Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CustomerLoader: a new malware distributing a wide variety of payloads

CustomerLoader is a recently identified malware loader that functions as a distribution mechanism for a wide variety of malicious payloads. Classified as a downloader-type malware, CustomerLoader facilitates the delivery and execution of multiple secondary malware families, including well-known stealers and remote access trojans (RATs) such as Vidar, XLoader, Agent Tesla, AsyncRAT, Ave Maria, DarkCloud Stealer, RedLine Stealer, and others. The malware employs various sophisticated techniques to evade detection and hinder defensive measures, including symmetric cryptography for payload encryption (MITRE T1573.001), disabling or modifying security tools (T1562.001), obfuscation of files and information (T1027), dynamic API resolution (T1027.007), reflective code loading (T1620), and data obfuscation (T1001). It also leverages common infection vectors such as spearphishing attachments (T1566.001) and ingress tool transfer (T1105) to infiltrate target systems. CustomerLoader is notable for its modular design, allowing it to load and execute diverse payloads, thereby increasing its versatility and threat potential. Despite its medium severity rating and no known exploits in the wild at the time of reporting, its association with multiple high-profile malware families and advanced evasion techniques mark it as a significant threat. The malware’s capability to impair defenses and its use of web protocols for command and control communications further complicate detection and mitigation efforts.

Detailed information about CustomerLoader: a new malware distributing a wide variety of payloads. Get real-time updates, technical details, and mitigation strat

CustomerLoader: a new malware distributing a wide variety of payloads - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT -  SWEED: Exposing years of Agent Tesla campaigns

Agent Tesla is a well-known information-stealing malware (infostealer) that has been active for several years, primarily targeting Windows systems. The threat described here relates to an OSINT (Open Source Intelligence) report titled 'SWEED: Exposing years of Agent Tesla campaigns,' published by CIRCL in mid-2019. This report aggregates and analyzes the long-term campaigns involving Agent Tesla, shedding light on its persistence, evolution, and operational tactics. Agent Tesla typically operates by infiltrating victim machines through phishing emails or malicious attachments, then harvesting sensitive data such as credentials, keystrokes, clipboard contents, and system information. The malware exfiltrates this data to command and control servers controlled by threat actors. The campaigns have demonstrated a degree of sophistication in evading detection and maintaining persistence, often leveraging obfuscation and packing techniques. Although the severity is rated low in the provided metadata, this likely reflects the OSINT nature of the report rather than the malware's inherent risk. The absence of known exploits in the wild indicates that Agent Tesla is not exploiting zero-day vulnerabilities but relies on social engineering and traditional infection vectors. The technical details suggest a moderate threat level (3) and analysis confidence (2), with a 75% certainty in the OSINT findings. Overall, this threat represents a persistent malware campaign focused on credential theft and espionage, with a long operational history and ongoing relevance in the cyber threat landscape.

Detailed information about OSINT -  SWEED: Exposing years of Agent Tesla campaigns. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-malware="agent tesla - s0331"'

Filter Threats