Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Dissecting PlugX to Extract Its Crown Jewels - Live Threat Intelligence - Threat Radar | OffSeq.com

Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm

BumbleBee is a modular backdoor malware that evolved from the previously known BookWorm backdoor. It employs a variety of sophisticated techniques to maintain persistence, evade detection, and facilitate remote control by threat actors. BumbleBee uses process injection (MITRE ATT&CK T1055) to execute malicious code within legitimate processes, thereby hiding its presence. It hijacks execution flow (T1574) and modifies system processes (T1543) to establish persistence, including through boot or logon autostart execution (T1547) and initialization scripts (T1037). The malware also incorporates execution guardrails (T1480) to limit its activity to specific environments, reducing the chance of accidental discovery. BumbleBee performs indicator removal on the host (T1070) to erase traces of its activity and uses keylogging and input capture techniques (T1056.001, T1056, T1417) to steal sensitive information. It gathers victim host information (T1592) to tailor its operations and uses web protocols (T1071.001) for command and control communications, often employing proxies (T1090) to obfuscate network traffic. Symmetric cryptography (T1573.001) is used to secure communications and payloads, complicating detection and analysis. BumbleBee’s modular architecture allows it to load and execute various payloads dynamically, increasing its flexibility and adaptability. Although no known exploits in the wild have been reported, its medium threat level and extensive use of stealth and persistence techniques make it a significant threat to targeted environments.

Detailed information about Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm. Get real-time updates, technical details, and mit

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="hijack execution flow - t1574"'

Filter Threats