Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group

The Winnti Group is a well-documented advanced persistent threat (APT) actor known for sophisticated cyber espionage and supply chain compromise operations. This OSINT report details the arsenal and methods employed by the Winnti Group, specifically focusing on their malware toolkit often referred to as "ShadowPad." The group leverages multiple advanced techniques to infiltrate targeted environments, maintain persistence, and exfiltrate sensitive data. Key attack patterns include supply chain compromise (MITRE ATT&CK T1195), where the adversary injects malicious code into legitimate software updates or installers, enabling widespread distribution of malware to downstream victims. The group also uses DLL search order hijacking (T1038) and hooking (T1179) to manipulate legitimate processes and evade detection. Code signing (T1116) is abused to make their malware appear trustworthy, while obfuscation techniques (T1027, T1140) and hidden files/directories (T1158) help conceal their presence. Process injection (T1055) and disabling security tools (T1089) further enhance stealth and persistence. The malware communicates using both standard application layer protocols (T1071) and custom cryptographic protocols (T1024), often over commonly used ports (T1043), complicating network detection. Multi-stage command and control channels (T1104) and data exfiltration over these channels (T1041) enable the group to siphon sensitive information covertly. Additionally, resource hijacking (T1496) and stored data manipulation (T1492) indicate potential for sabotage or disruption beyond espionage. The threat actor behind Winnti, also known as Axiom, has historically targeted technology, gaming, pharmaceutical, and telecommunications sectors, often focusing on supply chain vectors to maximize impact. Despite the lack of a patch or known exploits in the wild for this specific malware variant, the complexity and breadth of techniques suggest a highly capable adversary with significant operational security and persistence capabilities.

Detailed information about OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group. Get real-time updates, technical details, and miti

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group - Live Threat Intelligence - Threat Radar | OffSeq.com

Financial - socgen-compliance.com fake website delivering malicious documents

The threat involves a fraudulent website, socgen-compliance.com, impersonating a legitimate financial entity to distribute malicious documents. This campaign is designed to deceive users into downloading and opening these documents, which likely contain embedded malware. The attack leverages several sophisticated techniques identified by MITRE ATT&CK patterns, including the use of uncommonly used ports (T1065), process injection (T1055), hooking (T1179), Office application startup manipulation (T1137), and registry modification (T1112). These techniques suggest that the malicious documents exploit Office macros or similar scripting capabilities to execute code stealthily, maintain persistence, and evade detection. Process injection and hooking enable the malware to hide its presence and interfere with normal system operations, while registry modifications ensure the malware can persist across reboots. The use of uncommonly used ports indicates attempts to bypass network security controls or blend in with legitimate traffic. Although the campaign's severity is rated low and no known exploits are reported in the wild, the combination of these tactics indicates a targeted approach aimed at financial sector victims. The threat level and analysis scores suggest moderate confidence in the campaign's capabilities, but the overall certainty is about 50%, indicating some uncertainty in the full scope or impact. The campaign is perpetual, meaning it could be ongoing or reactivated over time. The lack of specific affected versions or products implies a broad targeting strategy focused on user interaction with malicious documents rather than exploiting a particular software vulnerability.

Detailed information about Financial - socgen-compliance.com fake website delivering malicious documents. Get real-time updates, technical details, and mitigati

Financial - socgen-compliance.com fake website delivering malicious documents - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake amf-fr.org website delivering malicious Word document and binaries

This threat involves a fraudulent website impersonating the legitimate amf-fr.org domain, which is associated with the French financial markets authority. The fake website is used as a distribution vector for malicious payloads, specifically a Word document embedded with malware and additional binary files. The attack campaign leverages social engineering to entice victims to download and open the malicious Word document, which likely contains macros or exploits that execute malicious code on the victim's system. The binaries delivered may include backdoors, remote access tools, or other malware designed to compromise the target's system. The campaign is tagged with MITRE ATT&CK techniques such as 'service execution' (T1035) and 'hooking' (T1179), indicating that the malware may employ advanced persistence or code injection methods to evade detection and maintain control over the infected system. The threat level is assessed as low, with a 50% certainty rating, suggesting limited observed impact or distribution. However, the targeting of a financial regulatory domain implies a focus on financial sector entities or stakeholders. The lack of known exploits in the wild and absence of patch information indicates this is primarily a social engineering and malware delivery campaign rather than an exploitation of a software vulnerability. The campaign was first identified in early 2019, and no specific affected software versions are listed.

Detailed information about Fake amf-fr.org website delivering malicious Word document and binaries. Get real-time updates, technical details, and mitigation str

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="hooking - t1179"'

Filter Threats