Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

The CERT-FR report highlights an extended campaign by the Sandworm intrusion set targeting Centreon systems. Centreon is an IT infrastructure monitoring software widely used to oversee network, server, and application performance. The Sandworm group, known for its sophisticated cyber-espionage and sabotage operations, exploits public-facing Centreon applications to gain unauthorized access. The attack techniques align with MITRE ATT&CK patterns such as exploiting public-facing applications (T1190), leveraging server software components (T1505), and creating or modifying system processes (T1543) to establish persistence. The adversaries also use scheduled tasks or jobs (T1053) and command and scripting interpreters (T1059) to execute malicious payloads. They abuse elevation control mechanisms (T1548) to gain higher privileges and employ deobfuscation techniques (T1140) to evade detection. Post-compromise activities include file and directory discovery (T1083), establishing encrypted command and control channels (T1573), using application layer protocols for communication (T1071), and exfiltrating data over these channels (T1041). Although no specific affected versions or patches are listed, the campaign's high confidence and almost-certain likelihood suggest active targeting of Centreon deployments, particularly in France. The threat level is moderate (4), and no known exploits in the wild have been reported yet, indicating a potential for future exploitation if mitigations are not applied.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems affecting misp-galaxy target-information. Get re

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="scheduled task/job - t1053"'

Filter Threats