Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The provided information pertains to an OSINT report analyzing a breach and attack campaign targeting Uber, focusing on various MITRE ATT&CK techniques observed during the incident. The campaign involves multiple tactics and techniques typically used in credential theft and lateral movement within compromised environments. Key attack patterns include spearphishing via service (T1566.003, T1194), which indicates attackers used targeted phishing campaigns through trusted services to gain initial access. The use of valid accounts (T1078) and domain accounts (T1078.002, T1087.002, T1136.002) suggests attackers leveraged compromised credentials to move laterally and maintain persistence. Techniques such as credentials in files (T1552.001, T1081) and network share discovery (T1135) further indicate attempts to harvest credentials and explore network resources. External remote services (T1133) were likely exploited to facilitate remote access. The attackers also attempted to bypass multi-factor authentication by generating MFA requests (T1621), a sophisticated method to circumvent additional security layers. Data exfiltration was conducted over alternative protocols (T1048), implying the use of non-standard channels to evade detection. The campaign is classified as a system compromise with a low severity rating by the source, though the complexity of techniques used indicates a well-orchestrated attack. No known exploits in the wild or patches are associated, and the certainty of the OSINT is moderate (50%). The threat level is rated 4 on an unspecified scale, suggesting a notable but not critical threat. Overall, the attack demonstrates a combination of social engineering, credential theft, lateral movement, and data exfiltration techniques consistent with advanced persistent threat (APT) behavior targeting a high-profile organization.

Detailed information about OSINT - Uber Breach & Attack Analysis. Get real-time updates, technical details, and mitigation strategies.

OSINT - Uber Breach & Attack Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Uber Breach & Attack Analysis

OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo

The Amavaldo malware is a backdoor Trojan primarily categorized as spyware and keylogger, with capabilities that include masquerading, spearphishing via service, screen capture, input capture, video capture, forced authentication, and deployment through application deployment software. It is identified as a Remote Access Trojan (RAT) with a focus on banking-related espionage activities. The malware employs multiple MITRE ATT&CK techniques such as T1036 (Masquerading), T1194 (Spearphishing via Service), T1113 (Screen Capture), T1056 (Input Capture), T1125 (Video Capture), T1187 (Forced Authentication), and T1017 (Application Deployment Software), indicating a sophisticated approach to infiltrate and maintain persistence within targeted systems. The threat is characterized by a low severity rating but is persistent and capable of continuous espionage, capturing sensitive user inputs and screen data, which can lead to credential theft and unauthorized access to financial accounts. The malware's distribution vector includes spearphishing, which exploits social engineering to gain initial access, and it can masquerade as legitimate software to evade detection. Although no known exploits in the wild are reported, the malware's capabilities suggest it is designed for targeted attacks, especially against financial institutions or users with banking privileges. The threat level and analysis scores indicate moderate confidence in the technical details, with a 50% certainty rating, suggesting some gaps in full attribution or behavioral understanding. The malware's perpetual lifetime implies ongoing risk if not detected and removed.

Detailed information about OSINT - From Carnaval to Cinco de Mayo â€“ The journey of Amavaldo. Get real-time updates, technical details, and mitigation strategi

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="spearphishing via service - t1194"'

Filter Threats