Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Ursnif Campaign identified as f1.pipen.at is a malware campaign involving the Ursnif banking Trojan, also known as Gozi. Ursnif is a well-known information-stealing malware primarily targeting banking credentials but also capable of broader data theft and system compromise. This campaign leverages spearphishing links (MITRE ATT&CK T1192) to deliver the payload, relying on user execution (T1204) to initiate infection. The attack chain includes compile-after-delivery techniques (T1500), where the malware is compiled on the victim's machine post-download, complicating detection. The campaign uses Windows utilities such as mshta (T1170) and regsvr32 (T1117) to execute malicious scripts or DLLs, techniques often employed to bypass security controls by abusing trusted system binaries (living-off-the-land). It also modifies the Windows registry (T1112) to maintain persistence or alter system behavior. Communication with command and control (C2) servers occurs over commonly used ports (T1043) and standard application layer protocols (T1071), helping the malware blend with normal network traffic and evade detection. The campaign is tagged with Cobalt Strike, indicating possible use of this penetration testing tool or its components for post-exploitation activities. Although the severity is marked as low in the source, the combination of sophisticated techniques and the use of trusted system tools suggests a stealthy and potentially impactful threat. No known exploits in the wild are reported, and no specific affected software versions are listed, implying this is a malware campaign rather than a vulnerability in a product. The campaign was first published in April 2020, and the threat level is moderate (3 out of an unspecified scale).

Detailed information about Ursnif Campaign f1.pipen.at. Get real-time updates, technical details, and mitigation strategies.

Ursnif Campaign f1.pipen.at - Live Threat Intelligence - Threat Radar | OffSeq.com

Ursnif Campaign f1.pipen.at

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils

The Aggah malspam campaign is a low-severity threat involving the distribution of malicious spam emails that employ a diverse set of attack techniques to compromise targeted systems. The campaign leverages multiple MITRE ATT&CK techniques, including execution via scheduled tasks (T1053), command-line interface usage (T1059), scripting (T1064), PowerShell execution (T1086), API-based execution (T1106), and mshta (T1170). Persistence mechanisms include registry run keys and startup folder manipulation (T1060). The campaign also uses process injection (T1055) to evade detection and maintain stealth. To obfuscate its activities, it employs deobfuscation and decoding of files or information (T1140). Credential theft is facilitated through credentials stored in files (T1081), and input capture (T1056) and screen capture (T1113) techniques are used for espionage or data exfiltration. Communication may occur over uncommonly used ports (T1065), potentially bypassing standard network monitoring. The campaign is characterized by its diversification of tools and techniques, making detection and mitigation more challenging. Although no known exploits in the wild are reported, the campaign's use of multiple attack vectors and persistence methods indicates a sophisticated approach to compromise and maintain access to victim systems. The threat level is assessed as low, with a certainty of 50%, indicating moderate confidence in the intelligence. The campaign was first reported in October 2019 by CIRCL and is cataloged under the MISP galaxy with multiple MITRE ATT&CK patterns.

Detailed information about OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="mshta - t1170"'

Filter Threats