Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group

The Winnti Group is a well-documented advanced persistent threat (APT) actor known for sophisticated cyber espionage and supply chain compromise operations. This OSINT report details the arsenal and methods employed by the Winnti Group, specifically focusing on their malware toolkit often referred to as "ShadowPad." The group leverages multiple advanced techniques to infiltrate targeted environments, maintain persistence, and exfiltrate sensitive data. Key attack patterns include supply chain compromise (MITRE ATT&CK T1195), where the adversary injects malicious code into legitimate software updates or installers, enabling widespread distribution of malware to downstream victims. The group also uses DLL search order hijacking (T1038) and hooking (T1179) to manipulate legitimate processes and evade detection. Code signing (T1116) is abused to make their malware appear trustworthy, while obfuscation techniques (T1027, T1140) and hidden files/directories (T1158) help conceal their presence. Process injection (T1055) and disabling security tools (T1089) further enhance stealth and persistence. The malware communicates using both standard application layer protocols (T1071) and custom cryptographic protocols (T1024), often over commonly used ports (T1043), complicating network detection. Multi-stage command and control channels (T1104) and data exfiltration over these channels (T1041) enable the group to siphon sensitive information covertly. Additionally, resource hijacking (T1496) and stored data manipulation (T1492) indicate potential for sabotage or disruption beyond espionage. The threat actor behind Winnti, also known as Axiom, has historically targeted technology, gaming, pharmaceutical, and telecommunications sectors, often focusing on supply chain vectors to maximize impact. Despite the lack of a patch or known exploits in the wild for this specific malware variant, the complexity and breadth of techniques suggest a highly capable adversary with significant operational security and persistence capabilities.

Detailed information about OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group. Get real-time updates, technical details, and miti

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group - Live Threat Intelligence - Threat Radar | OffSeq.com

The Ursnif Campaign identified as f1.pipen.at is a malware campaign involving the Ursnif banking Trojan, also known as Gozi. Ursnif is a well-known information-stealing malware primarily targeting banking credentials but also capable of broader data theft and system compromise. This campaign leverages spearphishing links (MITRE ATT&CK T1192) to deliver the payload, relying on user execution (T1204) to initiate infection. The attack chain includes compile-after-delivery techniques (T1500), where the malware is compiled on the victim's machine post-download, complicating detection. The campaign uses Windows utilities such as mshta (T1170) and regsvr32 (T1117) to execute malicious scripts or DLLs, techniques often employed to bypass security controls by abusing trusted system binaries (living-off-the-land). It also modifies the Windows registry (T1112) to maintain persistence or alter system behavior. Communication with command and control (C2) servers occurs over commonly used ports (T1043) and standard application layer protocols (T1071), helping the malware blend with normal network traffic and evade detection. The campaign is tagged with Cobalt Strike, indicating possible use of this penetration testing tool or its components for post-exploitation activities. Although the severity is marked as low in the source, the combination of sophisticated techniques and the use of trusted system tools suggests a stealthy and potentially impactful threat. No known exploits in the wild are reported, and no specific affected software versions are listed, implying this is a malware campaign rather than a vulnerability in a product. The campaign was first published in April 2020, and the threat level is moderate (3 out of an unspecified scale).

Detailed information about Ursnif Campaign f1.pipen.at. Get real-time updates, technical details, and mitigation strategies.

Ursnif Campaign f1.pipen.at - Live Threat Intelligence - Threat Radar | OffSeq.com

Ursnif Campaign f1.pipen.at

Emotet is a sophisticated and modular malware strain primarily known for its use in large-scale spam campaigns and as a delivery mechanism for other malware families. The provided information details an Emotet campaign characterized by a variety of Tactics, Techniques, and Procedures (TTPs) aligned with the MITRE ATT&CK framework. Key techniques include spearphishing attachments (T1193) as the initial infection vector, leveraging malicious email attachments to compromise victims. Once executed, Emotet employs command-line interfaces (T1059), scheduled tasks (T1053), scripting (T1064), and Windows Management Instrumentation (WMI) (T1047) to maintain persistence and execute payloads. It also uses registry run keys and startup folders (T1060) to ensure execution upon system reboot. Process injection (T1055) is utilized to evade detection and maintain stealth by running malicious code within legitimate processes. Emotet conducts extensive reconnaissance activities such as account discovery (T1087), domain trust discovery (T1482), and system owner/user discovery (T1033) to map the environment and identify valuable targets. For command and control (C2) communication, it uses commonly used ports (T1043), standard application layer protocols (T1071), and standard cryptographic protocols (T1032) to blend in with normal network traffic and evade network defenses. The campaign also references tools like Empire and Cobalt Strike, which are often used post-compromise for lateral movement and privilege escalation. The threat level is medium, reflecting Emotet's widespread impact but also the availability of detection and mitigation strategies. No known exploits in the wild are indicated, but the campaign's persistence and modularity make it a continuing risk. Overall, this Emotet campaign demonstrates a multi-stage attack lifecycle from initial phishing to lateral movement and data exfiltration capabilities, leveraging a broad spectrum of Windows-based techniques to maintain stealth and persistence.

Detailed information about Emotet in Depth TTP 10-07-19. Get real-time updates, technical details, and mitigation strategies.

Emotet in Depth TTP 10-07-19 - Live Threat Intelligence - Threat Radar | OffSeq.com

Emotet in Depth TTP 10-07-19

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Operation Ghost - White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost - White Paper

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

SectorJ04 Groupâ€™s Increased Activity in 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "OSINT - Sharpening the Machete" is associated with the threat actor group "El Machete" and involves a range of sophisticated tactics, techniques, and procedures (TTPs) primarily centered around spear-phishing attacks. The campaign leverages spear-phishing via both attachments (MITRE ATT&CK T1193) and links (T1192) to initiate user execution (T1204), which is a critical step for initial compromise. Once inside the target environment, the threat actor employs scheduled tasks (T1053) to maintain persistence and uses various evasion techniques such as hiding files and directories (T1158), obfuscating files or information (T1027), software packing (T1045), and masquerading (T1036) to avoid detection by security tools. The campaign also involves credential theft techniques, including harvesting private keys (T1145) and credentials stored in files (T1081), which facilitate lateral movement and privilege escalation.

Reconnaissance and discovery activities are extensive, including system network connections discovery (T1049), peripheral device discovery (T1120), file and directory discovery (T1083), browser bookmark discovery (T1217), process discovery (T1057), and application window discovery (T1010). Data collection techniques include clipboard data capture (T1115), gathering data from local systems (T1005), and removable media (T1025). The adversary stages data (T1074) and captures input (T1056) and screen content (T1113) to maximize intelligence gathering.

For command and control (C2) and data exfiltration, the threat actor uses commonly used ports (T1043), fallback channels (T1008), and standard application layer protocols (T1071) to blend in with legitimate traffic. Remote file copy (T1105) and automated exfiltration (T1020) techniques are employed to transfer data stealthily. Data is often compressed (T1002) and encrypted (T1022) before exfiltration, which can occur over C2 channels (T1041), physical media (T1052), or scheduled transfers (T1029). The campaign is characterized by a moderate threat level and analysis confidence, with a low severity rating assigned by the source but involving a broad spectrum of attack vectors and techniques.

Overall, this campaign represents a targeted, multi-stage attack focusing on spear-phishing to gain initial access, followed by extensive reconnaissance, credential theft, persistence, and sophisticated data exfiltration methods. The use of obfuscation and masquerading techniques indicates a focus on evading detection and maintaining long-term presence within victim networks.

Detailed information about OSINT - Sharpening the Machete. Get real-time updates, technical details, and mitigation strategies.

OSINT - Sharpening the Machete - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Sharpening the Machete

Zebrocy is a malware family primarily classified as a backdoor, known for its use in targeted intrusion campaigns. It is associated with a range of sophisticated attack techniques as cataloged in the MITRE ATT&CK framework. Zebrocy typically employs spearphishing links (T1192) to initiate infection, relying on user execution (T1204) to activate its payload. The malware leverages Windows native utilities such as rundll32 (T1085) and Windows Management Instrumentation (WMI) (T1047) to execute malicious code and maintain persistence. Persistence mechanisms include scheduled tasks (T1053), registry run keys/startup folder modifications (T1060), and Component Object Model (COM) hijacking (T1122). Zebrocy also attempts to disable security tools (T1089) and delete files (T1107) to evade detection and hinder forensic analysis.

Once established, Zebrocy conducts extensive reconnaissance activities including process discovery (T1057), system information discovery (T1082), file and directory discovery (T1083), and registry queries (T1012). It collects data from local systems (T1005), network shared drives (T1039), and removable media (T1025), staging this data (T1074) for exfiltration. Zebrocy employs input capture (T1056) and screen capture (T1113) techniques to gather sensitive user information. Data exfiltration is performed over command and control (C2) channels (T1041) using commonly used ports (T1043) and custom cryptographic protocols (T1024), often with multilayer encryption (T1079) and data obfuscation (T1001) to avoid detection. The malware uses fallback channels (T1008) and standard application layer protocols (T1071) to maintain communication resilience.

Zebrocy is notable for its modularity and use of AutoIt scripting in some variants, facilitating rapid development and deployment. Although no known exploits are currently reported in the wild for this malware, its extensive use of legitimate Windows features and complex evasion techniques make it a persistent threat in targeted environments. The threat level is moderate (3/10), with a low severity rating assigned, reflecting the requirement for user interaction and the targeted nature of attacks rather than widespread automated exploitation.

Detailed information about OSINT - A journey to Zebrocy land. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="standard application layer protocol - t1071"'

Filter Threats