Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

The threat campaign attributed to the advanced persistent threat (APT) group known as NOBELIUM (also tracked as UNC2452 and APT29) leverages a geopolitical event—Poland's Ambassador’s visit to the United States—to target European Union governments that are providing assistance to Ukraine. This campaign is characterized by sophisticated spearphishing techniques, including spearphishing links and malicious file attachments delivered via HTML smuggling and obfuscated payloads to evade detection. The attackers exploit trusted relationships and use native APIs to execute code, enabling persistence through mechanisms such as registry run keys and autostart execution. The campaign employs drive-by compromises and web services for command and control, facilitating bidirectional communication with compromised systems. The use of obfuscation techniques and infrastructure compromise further complicates detection and mitigation efforts. The attack chain requires user execution, typically through social engineering, and targets high-value government entities involved in geopolitical support activities. Although no specific software vulnerabilities or affected product versions are listed, the campaign's reliance on social engineering and trusted relationships indicates a focus on human factors and supply chain attack vectors rather than direct exploitation of software flaws. The campaign is ongoing as of the publication date in March 2023, with no patches available, underscoring the need for heightened vigilance and tailored defensive measures.

Detailed information about NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine. Get real-time updates, technical de

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

UEFI threats moving to the ESP: Introducing ESPecter bootkit

The ESPecter bootkit represents a sophisticated UEFI (Unified Extensible Firmware Interface) threat that targets the EFI System Partition (ESP) to establish persistent, stealthy footholds on compromised systems. Unlike traditional malware that operates within the OS environment, ESPecter operates at the pre-boot level, embedding itself within the ESP, a critical partition used by the firmware to load the operating system. This approach allows the bootkit to execute before the OS loads, evading many conventional security controls and detection mechanisms. The campaign leverages multiple advanced techniques mapped to MITRE ATT&CK patterns, including native API usage (T1106), pre-OS boot execution (T1542), boot or logon autostart execution (T1547), and bootkit deployment (T1542.003). It also employs dynamic-link library injection (T1055.001), hidden files and directories (T1564.001), hidden file systems (T1564.005), and obfuscation methods such as software packing (T1027.002) and file deobfuscation (T1140) to evade detection and analysis. The bootkit modifies system images (T1601.001) and code signing policies (T1553.006), impairing defenses (T1562) and renaming system utilities (T1036.003) to maintain persistence and stealth. It performs extensive system reconnaissance, including registry modification (T1112), system and process discovery (T1426, T1424), peripheral device discovery (T1120), and system time discovery (T1124). For data collection and exfiltration, ESPecter captures inputs (keylogging T1056.001, input capture T1417), screen captures (T1513, T1113), and automates data collection (T1119) with multi-stage command and control (C2) channels (T1104), using web protocols (T1071.001) and non-application layer protocols (T1095). It stages local data (T1074.001) and exfiltrates data over C2 channels (T1041), often using scheduled transfers (T1029). The campaign's complexity and use of multiple evasion and persistence techniques highlight its high threat level and sophistication, indicating a well-resourced adversary capable of long-term targeted attacks.

Detailed information about UEFI threats moving to the ESP: Introducing ESPecter bootkit. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="native api - t1106"'

Filter Threats