Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Remcos RAT (Remote Access Trojan) is a commercially available malware tool that enables attackers to remotely control infected Windows systems. The campaign identified on 2020-02-28 involves the distribution of Remcos RAT primarily through malspam campaigns leveraging spearphishing attachments (MITRE ATT&CK T1193). The malware employs multiple techniques to evade detection and maintain persistence, including scripting (T1064), registry run keys or startup folder modifications (T1060), timestomping to alter file timestamps (T1099), masquerading as legitimate files or processes (T1036), and indirect command execution (T1202). It also uses uncommonly used ports (T1065) for command and control communications and indicator blocking (T1054) to hinder forensic analysis and detection. Despite its low severity classification in this report, Remcos RAT is a versatile and stealthy tool that can facilitate espionage, data exfiltration, credential theft, and lateral movement within compromised networks. The campaign does not specify affected software versions or known exploits in the wild, indicating that the infection vector relies on social engineering rather than exploiting software vulnerabilities. The threat level is moderate (3/10), with no direct evidence of widespread exploitation but with significant potential for targeted attacks. The lack of CVSS score necessitates an independent severity assessment based on the malware's capabilities and attack techniques.

Detailed information about Remcos RAT 02-28-20. Get real-time updates, technical details, and mitigation strategies.

Remcos RAT 02-28-20 - Live Threat Intelligence - Threat Radar | OffSeq.com

Remcos RAT 02-28-20

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils

The Aggah malspam campaign is a low-severity threat involving the distribution of malicious spam emails that employ a diverse set of attack techniques to compromise targeted systems. The campaign leverages multiple MITRE ATT&CK techniques, including execution via scheduled tasks (T1053), command-line interface usage (T1059), scripting (T1064), PowerShell execution (T1086), API-based execution (T1106), and mshta (T1170). Persistence mechanisms include registry run keys and startup folder manipulation (T1060). The campaign also uses process injection (T1055) to evade detection and maintain stealth. To obfuscate its activities, it employs deobfuscation and decoding of files or information (T1140). Credential theft is facilitated through credentials stored in files (T1081), and input capture (T1056) and screen capture (T1113) techniques are used for espionage or data exfiltration. Communication may occur over uncommonly used ports (T1065), potentially bypassing standard network monitoring. The campaign is characterized by its diversification of tools and techniques, making detection and mitigation more challenging. Although no known exploits in the wild are reported, the campaign's use of multiple attack vectors and persistence methods indicates a sophisticated approach to compromise and maintain access to victim systems. The threat level is assessed as low, with a certainty of 50%, indicating moderate confidence in the intelligence. The campaign was first reported in October 2019 by CIRCL and is cataloged under the MISP galaxy with multiple MITRE ATT&CK patterns.

Detailed information about OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils. Get real-time updates, technical details, 

OSINT - Dans lâ€™Å“il de notre CyberSOC : la campagne malspam Aggah diversifie ses outils - Live Threat Intelligence - Threat Radar | OffSeq.com

Financial - socgen-compliance.com fake website delivering malicious documents

The threat involves a fraudulent website, socgen-compliance.com, impersonating a legitimate financial entity to distribute malicious documents. This campaign is designed to deceive users into downloading and opening these documents, which likely contain embedded malware. The attack leverages several sophisticated techniques identified by MITRE ATT&CK patterns, including the use of uncommonly used ports (T1065), process injection (T1055), hooking (T1179), Office application startup manipulation (T1137), and registry modification (T1112). These techniques suggest that the malicious documents exploit Office macros or similar scripting capabilities to execute code stealthily, maintain persistence, and evade detection. Process injection and hooking enable the malware to hide its presence and interfere with normal system operations, while registry modifications ensure the malware can persist across reboots. The use of uncommonly used ports indicates attempts to bypass network security controls or blend in with legitimate traffic. Although the campaign's severity is rated low and no known exploits are reported in the wild, the combination of these tactics indicates a targeted approach aimed at financial sector victims. The threat level and analysis scores suggest moderate confidence in the campaign's capabilities, but the overall certainty is about 50%, indicating some uncertainty in the full scope or impact. The campaign is perpetual, meaning it could be ongoing or reactivated over time. The lack of specific affected versions or products implies a broad targeting strategy focused on user interaction with malicious documents rather than exploiting a particular software vulnerability.

Detailed information about Financial - socgen-compliance.com fake website delivering malicious documents. Get real-time updates, technical details, and mitigati

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="uncommonly used port - t1065"'

Filter Threats