerShell scripts (T1059.001). MedusaLocker also uses advanced persistence and evasion tactics such as booting the system in safe mode (T1562.009) to inhibit detection and removal. The ransomware encrypts victim data to impact availability (T1486) and actively inhibits system recovery mechanisms (T1490), such as deleting shadow copies or disabling recovery options, to prevent victims from restoring their systems without paying the ransom. Although no specific affected software versions are listed, the malware targets Windows environments given the use of PowerShell and safe mode boot techniques. No known exploits in the wild have been reported, but the threat level is high due to its ransomware nature and the sophistication of its attack vectors. The ransomware is distributed via phishing and exploitation of external remote services, which indicates that initial access can be gained through social engineering or exploiting exposed services such as RDP or VPNs. The lack of a CVSS score requires an independent severity assessment, which is high given the potential for significant confidentiality, integrity, and availability impacts, ease of exploitation through phishing or exposed services, and the broad scope of affected systems. MedusaLocker’s RaaS model increases its threat surface as multiple affiliates can deploy it, increasing the likelihood of attacks.

Detailed information about #StopRansomware: MedusaLocker. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="external remote services - t1133"'

Filter Threats

Threats Tagged 'misp-galaxy:mitre-attack-pattern="external remote services - t1133"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility