Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

The threat campaign attributed to the advanced persistent threat (APT) group known as NOBELIUM (also tracked as UNC2452 and APT29) leverages a geopolitical event—Poland's Ambassador’s visit to the United States—to target European Union governments that are providing assistance to Ukraine. This campaign is characterized by sophisticated spearphishing techniques, including spearphishing links and malicious file attachments delivered via HTML smuggling and obfuscated payloads to evade detection. The attackers exploit trusted relationships and use native APIs to execute code, enabling persistence through mechanisms such as registry run keys and autostart execution. The campaign employs drive-by compromises and web services for command and control, facilitating bidirectional communication with compromised systems. The use of obfuscation techniques and infrastructure compromise further complicates detection and mitigation efforts. The attack chain requires user execution, typically through social engineering, and targets high-value government entities involved in geopolitical support activities. Although no specific software vulnerabilities or affected product versions are listed, the campaign's reliance on social engineering and trusted relationships indicates a focus on human factors and supply chain attack vectors rather than direct exploitation of software flaws. The campaign is ongoing as of the publication date in March 2023, with no patches available, underscoring the need for heightened vigilance and tailored defensive measures.

Detailed information about NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine. Get real-time updates, technical de

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT -  Wrong hashes (from getmonero.org) #6151 - malicious binaries

This threat concerns a campaign identified through open-source intelligence (OSINT) involving the distribution of malicious binaries masquerading as legitimate software downloads from the official Monero website (getmonero.org). The core issue is the presence of incorrect cryptographic hashes published on the website, which are used to verify the integrity and authenticity of downloaded binaries. Attackers have exploited this discrepancy to introduce malicious payloads under the guise of legitimate Monero software, effectively conducting a supply chain compromise (MITRE ATT&CK T1195) and leveraging trusted relationships (T1199). The compromised hashes mislead users into trusting and executing tampered binaries, which may lead to unauthorized code execution, data theft, or system compromise. Although no known exploits have been reported in the wild, the high confidence and likelihood assessments indicate a credible and ongoing threat. The campaign's nature as a supply chain attack makes it particularly insidious, as it targets the trust users place in official distribution channels. The lack of affected versions and patch links suggests this is an issue with the distribution process rather than a software vulnerability per se. The threat level is rated high due to the potential for widespread impact on users relying on Monero software for cryptocurrency transactions and privacy.

Detailed information about OSINT -  Wrong hashes (from getmonero.org) #6151 - malicious binaries. Get real-time updates, technical details, and mitigation strat

OSINT -  Wrong hashes (from getmonero.org) #6151 - malicious binaries - Live Threat Intelligence - Threat Radar | OffSeq.com

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="trusted relationship - t1199"'

Filter Threats