Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An Analysis of Infrastructure linked to the Hagga Threat Actor

The provided information pertains to a security campaign linked to the Hagga threat actor, as analyzed by CIRCL. This campaign involves infrastructure associated with Hagga, a threat actor known for leveraging remote access software and tools, as indicated by references to MITRE ATT&CK techniques T1219 (Remote Access Software/Tools) and T1571 (Non-standard Port). The campaign is categorized as an OSINT (Open Source Intelligence) type with a medium severity rating and a moderate certainty level (50%). The analysis suggests that Hagga employs remote access tools to establish persistence and control over compromised systems, potentially using non-standard ports to evade detection and network defenses. Although no specific affected software versions or exploits in the wild are reported, the campaign's infrastructure analysis highlights the threat actor's tactics, techniques, and procedures (TTPs) that could be leveraged for espionage, data exfiltration, or lateral movement within targeted networks. The lack of detailed indicators and patch information implies that this is more an intelligence report on threat actor infrastructure rather than a vulnerability or exploit targeting a specific product. The threat level and analysis scores indicate a moderate level of concern, emphasizing the need for vigilance against remote access-based intrusions that may bypass conventional security controls by using uncommon network ports and legitimate remote access tools.

Detailed information about An Analysis of Infrastructure linked to the Hagga Threat Actor. Get real-time updates, technical details, and mitigation strategies.

An Analysis of Infrastructure linked to the Hagga Threat Actor - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -

The threat described is an ongoing cyber attack campaign identified by the German Federal Office for the Protection of the Constitution (BfV) and reported via OSINT sources. The campaign is attributed to the threat actor group known as Axiom, which is known for sophisticated cyber espionage activities. The attack leverages a wide range of advanced techniques mapped to MITRE ATT&CK patterns, indicating a multi-faceted and persistent intrusion approach. Key tactics include exploitation of external remote services (T1133), command-line interface usage (T1059), execution through APIs (T1106), and execution via rundll32 (T1085). The attackers also employ service execution (T1035), user execution (T1204), and DLL search order hijacking (T1038) to maintain persistence and evade detection. Kernel modules and extensions (T1215) and rootkits (T1014) suggest deep system compromise capabilities. Additional evasion techniques include disabling security tools (T1089), timestomping (T1099), binary padding (T1009), and software packing (T1045). The campaign uses custom command and control protocols (T1094), connection proxies (T1090), and fallback channels (T1008) to maintain resilient communications. The use of port knocking (T1205) and commonly used ports (T1043) further complicates detection. The campaign also manipulates system registries (T1112), deletes files (T1107), and employs process injection (T1055) to hide malicious activities. Execution guardrails (T1480) indicate targeted execution based on environment checks. Code signing (T1116) and deobfuscation techniques (T1140) are used to bypass security mechanisms. The campaign’s high severity rating and the broad spectrum of sophisticated techniques suggest a well-resourced and highly capable adversary focused on stealth, persistence, and data exfiltration. No specific affected software versions are listed, and no known exploits in the wild are reported, but the campaign’s complexity and persistence pose a significant threat to targeted organizations.

Detailed information about OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -. Get real-time updates, technical details, and mitigati

OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne - - Live Threat Intelligence - Threat Radar | OffSeq.com

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="remote access tools - t1219"'

Filter Threats