Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

The Dharma ransomware is a malware family known for encrypting victims' data to extort ransom payments. It primarily targets systems through the exploitation of external remote services (MITRE ATT&CK T1133) and the use of valid accounts (T1078), indicating that attackers often gain initial access by compromising legitimate credentials or leveraging exposed remote access protocols such as RDP. Once inside the network, Dharma employs scripting techniques (T1064) to automate its malicious activities, including file and directory discovery (T1083) and network share discovery (T1135), to identify valuable data and propagate across networked systems. The ransomware then encrypts data for impact (T1486), rendering files inaccessible and demanding payment for decryption keys. Despite its impactful behavior, the threat is currently assessed with a low severity rating, possibly due to limited exploitation in the wild or the availability of defensive measures. No patches are available for this ransomware, as it exploits access vectors rather than software vulnerabilities. Indicators of compromise are not provided, which may complicate detection efforts. The attack chain suggests that initial access is often gained through compromised credentials or exposed remote services, followed by lateral movement and encryption activities. The lack of known exploits in the wild and absence of a CVSS score indicate that while the ransomware is a known threat, its current operational impact may be limited or targeted.

Detailed information about Dharma Ransomware Event. Get real-time updates, technical details, and mitigation strategies.

Dharma Ransomware Event - Live Threat Intelligence - Threat Radar | OffSeq.com

Dharma Ransomware Event

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Inside the Dragon: DragonForce Ransomware Group

The DragonForce ransomware group is a known threat actor specializing in ransomware attacks, leveraging a variety of sophisticated techniques to infiltrate and compromise targeted networks. This group employs multiple MITRE ATT&CK techniques, including the use of valid accounts (T1078) and domain accounts (T1078.002) to gain initial access and maintain persistence. They utilize PowerShell (T1059.001) for execution of malicious scripts, and establish persistence through registry run keys and startup folders (T1547.001) as well as Windows services (T1543.003). To evade detection and hinder forensic analysis, DragonForce clears Windows event logs (T1070.001) and extracts credentials from LSASS memory (T1003.001). The group conducts domain trust discovery (T1482), remote system discovery (T1018), system network configuration discovery (T1016), system information discovery (T1082), and file and directory discovery (T1083) to map the network environment and identify valuable targets. They also exploit remote desktop protocol (RDP) (T1021.001) and web protocols (T1071.001) for lateral movement and command and control communications. The final stage involves encrypting data for impact (T1486), effectively locking victims out of their systems and demanding ransom payments. Although no known exploits are currently reported in the wild for this group, their tactics indicate a high level of operational capability and adaptability. The threat level is assessed as moderate (3 out of an unspecified scale), but the overall severity is currently rated low by the source, possibly reflecting limited observed impact or activity at this time.

Detailed information about OSINT - Inside the Dragon: DragonForce Ransomware Group. Get real-time updates, technical details, and mitigation strategies.

OSINT - Inside the Dragon: DragonForce Ransomware Group - Live Threat Intelligence - Threat Radar | OffSeq.com

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free

The threat involves the Lorenz ransomware group exploiting vulnerabilities related to Mitel MiVoice, a unified communications platform widely used in enterprise telephony. The group reportedly cracked MiVoice systems, enabling them to make unauthorized calls without cost to themselves, indicating a compromise of telephony infrastructure. Lorenz ransomware is known for its sophisticated attack techniques, including exploitation of public-facing applications, deployment of web shells, use of encrypted communication channels, and credential harvesting from LSASS memory. The attack chain involves multiple MITRE ATT&CK techniques such as exploitation of public-facing applications (T1190), use of proxy tools (T1090), execution of PowerShell and Windows command shells (T1059.001, T1059.003), modification of registry keys (T1112), scheduled task creation for persistence (T1053, T1053.005), and discovery of system network configurations and security software (T1016, T1518.001). The ransomware encrypts data for impact (T1486) and may perform system shutdown or reboot to enforce encryption effects (T1529), while also clearing Windows event logs (T1070.001) to cover tracks. The use of chisel tools (both ELF and Windows variants) suggests tunneling or proxying capabilities to maintain covert communication channels. Although no known exploits in the wild are reported, the threat level is assessed as moderate (4 out of 10), with a low severity rating assigned by the source. The attack requires initial access to public-facing applications, which may be facilitated by misconfigurations or unpatched vulnerabilities. The lack of specific affected versions and patch links indicates that this is an open investigation or an intelligence report based on OSINT with moderate certainty (50%).

Detailed information about Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free affecting type osint. Get real-time updates, technical d

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free - Live Threat Intelligence - Threat Radar | OffSeq.com

UEFI threats moving to the ESP: Introducing ESPecter bootkit

The ESPecter bootkit represents a sophisticated UEFI (Unified Extensible Firmware Interface) threat that targets the EFI System Partition (ESP) to establish persistent, stealthy footholds on compromised systems. Unlike traditional malware that operates within the OS environment, ESPecter operates at the pre-boot level, embedding itself within the ESP, a critical partition used by the firmware to load the operating system. This approach allows the bootkit to execute before the OS loads, evading many conventional security controls and detection mechanisms. The campaign leverages multiple advanced techniques mapped to MITRE ATT&CK patterns, including native API usage (T1106), pre-OS boot execution (T1542), boot or logon autostart execution (T1547), and bootkit deployment (T1542.003). It also employs dynamic-link library injection (T1055.001), hidden files and directories (T1564.001), hidden file systems (T1564.005), and obfuscation methods such as software packing (T1027.002) and file deobfuscation (T1140) to evade detection and analysis. The bootkit modifies system images (T1601.001) and code signing policies (T1553.006), impairing defenses (T1562) and renaming system utilities (T1036.003) to maintain persistence and stealth. It performs extensive system reconnaissance, including registry modification (T1112), system and process discovery (T1426, T1424), peripheral device discovery (T1120), and system time discovery (T1124). For data collection and exfiltration, ESPecter captures inputs (keylogging T1056.001, input capture T1417), screen captures (T1513, T1113), and automates data collection (T1119) with multi-stage command and control (C2) channels (T1104), using web protocols (T1071.001) and non-application layer protocols (T1095). It stages local data (T1074.001) and exfiltrates data over C2 channels (T1041), often using scheduled transfers (T1029). The campaign's complexity and use of multiple evasion and persistence techniques highlight its high threat level and sophistication, indicating a well-resourced adversary capable of long-term targeted attacks.

Detailed information about UEFI threats moving to the ESP: Introducing ESPecter bootkit. Get real-time updates, technical details, and mitigation strategies.

UEFI threats moving to the ESP: Introducing ESPecter bootkit - Live Threat Intelligence - Threat Radar | OffSeq.com

The CERT-FR report highlights an extended campaign by the Sandworm intrusion set targeting Centreon systems. Centreon is an IT infrastructure monitoring software widely used to oversee network, server, and application performance. The Sandworm group, known for its sophisticated cyber-espionage and sabotage operations, exploits public-facing Centreon applications to gain unauthorized access. The attack techniques align with MITRE ATT&CK patterns such as exploiting public-facing applications (T1190), leveraging server software components (T1505), and creating or modifying system processes (T1543) to establish persistence. The adversaries also use scheduled tasks or jobs (T1053) and command and scripting interpreters (T1059) to execute malicious payloads. They abuse elevation control mechanisms (T1548) to gain higher privileges and employ deobfuscation techniques (T1140) to evade detection. Post-compromise activities include file and directory discovery (T1083), establishing encrypted command and control channels (T1573), using application layer protocols for communication (T1071), and exfiltrating data over these channels (T1041). Although no specific affected versions or patches are listed, the campaign's high confidence and almost-certain likelihood suggest active targeting of Centreon deployments, particularly in France. The threat level is moderate (4), and no known exploits in the wild have been reported yet, indicating a potential for future exploitation if mitigations are not applied.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems affecting misp-galaxy target-information. Get re

The reported threat involves a campaign by the Sandworm intrusion set targeting Centreon systems, as identified by CERT-FR and CIRCL. Sandworm is a well-known advanced persistent threat (APT) group associated with sophisticated cyber espionage and sabotage activities. Centreon is an IT infrastructure monitoring software widely used in enterprise environments, including Linux-based systems. The campaign exploits public-facing applications (MITRE ATT&CK T1190), likely leveraging vulnerabilities or misconfigurations in Centreon's web interface to gain initial access. Post-compromise activities include deploying web shells (T1505.003) for persistent remote control, performing file and directory discovery (T1083) to map the environment, and creating or modifying system processes or Windows services (T1543, T1543.003) to maintain persistence and escalate privileges. The attackers use symmetric and asymmetric cryptography (T1573.001, T1573.002) and encrypted channels (T1573) to secure command and control communications, complicating detection and analysis. Data exfiltration is conducted over these encrypted C2 channels (T1041). The threat targets Linux systems predominantly in Western Europe, with high confidence in the indicators of compromise (IOCs) accuracy. Although the severity is classified as low by CERT-FR, the involvement of a high-profile APT group and the use of advanced techniques indicate a targeted espionage campaign rather than widespread destructive attacks. No known exploits in the wild or patches are currently documented, suggesting either a zero-day or exploitation of configuration weaknesses. The campaign aligns with historical Sandworm tactics, including stealthy infiltration and long-term presence in victim networks.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems affecting fr-classif non-classifiees. Get real-time updates, tec

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="file and directory discovery - t1083"'

Filter Threats