Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - #StopRansomware: Akira Ransomware

The Akira ransomware is a medium-severity threat identified through open-source intelligence (OSINT) and tracked by CIRCL under the #StopRansomware initiative. This ransomware employs multiple sophisticated attack techniques consistent with known ransomware behaviors, as mapped to MITRE ATT&CK patterns. Initial access vectors include spearphishing via attachments and links (T1566.001, T1566.002), exploitation of public-facing applications (T1190), and use of valid accounts (T1078). Post-compromise, Akira ransomware performs extensive reconnaissance activities such as system information discovery (T1082), network configuration discovery (T1016), domain trust discovery (T1482), process discovery (T1057), and enumeration of local and domain groups (T1069.001, T1069.002). Credential access techniques include harvesting credentials from LSASS memory (T1003.001) and from critical system files like /etc/passwd and /etc/shadow (T1003.008). The ransomware also manipulates domain accounts (T1136.002) and disables or modifies defensive tools (T1562.001) to evade detection. For lateral movement and persistence, it leverages remote access software (T1219) and connection proxies (T1090). Data exfiltration is conducted via alternative protocols (T1048) and cloud storage or cloud accounts (T1567.002, T1537). Finally, the ransomware encrypts data for impact (T1486) and inhibits system recovery mechanisms (T1490), effectively locking victims out of their data and demanding ransom. Although no known exploits are currently reported in the wild, the threat level is moderate, and the attack techniques indicate a well-rounded and potentially impactful ransomware campaign targeting both Europe and North America.

Detailed information about OSINT - #StopRansomware: Akira Ransomware affecting misp-galaxy ransomware. Get real-time updates, technical details, and mitigation 

OSINT - #StopRansomware: Akira Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

An Analysis of Infrastructure linked to the Hagga Threat Actor

The provided information pertains to a security campaign linked to the Hagga threat actor, as analyzed by CIRCL. This campaign involves infrastructure associated with Hagga, a threat actor known for leveraging remote access software and tools, as indicated by references to MITRE ATT&CK techniques T1219 (Remote Access Software/Tools) and T1571 (Non-standard Port). The campaign is categorized as an OSINT (Open Source Intelligence) type with a medium severity rating and a moderate certainty level (50%). The analysis suggests that Hagga employs remote access tools to establish persistence and control over compromised systems, potentially using non-standard ports to evade detection and network defenses. Although no specific affected software versions or exploits in the wild are reported, the campaign's infrastructure analysis highlights the threat actor's tactics, techniques, and procedures (TTPs) that could be leveraged for espionage, data exfiltration, or lateral movement within targeted networks. The lack of detailed indicators and patch information implies that this is more an intelligence report on threat actor infrastructure rather than a vulnerability or exploit targeting a specific product. The threat level and analysis scores indicate a moderate level of concern, emphasizing the need for vigilance against remote access-based intrusions that may bypass conventional security controls by using uncommon network ports and legitimate remote access tools.

Detailed information about An Analysis of Infrastructure linked to the Hagga Threat Actor. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="remote access software - t1219"'

Filter Threats