Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group

The Winnti Group is a well-documented advanced persistent threat (APT) actor known for sophisticated cyber espionage and supply chain compromise operations. This OSINT report details the arsenal and methods employed by the Winnti Group, specifically focusing on their malware toolkit often referred to as "ShadowPad." The group leverages multiple advanced techniques to infiltrate targeted environments, maintain persistence, and exfiltrate sensitive data. Key attack patterns include supply chain compromise (MITRE ATT&CK T1195), where the adversary injects malicious code into legitimate software updates or installers, enabling widespread distribution of malware to downstream victims. The group also uses DLL search order hijacking (T1038) and hooking (T1179) to manipulate legitimate processes and evade detection. Code signing (T1116) is abused to make their malware appear trustworthy, while obfuscation techniques (T1027, T1140) and hidden files/directories (T1158) help conceal their presence. Process injection (T1055) and disabling security tools (T1089) further enhance stealth and persistence. The malware communicates using both standard application layer protocols (T1071) and custom cryptographic protocols (T1024), often over commonly used ports (T1043), complicating network detection. Multi-stage command and control channels (T1104) and data exfiltration over these channels (T1041) enable the group to siphon sensitive information covertly. Additionally, resource hijacking (T1496) and stored data manipulation (T1492) indicate potential for sabotage or disruption beyond espionage. The threat actor behind Winnti, also known as Axiom, has historically targeted technology, gaming, pharmaceutical, and telecommunications sectors, often focusing on supply chain vectors to maximize impact. Despite the lack of a patch or known exploits in the wild for this specific malware variant, the complexity and breadth of techniques suggest a highly capable adversary with significant operational security and persistence capabilities.

Detailed information about OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group. Get real-time updates, technical details, and miti

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits

CVE-2023-46604 is a vulnerability affecting Apache ActiveMQ, an open-source message broker widely used for asynchronous communication in enterprise environments. This vulnerability has been exploited in the wild to deploy cryptominers and rootkits, indicating attackers are leveraging it for resource hijacking and persistent unauthorized access. The threat actor group associated with these campaigns is Kinsing, known for targeting cloud and container environments to install cryptomining malware and rootkits that facilitate long-term control and evasion. Although the official severity is listed as low, the exploitation involves compromising system integrity and availability by installing malicious software that consumes system resources and potentially opens backdoors. The lack of detailed affected versions and patch information suggests that organizations must proactively identify vulnerable ActiveMQ instances and monitor for indicators of compromise related to cryptomining and rootkit activity. The attack pattern aligns with MITRE ATT&CK technique T1496 (Resource Hijacking), where adversaries exploit vulnerabilities to misuse system resources for illicit cryptocurrency mining. The campaign's technical details indicate a moderate threat level, but no known exploits in the wild have been confirmed by CIRCL at the time of reporting. However, the presence of rootkits implies a sophisticated persistence mechanism that complicates detection and remediation.

Detailed information about CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits. Get real-time updates, tec

CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits - Live Threat Intelligence - Threat Radar | OffSeq.com

The Hezb cryptomining malware is a malicious software threat primarily focused on unauthorized cryptocurrency mining activities. This malware exploits vulnerabilities in public-facing applications (MITRE ATT&CK T1190) to gain initial access to targeted systems. Once inside, it performs resource hijacking (T1496), utilizing the victim's computing resources to mine cryptocurrency without consent. The malware is associated with the threat actor group 'hezb' and is characterized by high confidence in analytic judgment and an almost-certain likelihood of occurrence. Despite the absence of known exploits in the wild at the time of reporting, the threat is considered medium severity due to its potential impact on system performance and resource availability. The malware does not specify affected software versions, indicating it may target a broad range of systems with exploitable public-facing applications. The primary technical concern is the unauthorized consumption of CPU/GPU resources, which can degrade system performance, increase operational costs, and potentially cause hardware damage due to overheating or overuse. The lack of patch links suggests no specific vulnerability fix is currently available, emphasizing the need for proactive defense measures.

Detailed information about Hezb cryptomining malware affecting maec-malware-behavior maec-malware-behavior. Get real-time updates, technical details, and mitiga

Hezb cryptomining malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Hezb cryptomining malware

The threat identified as "Sample Linux miner - XMring" represents a high-severity vulnerability related to unauthorized cryptocurrency mining activities on Linux systems. XMring is a known cryptomining malware that targets Linux environments to illicitly utilize system resources for mining cryptocurrencies, typically Monero or similar privacy-focused coins. This threat leverages compromised third-party resources (MITRE ATT&CK T1375), indicating attackers may exploit vulnerabilities in supply chains or third-party software to deploy the miner. It also involves application or system exploitation techniques (T1499.004), which suggests attackers exploit system weaknesses to gain execution capabilities. The resource hijacking tactic (T1496) is central to this threat, where the attacker commandeers CPU, GPU, or other hardware resources to mine cryptocurrency without the knowledge or consent of the system owner. The absence of specific affected versions or patch information implies that this miner can potentially affect a broad range of Linux distributions and versions, especially those with weak security postures or unpatched vulnerabilities. Although no known exploits in the wild have been reported, the high severity rating and the nature of the threat indicate a significant risk if exploited. The threat level and analysis scores (1 and 2 respectively) suggest early-stage detection but with a clear potential for impact. The perpetual lifetime tag indicates that this threat remains relevant over time, requiring ongoing vigilance. The miner’s operation typically results in degraded system performance, increased power consumption, and potential system instability, which can disrupt business operations and increase operational costs. Furthermore, the presence of such malware can be a vector for further compromise, including lateral movement or data exfiltration, depending on attacker objectives and capabilities.

Detailed information about Sample Linux miner - XMring affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, and mitigation stra

Sample Linux miner - XMring - Live Threat Intelligence - Threat Radar | OffSeq.com

Sample Linux miner - XMring

Linux server infection with coinminers (derived from original post with iptables rules)

This threat involves the infection of Linux servers with coinminer malware, which is a form of resource hijacking where attackers use compromised systems to mine cryptocurrency without the owners' consent. The infection campaign is characterized by the deployment of coinminer tools that leverage command-line interfaces for execution and control, as indicated by the MITRE ATT&CK patterns T1496 (Resource Hijacking) and T1059 (Command-Line Interface). The campaign appears to use iptables rules, likely to manipulate network traffic or block security-related communications, thereby helping the malware maintain persistence and evade detection. Although no specific Linux distributions or versions are mentioned, the threat targets Linux servers broadly, exploiting their command-line accessibility and potentially weak security configurations. The campaign's severity is rated low, with a 50% certainty level, suggesting moderate confidence in the threat's existence and impact. No known exploits in the wild have been reported, and no patches are available, indicating that the infection vector may rely on common misconfigurations or weak credentials rather than zero-day vulnerabilities. The threat level is moderate (3 out of an unspecified scale), and the campaign is ongoing or perpetual in nature, as indicated by the OSINT lifetime tag. Overall, this campaign represents a persistent risk of unauthorized cryptocurrency mining on Linux servers, which can degrade system performance, increase operational costs, and potentially expose the system to further compromise due to the presence of malicious software.

Detailed information about Linux server infection with coinminers (derived from original post with iptables rules). Get real-time updates, technical details, an

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="resource hijacking - t1496"'

Filter Threats