Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat campaign titled "Trickbot to Ryuk in Two Hours" describes a rapid attack chain leveraging the Trickbot malware to deploy Ryuk ransomware within a very short timeframe, approximately two hours. Trickbot is a modular banking Trojan that has evolved into a versatile malware platform used for credential theft, lateral movement, and network reconnaissance. In this campaign, Trickbot is used to gain initial access, perform extensive network and system discovery, credential dumping, and disable security tools to evade detection. The attack employs multiple MITRE ATT&CK techniques such as scheduled tasks (T1053) for persistence, disabling security tools (T1089), group policy modification (T1484), process injection (T1055), and obfuscated files or information (T1027) to maintain stealth and control. The adversaries leverage valid accounts (T1078) and credential dumping (T1003) to escalate privileges and move laterally across the network. Discovery techniques include system network connections (T1049), software and security software discovery (T1518, T1063), remote system discovery (T1018), and network share discovery (T1135). Remote services (T1021), remote desktop protocol (T1076), and remote file copy (T1105) facilitate lateral movement and payload deployment. The final stage involves deploying Ryuk ransomware, which encrypts data for impact (T1486), causing significant operational disruption. The campaign is known to utilize tools like Cobalt Strike and PowerView for post-exploitation activities. The rapid progression from initial compromise to ransomware deployment underscores the high operational tempo and sophistication of the threat actors behind this campaign.

Detailed information about Trickbot to Ryuk in Two Hours. Get real-time updates, technical details, and mitigation strategies.

Trickbot to Ryuk in Two Hours - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot to Ryuk in Two Hours

Racoon Stealer is a low-severity information-stealing malware campaign primarily classified as a keylogger and infostealer. It operates by leveraging multiple attack techniques consistent with the MITRE ATT&CK framework, including spearphishing attachments (T1193) to deliver the payload, execution via PowerShell (T1086) and command-line interface (T1059), and use of commonly used ports (T1043) for communication. The malware performs remote file copying (T1105) to exfiltrate data and compresses collected information (T1002) before sending it over its command and control (C2) channels (T1041). Automated collection techniques (T1119) and gathering data from the local system (T1005) are also employed to maximize data theft. Despite the absence of known exploits in the wild and a low severity rating, Racoon Stealer poses a risk by stealthily harvesting sensitive information such as credentials, personal data, and potentially financial information. The use of PowerShell and command-line interfaces indicates an ability to evade traditional detection methods, while spearphishing remains the primary infection vector, relying on user interaction to open malicious attachments. The campaign's technical details suggest moderate threat level but limited analysis data is available, indicating a need for further investigation and monitoring.

Detailed information about Racoon Stealer. Get real-time updates, technical details, and mitigation strategies.

Racoon Stealer - Live Threat Intelligence - Threat Radar | OffSeq.com

Racoon Stealer

The threat campaign titled "OSINT - Sharpening the Machete" is associated with the threat actor group "El Machete" and involves a range of sophisticated tactics, techniques, and procedures (TTPs) primarily centered around spear-phishing attacks. The campaign leverages spear-phishing via both attachments (MITRE ATT&CK T1193) and links (T1192) to initiate user execution (T1204), which is a critical step for initial compromise. Once inside the target environment, the threat actor employs scheduled tasks (T1053) to maintain persistence and uses various evasion techniques such as hiding files and directories (T1158), obfuscating files or information (T1027), software packing (T1045), and masquerading (T1036) to avoid detection by security tools. The campaign also involves credential theft techniques, including harvesting private keys (T1145) and credentials stored in files (T1081), which facilitate lateral movement and privilege escalation.

Reconnaissance and discovery activities are extensive, including system network connections discovery (T1049), peripheral device discovery (T1120), file and directory discovery (T1083), browser bookmark discovery (T1217), process discovery (T1057), and application window discovery (T1010). Data collection techniques include clipboard data capture (T1115), gathering data from local systems (T1005), and removable media (T1025). The adversary stages data (T1074) and captures input (T1056) and screen content (T1113) to maximize intelligence gathering.

For command and control (C2) and data exfiltration, the threat actor uses commonly used ports (T1043), fallback channels (T1008), and standard application layer protocols (T1071) to blend in with legitimate traffic. Remote file copy (T1105) and automated exfiltration (T1020) techniques are employed to transfer data stealthily. Data is often compressed (T1002) and encrypted (T1022) before exfiltration, which can occur over C2 channels (T1041), physical media (T1052), or scheduled transfers (T1029). The campaign is characterized by a moderate threat level and analysis confidence, with a low severity rating assigned by the source but involving a broad spectrum of attack vectors and techniques.

Overall, this campaign represents a targeted, multi-stage attack focusing on spear-phishing to gain initial access, followed by extensive reconnaissance, credential theft, persistence, and sophisticated data exfiltration methods. The use of obfuscation and masquerading techniques indicates a focus on evading detection and maintaining long-term presence within victim networks.

Detailed information about OSINT - Sharpening the Machete. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="remote file copy - t1105"'

Filter Threats