Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities

Prynt Stealer is a recently identified information-stealing malware campaign observed in the wild, primarily designed to perform clipper and keylogger activities. This malware targets user credentials and sensitive information by capturing keystrokes and manipulating clipboard data to intercept cryptocurrency wallet addresses or other copied sensitive data. The stealer leverages multiple MITRE ATT&CK techniques, including user execution (T1204), system and process discovery (T1497.001, T1057), account discovery (T1087), software discovery (T1518), and system service and location discovery (T1007, T1614). It also performs credential theft from password stores (T1555), steals web session cookies (T1539), and application access tokens (T1528), indicating a broad scope of data exfiltration. The malware captures screen content (T1113) and exfiltrates data over command and control (C2) channels and web services (T1041, T1567). Prynt Stealer’s infection vector relies on user execution, meaning it requires victims to run malicious files or scripts, often delivered via phishing or social engineering. Although no known exploits are currently reported in the wild, the malware’s capabilities to harvest credentials, session tokens, and clipboard data pose significant risks to confidentiality and integrity of user data. The campaign’s perpetual lifetime and moderate certainty level (50%) suggest ongoing monitoring is necessary. The absence of affected versions implies it targets general Windows environments rather than specific software vulnerabilities.

Detailed information about Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities. Get real-time updates, technical 

Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="system location discovery - t1614"'

Filter Threats