Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT -  Disrupting active exploitation of on-premises SharePoint vulnerabilities

The reported security threat concerns active exploitation attempts targeting on-premises Microsoft SharePoint installations, identified under CVE-2025-53770. This vulnerability is associated with public-facing SharePoint applications, which are commonly used for enterprise collaboration and document management. The threat actors involved include advanced persistent threat (APT) groups such as APT31, Emissary Panda, and Storm-2603, known for their sophisticated cyber espionage campaigns. The attack techniques align with MITRE ATT&CK patterns including exploitation of public-facing applications (T1190), PowerShell execution (T1059.001), deployment of web shells (T1505.003), reflective code loading (T1620), and automated data collection (T1119). These techniques suggest a multi-stage attack where initial exploitation leads to remote code execution, persistence via web shells, and subsequent data exfiltration or reconnaissance activities. Despite the absence of an available patch, no known exploits have been confirmed in the wild, indicating either early detection or limited exploitation scope. The vulnerability's exploitation does not require user interaction but targets exposed SharePoint servers, which are often internet-accessible, increasing the attack surface. The technical details remain limited, but the involvement of recognized APT groups and the high severity rating underscore the critical nature of this threat to organizations relying on on-premises SharePoint deployments.

IP address exploiting SharePoint vulnerabilities

File containing web config data, including MachineKey data

Web shell used by threat actors   Actors have also modified the file name in a variety of ways, such as spinstall.aspx, spinstall1.aspx, spinstall2.aspx

Detailed information about OSINT -  Disrupting active exploitation of on-premises SharePoint vulnerabilities affecting type osint. Get real-time updates, techni

OSINT -  Disrupting active exploitation of on-premises SharePoint vulnerabilities - Live Threat Intelligence - Threat Radar | OffSeq.com

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

CustomerLoader: a new malware distributing a wide variety of payloads

CustomerLoader is a recently identified malware loader that functions as a distribution mechanism for a wide variety of malicious payloads. Classified as a downloader-type malware, CustomerLoader facilitates the delivery and execution of multiple secondary malware families, including well-known stealers and remote access trojans (RATs) such as Vidar, XLoader, Agent Tesla, AsyncRAT, Ave Maria, DarkCloud Stealer, RedLine Stealer, and others. The malware employs various sophisticated techniques to evade detection and hinder defensive measures, including symmetric cryptography for payload encryption (MITRE T1573.001), disabling or modifying security tools (T1562.001), obfuscation of files and information (T1027), dynamic API resolution (T1027.007), reflective code loading (T1620), and data obfuscation (T1001). It also leverages common infection vectors such as spearphishing attachments (T1566.001) and ingress tool transfer (T1105) to infiltrate target systems. CustomerLoader is notable for its modular design, allowing it to load and execute diverse payloads, thereby increasing its versatility and threat potential. Despite its medium severity rating and no known exploits in the wild at the time of reporting, its association with multiple high-profile malware families and advanced evasion techniques mark it as a significant threat. The malware’s capability to impair defenses and its use of web protocols for command and control communications further complicate detection and mitigation efforts.

Detailed information about CustomerLoader: a new malware distributing a wide variety of payloads. Get real-time updates, technical details, and mitigation strat

CustomerLoader: a new malware distributing a wide variety of payloads - Live Threat Intelligence - Threat Radar | OffSeq.com

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="reflective code loading - t1620"'

Filter Threats