Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Operation Ghost is a sophisticated cyber espionage campaign attributed to the advanced persistent threat (APT) group known as APT29, also referred to as Cozy Bear. This campaign employs a wide range of attack techniques primarily targeting Windows environments to gain initial access, execute malicious code, maintain persistence, and exfiltrate sensitive data. The initial intrusion vector is spearphishing with malicious attachments (MITRE ATT&CK T1193), which allows the threat actor to deliver payloads that execute through various Windows mechanisms such as API calls (T1106), module loading (T1129), PowerShell scripts (T1086), and rundll32 execution (T1085). The attackers leverage scripting (T1064) and service execution (T1035) to run their code stealthily and use valid accounts (T1078) to move laterally within compromised networks. To evade detection, the campaign utilizes obfuscation techniques (T1027), including software packing (T1045) and data obfuscation (T1001), and frequently deobfuscates or decodes files during execution (T1140). Persistence is maintained through registry modifications (T1112), registry run keys or startup folders (T1060), scheduled tasks (T1053), and Windows Management Instrumentation (WMI) event subscriptions (T1084). The attackers perform extensive discovery activities such as file and directory enumeration (T1083), network share discovery (T1135), process discovery (T1057), system network connections discovery (T1049), and access to Windows administrative shares (T1077) to map the environment and identify valuable targets. Data collection spans local systems (T1005), network shares (T1039), and removable media (T1025). Exfiltration is conducted covertly over command and control (C2) channels (T1041), often using fallback channels (T1008) and standard application layer protocols (T1071) to blend with legitimate traffic. Connection proxies (T1090) are also employed to mask the origin of communications. The campaign is characterized by a high level of operational security and technical sophistication, with no known public exploits but a high threat level due to the actor's capabilities and objectives. The threat is perpetual and ongoing, targeting sensitive organizations for espionage purposes.

Detailed information about Operation Ghost - White Paper. Get real-time updates, technical details, and mitigation strategies.

Operation Ghost - White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Ghost - White Paper

OSINT - CozyBear â€“ In from the Cold?

The threat described relates to the advanced persistent threat (APT) group known as CozyBear, also identified as APT29, a Russian state-sponsored cyber espionage group. The information is derived from open-source intelligence (OSINT) and references the use of malware and tools associated with this actor, including CozyCar malware and Cobalt Strike, a legitimate penetration testing tool often repurposed by threat actors for command and control and post-exploitation activities. CozyBear is known for sophisticated phishing campaigns and stealthy intrusion techniques targeting government, diplomatic, and critical infrastructure entities worldwide. The mention of phishing as an incident classification suggests that initial compromise vectors likely involve spear-phishing emails designed to deliver malware payloads or establish footholds within targeted networks. Although no specific affected versions or exploits in the wild are indicated, the presence of Cobalt Strike implies potential for lateral movement, privilege escalation, and data exfiltration once inside a network. The threat level is moderate (3 out of an unspecified scale), and the severity is marked as low, possibly reflecting limited immediate exploitation or impact at the time of reporting. However, CozyBear's historical operations demonstrate a capability for long-term espionage campaigns with significant confidentiality impacts. The lack of detailed technical indicators or patches suggests this is an intelligence report rather than a vulnerability disclosure. Overall, this threat represents a persistent espionage risk leveraging social engineering and advanced malware tools to infiltrate and maintain access to sensitive networks.

Detailed information about OSINT - CozyBear â€“ In from the Cold?. Get real-time updates, technical details, and mitigation strategies.

OSINT - CozyBear â€“ In from the Cold? - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - A Mole exposing itself to sunlight Snake: Coming soon in Mac OS X flavour

The provided information refers to an OSINT (Open Source Intelligence) campaign related to a threat actor group known as Sofacy, also identified as APT29, which is a well-known Russian state-sponsored advanced persistent threat group. The campaign is titled "A Mole exposing itself to sunlight Snake: Coming soon in Mac OS X flavour," suggesting that the threat actor is expanding or adapting their malware toolkit, specifically the 'Snake' malware family, to target Mac OS X systems. 'Snake' is a sophisticated malware platform historically associated with espionage activities, capable of stealthy data exfiltration, command and control communication, and persistence mechanisms. The mention of Mac OS X flavor indicates a strategic shift or expansion from traditional Windows or Linux targets to Apple macOS environments, which have been less frequently targeted but are increasingly relevant due to their growing adoption in enterprise and government sectors. The campaign is classified as medium severity, with no known exploits in the wild at the time of reporting (2017). The lack of affected versions and patch links suggests that this is an emerging threat or intelligence about future capabilities rather than a currently active vulnerability. The threat level and analysis scores of 2 indicate moderate confidence and concern. The involvement of APT29/Sofacy implies a high level of sophistication, targeting sensitive information through espionage. The campaign's OSINT nature means that the information was gathered from publicly available sources, possibly indicating early warning or reconnaissance phases. Overall, this threat represents a potential increase in attack surface for Mac OS X users, particularly those in sensitive sectors, due to the adaptation of a known espionage malware family to a new platform.

Detailed information about OSINT - A Mole exposing itself to sunlight Snake: Coming soon in Mac OS X flavour. Get real-time updates, technical details, and miti

OSINT - A Mole exposing itself to sunlight Snake: Coming soon in Mac OS X flavour - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information describes an OSINT report on a campaign attributed to APT29, a well-known advanced persistent threat actor often linked to Russian intelligence. The campaign involves the use of domain fronting combined with the TOR network to obfuscate command and control (C2) communications or exfiltrate data. Domain fronting is a technique that leverages legitimate content delivery networks (CDNs) or cloud providers to mask the true destination of network traffic, making detection and blocking by defenders more difficult. By routing traffic through TOR, the attackers add an additional layer of anonymity and resistance to network-based detection and attribution. Although the report is dated from 2017 and the severity is marked as low, the use of these techniques by APT29 indicates a sophisticated approach to maintaining stealth and persistence. No specific affected software versions or exploits are identified, and no known exploits in the wild are reported. The lack of detailed technical indicators or vulnerabilities suggests this is more an observation of attacker tactics and infrastructure rather than a direct vulnerability or exploit. The threat level is moderate (3 on an unspecified scale), and the campaign is categorized as a threat actor activity rather than a software vulnerability or malware outbreak. Overall, this campaign highlights the challenges in detecting and mitigating advanced threat actors who leverage anonymization and evasion techniques such as domain fronting and TOR to conduct espionage or cyber operations.

Detailed information about OSINT - APT29 Domain Fronting With TOR. Get real-time updates, technical details, and mitigation strategies.

OSINT - APT29 Domain Fronting With TOR - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - APT29 Domain Fronting With TOR

OSINT Tracking MiniDionis: CozyCarâ€™s New Ride Is Related to Seaduke by Unit 42 Palo Alto Networks

The threat described involves OSINT tracking related to a malware family known as MiniDionis, which is linked to CozyCar and associated with the Seaduke trojan, as identified by Unit 42 from Palo Alto Networks. CozyCar and Seaduke are known to be tools used by the APT29 threat actor, also known as Cozy Bear, a group with suspected ties to Russian intelligence. The malware is categorized as a trojan and is used for targeted cyber espionage campaigns. The information provided is primarily OSINT (Open Source Intelligence) tracking data, indicating ongoing monitoring and analysis of this malware family's evolution and its connections to known threat actors. The technical details are limited, with no specific affected software versions or exploits in the wild reported, and no direct patch links available. The threat level and analysis scores are moderate (level 2), and the severity is marked as medium. The malware's primary function is likely espionage-focused, aiming to compromise confidentiality by stealing sensitive information or maintaining persistent access within targeted networks. Given the association with APT29, the threat is sophisticated and targeted rather than opportunistic, often focusing on government, diplomatic, and critical infrastructure sectors.

Detailed information about OSINT Tracking MiniDionis: CozyCarâ€™s New Ride Is Related to Seaduke by Unit 42 Palo Alto Networks. Get real-time updates, technical

OSINT Tracking MiniDionis: CozyCarâ€™s New Ride Is Related to Seaduke by Unit 42 Palo Alto Networks - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:threat-actor="apt 29"'

Filter Threats