Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

APT43, also known as Kimsuky, is a North Korean advanced persistent threat (APT) group that has been observed leveraging cybercrime activities to fund its espionage operations. This threat actor employs a sophisticated and multi-faceted attack methodology primarily centered around social engineering techniques such as phishing and spearphishing (MITRE ATT&CK T1566, T1566.001, T1566.002). The group uses malicious links and attachments to gain initial access to targeted systems. Once inside, APT43 utilizes a wide range of tactics and techniques to maintain persistence, escalate privileges, and conduct reconnaissance. These include the use of scheduled tasks (T1053.005), Windows Management Instrumentation (T1047), command and scripting interpreters such as PowerShell and Windows command shell (T1059.001, T1059.003), and code injection methods (T1055 series). 

APT43 also compromises infrastructure by leveraging virtual private servers (T1583.003) and multi-hop proxies (T1090.003) to obfuscate command and control (C2) communications, which often use web protocols (T1071.001) and DNS tunneling (T1071.004). The group employs digital and code signing certificates (T1588.003, T1588.004) to sign malware and evade detection, and installs these certificates (T1608.003) to masquerade malicious payloads as legitimate software. They also use obfuscation techniques such as binary padding, software packing, and indicator removal (T1027 series) to avoid signature-based detection. 

APT43 conducts extensive discovery activities (T1007, T1010, T1012, T1016, T1033, T1057, T1082, T1083, T1087, T1518) to map out the environment and identify valuable targets. They capture sensitive data through keylogging (T1056.001), screen capture (T1113), clipboard data collection (T1115), and exfiltrate data via automated methods (T1020). The group also employs brute force attacks (T1110) and steals credentials from web browsers (T1555.003) to expand access. Persistence is maintained through registry run keys, startup folders, Windows services, and Winlogon helper DLLs (T1547 series, T1543.003). They also use advanced evasion techniques such as virtualization/sandbox evasion (T1497), debugger evasion (T1622), and reflective code loading (T1620). 

This threat actor is known to exploit client execution vulnerabilities (T1203) and uses malicious files and links (T1204.001, T1204.002) to deliver payloads. They manipulate system processes and tokens (T1134) and modify system registries (T1112) to maintain control. The group’s operations are perpetual and ongoing, with known exploits in the wild, and no patches are currently available for the vulnerabilities exploited. The threat level is high due to the combination of espionage objectives and cybercrime funding activities, making it a persistent and dangerous actor.

Detailed information about APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations affecting misp-galaxy mitre-attack-pattern. Get real-time upda

APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

The SNOWYAMBER campaign represents a sophisticated malware operation characterized by a multi-stage attack leveraging a variety of well-known tactics, techniques, and procedures (TTPs) as classified by the MITRE ATT&CK framework. The campaign employs phishing and spearphishing (T1566, T1566.001, T1566.002) as primary initial infection vectors, utilizing malicious attachments and links that require user execution (T1204, T1204.001, T1204.002). The attackers use advanced evasion techniques such as HTML smuggling (T1027.006) and right-to-left override (T1036.002) to bypass security controls and trick users into executing malicious payloads. Once executed, the malware establishes persistence through registry run keys and startup folder modifications (T1547.001) and employs DLL search order hijacking and side-loading (T1574.001, T1574.002) to maintain stealth and evade detection. The campaign also involves infrastructure compromise (T1584) and the use of virtual private servers and web services (T1583.003, T1583.006) to host command and control (C2) infrastructure. Communication with C2 servers is conducted via web services (T1102) and one-way communication channels (T1102.003), which may limit detection opportunities. The malware also incorporates techniques to bypass the 'mark-of-the-web' security feature (T1553.005) and deobfuscate or decode files or information (T1140), indicating a high level of sophistication in payload delivery and execution. The campaign is tagged with a threat level of 1 (high) and a certainty of 50%, suggesting ongoing analysis and partial confidence in attribution and impact assessment. No patches or known exploits are currently available, indicating that mitigation relies heavily on detection and prevention strategies rather than remediation of a specific vulnerability. The campaign's use of OSINT tools and infrastructure suggests a focus on reconnaissance and targeted attacks, potentially aimed at high-value targets through spearphishing and infrastructure compromise.

phishing email mimicking diplomatic correspondence. The link hidden under “here” leads to the ENVYSCOUT

Used to distribute phishing emails with a link to ENVYSCOUT

Used to distribute phishing emails with a link to i.php (reconnaissance?)

Detailed information about SNOWYAMBER - Malware Analysis Report. Get real-time updates, technical details, and mitigation strategies.

SNOWYAMBER - Malware Analysis Report - Live Threat Intelligence - Threat Radar | OffSeq.com

SNOWYAMBER - Malware Analysis Report

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine

The threat campaign attributed to the advanced persistent threat (APT) group known as NOBELIUM (also tracked as UNC2452 and APT29) leverages a geopolitical event—Poland's Ambassador’s visit to the United States—to target European Union governments that are providing assistance to Ukraine. This campaign is characterized by sophisticated spearphishing techniques, including spearphishing links and malicious file attachments delivered via HTML smuggling and obfuscated payloads to evade detection. The attackers exploit trusted relationships and use native APIs to execute code, enabling persistence through mechanisms such as registry run keys and autostart execution. The campaign employs drive-by compromises and web services for command and control, facilitating bidirectional communication with compromised systems. The use of obfuscation techniques and infrastructure compromise further complicates detection and mitigation efforts. The attack chain requires user execution, typically through social engineering, and targets high-value government entities involved in geopolitical support activities. Although no specific software vulnerabilities or affected product versions are listed, the campaign's reliance on social engineering and trusted relationships indicates a focus on human factors and supply chain attack vectors rather than direct exploitation of software flaws. The campaign is ongoing as of the publication date in March 2023, with no patches available, underscoring the need for heightened vigilance and tailored defensive measures.

Detailed information about NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine. Get real-time updates, technical de

NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "Trickbot to Ryuk in Two Hours" describes a rapid attack chain leveraging the Trickbot malware to deploy Ryuk ransomware within a very short timeframe, approximately two hours. Trickbot is a modular banking Trojan that has evolved into a versatile malware platform used for credential theft, lateral movement, and network reconnaissance. In this campaign, Trickbot is used to gain initial access, perform extensive network and system discovery, credential dumping, and disable security tools to evade detection. The attack employs multiple MITRE ATT&CK techniques such as scheduled tasks (T1053) for persistence, disabling security tools (T1089), group policy modification (T1484), process injection (T1055), and obfuscated files or information (T1027) to maintain stealth and control. The adversaries leverage valid accounts (T1078) and credential dumping (T1003) to escalate privileges and move laterally across the network. Discovery techniques include system network connections (T1049), software and security software discovery (T1518, T1063), remote system discovery (T1018), and network share discovery (T1135). Remote services (T1021), remote desktop protocol (T1076), and remote file copy (T1105) facilitate lateral movement and payload deployment. The final stage involves deploying Ryuk ransomware, which encrypts data for impact (T1486), causing significant operational disruption. The campaign is known to utilize tools like Cobalt Strike and PowerView for post-exploitation activities. The rapid progression from initial compromise to ransomware deployment underscores the high operational tempo and sophistication of the threat actors behind this campaign.

Detailed information about Trickbot to Ryuk in Two Hours. Get real-time updates, technical details, and mitigation strategies.

Trickbot to Ryuk in Two Hours - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot to Ryuk in Two Hours

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="web service - t1102"'

Filter Threats