Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit Reverse Engineering

Exploit-DB RSS Feed

Reddit Malware

Reddit Cybersecurity

Reddit InfoSec News

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The IRS Doc Malware is a low-severity malware threat primarily delivered via spearphishing attachments, specifically malicious documents (maldocs). The attack chain begins with a targeted spearphishing email containing a weaponized document designed to exploit user trust and induce execution. Upon opening the document, the malware leverages scripting techniques, including PowerShell commands and command-line interface execution, to run malicious payloads. Persistence is achieved through modification of registry run keys or placing scripts in startup folders, ensuring the malware executes on system reboot. The malware also utilizes Background Intelligent Transfer Service (BITS) jobs to facilitate stealthy and reliable data transfer or command execution. Network communication is conducted over commonly used ports and employs standard cryptographic protocols to evade detection and secure command and control (C2) communications. The malware's tactics align with several MITRE ATT&CK techniques such as T1193 (spearphishing attachment), T1059 (command-line interface), T1086 (PowerShell), T1064 (scripting), T1060 (registry run keys/startup folder), T1197 (BITS jobs), T1043 (commonly used port), and T1032 (standard cryptographic protocol). No specific affected software versions are identified, and no patches are available, indicating the malware exploits social engineering and scripting rather than software vulnerabilities. There are no known exploits in the wild beyond the spearphishing vector, and no detailed indicators of compromise (IOCs) are provided. The overall impact is limited by the low severity rating, but the malware's use of multiple persistence and evasion techniques makes it a credible threat in targeted environments.

Detailed information about IRS Doc Malware. Get real-time updates, technical details, and mitigation strategies.

IRS Doc Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

IRS Doc Malware

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

The threat campaign attributed to the advanced persistent threat (APT) group known as NOBELIUM (also tracked as UNC2452 and APT29) leverages a geopolitical event—Poland's Ambassador’s visit to the United States—to target European Union governments that are providing assistance to Ukraine. This campaign is characterized by sophisticated spearphishing techniques, including spearphishing links and malicious file attachments delivered via HTML smuggling and obfuscated payloads to evade detection. The attackers exploit trusted relationships and use native APIs to execute code, enabling persistence through mechanisms such as registry run keys and autostart execution. The campaign employs drive-by compromises and web services for command and control, facilitating bidirectional communication with compromised systems. The use of obfuscation techniques and infrastructure compromise further complicates detection and mitigation efforts. The attack chain requires user execution, typically through social engineering, and targets high-value government entities involved in geopolitical support activities. Although no specific software vulnerabilities or affected product versions are listed, the campaign's reliance on social engineering and trusted relationships indicates a focus on human factors and supply chain attack vectors rather than direct exploitation of software flaws. The campaign is ongoing as of the publication date in March 2023, with no patches available, underscoring the need for heightened vigilance and tailored defensive measures.

Detailed information about NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine. Get real-time updates, technical de

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting PlugX to Extract Its Crown Jewels

PlugX is a sophisticated Remote Access Trojan (RAT) widely used by advanced persistent threat (APT) groups such as DragonOK, Mustang Panda, Winnti Group, and Axiom. It is known for its modular architecture, enabling attackers to execute a broad range of malicious activities including command execution, data exfiltration, and persistence on compromised Windows systems. The malware typically spreads via spearphishing campaigns using malicious links or attachments, leveraging social engineering to trick users into execution. Once deployed, PlugX employs various evasion and persistence techniques such as DLL side-loading, process hollowing, masquerading legitimate processes, registry run keys, and service execution to maintain stealth and resist detection. It also abuses Windows features like Component Object Model (COM) and User Account Control (UAC) bypass to escalate privileges and execute code with elevated rights. The malware uses obfuscation, packing, and encrypted communication channels to evade signature-based detection and network monitoring. Its capabilities include system and network reconnaissance, credential harvesting through input capture and keylogging, screen capture, and automated collection of sensitive data. The malware also supports remote system discovery and lateral movement via remote desktop protocol and remote services. Although no known exploits are currently active in the wild for this specific analysis, PlugX remains a persistent threat due to its continuous use by multiple threat actors targeting strategic organizations. The technical report from CIRCL highlights the extraction of PlugX's core components ('crown jewels'), providing insights into its inner workings and attack patterns, which can aid defenders in detection and mitigation.

Detailed information about Dissecting PlugX to Extract Its Crown Jewels. Get real-time updates, technical details, and mitigation strategies.

Dissecting PlugX to Extract Its Crown Jewels - Live Threat Intelligence - Threat Radar | OffSeq.com

Harma and Odveta are ransomware families identified as malware threats that employ several common tactics, techniques, and procedures (TTPs) associated with ransomware attacks. These ransomware variants utilize command-line interfaces (MITRE ATT&CK T1059) to execute malicious commands, which may facilitate automation and stealth during infection and propagation. They also leverage registry run keys or startup folders (T1060) to maintain persistence on infected systems, ensuring that the ransomware executes upon system reboot or user login. Communication with external remote services (T1133) suggests that these ransomware variants may receive commands or exfiltrate data to attacker-controlled infrastructure. The use of commonly used ports (T1043) indicates attempts to blend malicious network traffic with legitimate traffic, potentially evading network detection mechanisms. The primary impact of these ransomware families is data encryption for impact (T1486), which encrypts victim data to deny access and demands ransom payments for decryption keys. Despite being categorized with a low severity by the source, the ransomware's capabilities to encrypt data and maintain persistence pose significant risks to affected organizations. There are no known exploits in the wild specifically targeting vulnerabilities for initial infection, suggesting that infection vectors may rely on social engineering, phishing, or exploitation of external remote services. The lack of affected versions and patch links indicates that this ransomware targets general systems rather than specific software vulnerabilities. Overall, Harma and Odveta ransomware represent typical ransomware threats that combine persistence, encryption, and network communication to disrupt operations and extort victims.

Detailed information about Harma and Odveta Ransomware. Get real-time updates, technical details, and mitigation strategies.

Harma and Odveta Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

Harma and Odveta Ransomware

Remcos RAT (Remote Access Trojan) is a commercially available malware tool that enables attackers to remotely control infected Windows systems. The campaign identified on 2020-02-28 involves the distribution of Remcos RAT primarily through malspam campaigns leveraging spearphishing attachments (MITRE ATT&CK T1193). The malware employs multiple techniques to evade detection and maintain persistence, including scripting (T1064), registry run keys or startup folder modifications (T1060), timestomping to alter file timestamps (T1099), masquerading as legitimate files or processes (T1036), and indirect command execution (T1202). It also uses uncommonly used ports (T1065) for command and control communications and indicator blocking (T1054) to hinder forensic analysis and detection. Despite its low severity classification in this report, Remcos RAT is a versatile and stealthy tool that can facilitate espionage, data exfiltration, credential theft, and lateral movement within compromised networks. The campaign does not specify affected software versions or known exploits in the wild, indicating that the infection vector relies on social engineering rather than exploiting software vulnerabilities. The threat level is moderate (3/10), with no direct evidence of widespread exploitation but with significant potential for targeted attacks. The lack of CVSS score necessitates an independent severity assessment based on the malware's capabilities and attack techniques.

Detailed information about Remcos RAT 02-28-20. Get real-time updates, technical details, and mitigation strategies.

Remcos RAT 02-28-20 - Live Threat Intelligence - Threat Radar | OffSeq.com

Remcos RAT 02-28-20

The IRS Doc Malware campaign is a low-severity threat primarily leveraging spearphishing attachments to deliver malicious payloads. The attack vector involves sending targeted emails with malicious documents (maldocs) that, when opened, execute embedded scripts. These scripts utilize Windows command-line interfaces and PowerShell to execute further malicious activities. The malware employs scripting techniques to establish persistence on infected systems by modifying registry run keys or placing executables in startup folders. It also uses Background Intelligent Transfer Service (BITS) jobs to facilitate stealthy and reliable data transfer or command and control communications. The malware communicates over commonly used network ports and employs standard cryptographic protocols to encrypt its communications, making detection and analysis more challenging. Although no known exploits in the wild have been reported, the campaign's use of multiple MITRE ATT&CK techniques such as T1193 (Spearphishing Attachment), T1059 (Command-Line Interface), T1086 (PowerShell), T1064 (Scripting), T1060 (Registry Run Keys/Startup Folder), T1197 (BITS Jobs), T1043 (Commonly Used Port), and T1032 (Standard Cryptographic Protocol) indicates a multi-faceted approach to infection, persistence, and communication. The campaign's low severity rating suggests limited impact or scope at the time of reporting, but the use of sophisticated techniques warrants vigilance.

Emotet is a sophisticated and modular malware strain primarily known for its use in large-scale spam campaigns and as a delivery mechanism for other malware families. The provided information details an Emotet campaign characterized by a variety of Tactics, Techniques, and Procedures (TTPs) aligned with the MITRE ATT&CK framework. Key techniques include spearphishing attachments (T1193) as the initial infection vector, leveraging malicious email attachments to compromise victims. Once executed, Emotet employs command-line interfaces (T1059), scheduled tasks (T1053), scripting (T1064), and Windows Management Instrumentation (WMI) (T1047) to maintain persistence and execute payloads. It also uses registry run keys and startup folders (T1060) to ensure execution upon system reboot. Process injection (T1055) is utilized to evade detection and maintain stealth by running malicious code within legitimate processes. Emotet conducts extensive reconnaissance activities such as account discovery (T1087), domain trust discovery (T1482), and system owner/user discovery (T1033) to map the environment and identify valuable targets. For command and control (C2) communication, it uses commonly used ports (T1043), standard application layer protocols (T1071), and standard cryptographic protocols (T1032) to blend in with normal network traffic and evade network defenses. The campaign also references tools like Empire and Cobalt Strike, which are often used post-compromise for lateral movement and privilege escalation. The threat level is medium, reflecting Emotet's widespread impact but also the availability of detection and mitigation strategies. No known exploits in the wild are indicated, but the campaign's persistence and modularity make it a continuing risk. Overall, this Emotet campaign demonstrates a multi-stage attack lifecycle from initial phishing to lateral movement and data exfiltration capabilities, leveraging a broad spectrum of Windows-based techniques to maintain stealth and persistence.

Detailed information about Emotet in Depth TTP 10-07-19. Get real-time updates, technical details, and mitigation strategies.

Emotet in Depth TTP 10-07-19 - Live Threat Intelligence - Threat Radar | OffSeq.com

Emotet in Depth TTP 10-07-19

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils

The Aggah malspam campaign is a low-severity threat involving the distribution of malicious spam emails that employ a diverse set of attack techniques to compromise targeted systems. The campaign leverages multiple MITRE ATT&CK techniques, including execution via scheduled tasks (T1053), command-line interface usage (T1059), scripting (T1064), PowerShell execution (T1086), API-based execution (T1106), and mshta (T1170). Persistence mechanisms include registry run keys and startup folder manipulation (T1060). The campaign also uses process injection (T1055) to evade detection and maintain stealth. To obfuscate its activities, it employs deobfuscation and decoding of files or information (T1140). Credential theft is facilitated through credentials stored in files (T1081), and input capture (T1056) and screen capture (T1113) techniques are used for espionage or data exfiltration. Communication may occur over uncommonly used ports (T1065), potentially bypassing standard network monitoring. The campaign is characterized by its diversification of tools and techniques, making detection and mitigation more challenging. Although no known exploits in the wild are reported, the campaign's use of multiple attack vectors and persistence methods indicates a sophisticated approach to compromise and maintain access to victim systems. The threat level is assessed as low, with a certainty of 50%, indicating moderate confidence in the intelligence. The campaign was first reported in October 2019 by CIRCL and is cataloged under the MISP galaxy with multiple MITRE ATT&CK patterns.

Detailed information about OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils. Get real-time updates, technical details, 

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Operation Ghost - White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost - White Paper

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="registry run keys / startup folder - t1060"'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats