Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The IRS Doc Malware is a low-severity malware threat primarily delivered via spearphishing attachments, specifically malicious documents (maldocs). The attack chain begins with a targeted spearphishing email containing a weaponized document designed to exploit user trust and induce execution. Upon opening the document, the malware leverages scripting techniques, including PowerShell commands and command-line interface execution, to run malicious payloads. Persistence is achieved through modification of registry run keys or placing scripts in startup folders, ensuring the malware executes on system reboot. The malware also utilizes Background Intelligent Transfer Service (BITS) jobs to facilitate stealthy and reliable data transfer or command execution. Network communication is conducted over commonly used ports and employs standard cryptographic protocols to evade detection and secure command and control (C2) communications. The malware's tactics align with several MITRE ATT&CK techniques such as T1193 (spearphishing attachment), T1059 (command-line interface), T1086 (PowerShell), T1064 (scripting), T1060 (registry run keys/startup folder), T1197 (BITS jobs), T1043 (commonly used port), and T1032 (standard cryptographic protocol). No specific affected software versions are identified, and no patches are available, indicating the malware exploits social engineering and scripting rather than software vulnerabilities. There are no known exploits in the wild beyond the spearphishing vector, and no detailed indicators of compromise (IOCs) are provided. The overall impact is limited by the low severity rating, but the malware's use of multiple persistence and evasion techniques makes it a credible threat in targeted environments.

Detailed information about IRS Doc Malware. Get real-time updates, technical details, and mitigation strategies.

IRS Doc Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

IRS Doc Malware

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group

The Winnti Group is a well-documented advanced persistent threat (APT) actor known for sophisticated cyber espionage and supply chain compromise operations. This OSINT report details the arsenal and methods employed by the Winnti Group, specifically focusing on their malware toolkit often referred to as "ShadowPad." The group leverages multiple advanced techniques to infiltrate targeted environments, maintain persistence, and exfiltrate sensitive data. Key attack patterns include supply chain compromise (MITRE ATT&CK T1195), where the adversary injects malicious code into legitimate software updates or installers, enabling widespread distribution of malware to downstream victims. The group also uses DLL search order hijacking (T1038) and hooking (T1179) to manipulate legitimate processes and evade detection. Code signing (T1116) is abused to make their malware appear trustworthy, while obfuscation techniques (T1027, T1140) and hidden files/directories (T1158) help conceal their presence. Process injection (T1055) and disabling security tools (T1089) further enhance stealth and persistence. The malware communicates using both standard application layer protocols (T1071) and custom cryptographic protocols (T1024), often over commonly used ports (T1043), complicating network detection. Multi-stage command and control channels (T1104) and data exfiltration over these channels (T1041) enable the group to siphon sensitive information covertly. Additionally, resource hijacking (T1496) and stored data manipulation (T1492) indicate potential for sabotage or disruption beyond espionage. The threat actor behind Winnti, also known as Axiom, has historically targeted technology, gaming, pharmaceutical, and telecommunications sectors, often focusing on supply chain vectors to maximize impact. Despite the lack of a patch or known exploits in the wild for this specific malware variant, the complexity and breadth of techniques suggest a highly capable adversary with significant operational security and persistence capabilities.

Detailed information about OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group. Get real-time updates, technical details, and miti

OSINT - Connecting the dots: Exposing the arsenal and methods of the Winnti Group - Live Threat Intelligence - Threat Radar | OffSeq.com

The IRS Doc Malware campaign is a low-severity threat primarily leveraging spearphishing attachments to deliver malicious payloads. The attack vector involves sending targeted emails with malicious documents (maldocs) that, when opened, execute embedded scripts. These scripts utilize Windows command-line interfaces and PowerShell to execute further malicious activities. The malware employs scripting techniques to establish persistence on infected systems by modifying registry run keys or placing executables in startup folders. It also uses Background Intelligent Transfer Service (BITS) jobs to facilitate stealthy and reliable data transfer or command and control communications. The malware communicates over commonly used network ports and employs standard cryptographic protocols to encrypt its communications, making detection and analysis more challenging. Although no known exploits in the wild have been reported, the campaign's use of multiple MITRE ATT&CK techniques such as T1193 (Spearphishing Attachment), T1059 (Command-Line Interface), T1086 (PowerShell), T1064 (Scripting), T1060 (Registry Run Keys/Startup Folder), T1197 (BITS Jobs), T1043 (Commonly Used Port), and T1032 (Standard Cryptographic Protocol) indicates a multi-faceted approach to infection, persistence, and communication. The campaign's low severity rating suggests limited impact or scope at the time of reporting, but the use of sophisticated techniques warrants vigilance.

Emotet is a sophisticated and modular malware strain primarily known for its use in large-scale spam campaigns and as a delivery mechanism for other malware families. The provided information details an Emotet campaign characterized by a variety of Tactics, Techniques, and Procedures (TTPs) aligned with the MITRE ATT&CK framework. Key techniques include spearphishing attachments (T1193) as the initial infection vector, leveraging malicious email attachments to compromise victims. Once executed, Emotet employs command-line interfaces (T1059), scheduled tasks (T1053), scripting (T1064), and Windows Management Instrumentation (WMI) (T1047) to maintain persistence and execute payloads. It also uses registry run keys and startup folders (T1060) to ensure execution upon system reboot. Process injection (T1055) is utilized to evade detection and maintain stealth by running malicious code within legitimate processes. Emotet conducts extensive reconnaissance activities such as account discovery (T1087), domain trust discovery (T1482), and system owner/user discovery (T1033) to map the environment and identify valuable targets. For command and control (C2) communication, it uses commonly used ports (T1043), standard application layer protocols (T1071), and standard cryptographic protocols (T1032) to blend in with normal network traffic and evade network defenses. The campaign also references tools like Empire and Cobalt Strike, which are often used post-compromise for lateral movement and privilege escalation. The threat level is medium, reflecting Emotet's widespread impact but also the availability of detection and mitigation strategies. No known exploits in the wild are indicated, but the campaign's persistence and modularity make it a continuing risk. Overall, this Emotet campaign demonstrates a multi-stage attack lifecycle from initial phishing to lateral movement and data exfiltration capabilities, leveraging a broad spectrum of Windows-based techniques to maintain stealth and persistence.

Detailed information about Emotet in Depth TTP 10-07-19. Get real-time updates, technical details, and mitigation strategies.

Emotet in Depth TTP 10-07-19 - Live Threat Intelligence - Threat Radar | OffSeq.com

Emotet in Depth TTP 10-07-19

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

SectorJ04 Groupâ€™s Increased Activity in 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

Zebrocy is a malware family primarily classified as a backdoor, known for its use in targeted intrusion campaigns. It is associated with a range of sophisticated attack techniques as cataloged in the MITRE ATT&CK framework. Zebrocy typically employs spearphishing links (T1192) to initiate infection, relying on user execution (T1204) to activate its payload. The malware leverages Windows native utilities such as rundll32 (T1085) and Windows Management Instrumentation (WMI) (T1047) to execute malicious code and maintain persistence. Persistence mechanisms include scheduled tasks (T1053), registry run keys/startup folder modifications (T1060), and Component Object Model (COM) hijacking (T1122). Zebrocy also attempts to disable security tools (T1089) and delete files (T1107) to evade detection and hinder forensic analysis.

Once established, Zebrocy conducts extensive reconnaissance activities including process discovery (T1057), system information discovery (T1082), file and directory discovery (T1083), and registry queries (T1012). It collects data from local systems (T1005), network shared drives (T1039), and removable media (T1025), staging this data (T1074) for exfiltration. Zebrocy employs input capture (T1056) and screen capture (T1113) techniques to gather sensitive user information. Data exfiltration is performed over command and control (C2) channels (T1041) using commonly used ports (T1043) and custom cryptographic protocols (T1024), often with multilayer encryption (T1079) and data obfuscation (T1001) to avoid detection. The malware uses fallback channels (T1008) and standard application layer protocols (T1071) to maintain communication resilience.

Zebrocy is notable for its modularity and use of AutoIt scripting in some variants, facilitating rapid development and deployment. Although no known exploits are currently reported in the wild for this malware, its extensive use of legitimate Windows features and complex evasion techniques make it a persistent threat in targeted environments. The threat level is moderate (3/10), with a low severity rating assigned, reflecting the requirement for user interaction and the targeted nature of attacks rather than widespread automated exploitation.

Detailed information about OSINT - A journey to Zebrocy land. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="standard cryptographic protocol - t1032"'

Filter Threats