Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - The #BronzeUnion/#LuckyMouse/#APT27 infection checker

The provided information pertains to an OSINT (Open Source Intelligence) resource described as an infection checker related to the threat actor group known as Bronze Union, LuckyMouse, or APT27. This group, also referenced as Threat Group-3390 or Emissary Panda, is a well-documented Chinese state-sponsored advanced persistent threat (APT) actor known for cyber espionage campaigns targeting government, defense, and critical infrastructure sectors globally. The infection checker is a tool or resource designed to detect or identify infections or compromises associated with this APT group. However, the data does not describe a specific vulnerability or exploit but rather an intelligence or detection capability. The severity is marked as low, and there are no known exploits in the wild linked to this resource. The threat level is indicated as 3 (on an unspecified scale), and the certainty of the OSINT is moderate (50%). No technical details about specific attack vectors, malware, or vulnerabilities are provided, nor are there indicators of compromise (IOCs) listed. The resource appears to be a defensive or investigative tool rather than a direct threat or vulnerability itself.

Detailed information about OSINT - The #BronzeUnion/#LuckyMouse/#APT27 infection checker. Get real-time updates, technical details, and mitigation strategies.

OSINT - The #BronzeUnion/#LuckyMouse/#APT27 infection checker - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - #EmissaryPanda #APT older sample (2018)

The provided information pertains to an OSINT report on an older sample (2018) linked to the Emissary Panda Advanced Persistent Threat (APT), also known as Threat Group-3390 or LuckyMouse. Emissary Panda is a known Chinese state-sponsored threat actor group that has been active since at least 2013, primarily targeting government entities, think tanks, and critical infrastructure with espionage objectives. This specific entry references a campaign sample from 2018, indicating historical activity rather than a newly discovered vulnerability or exploit. The data is sourced from CIRCL and categorized under the MITRE ATT&CK intrusion set for Threat Group-3390. The severity is marked as low, with no known exploits in the wild and no specific affected software versions or vulnerabilities detailed. The threat level is indicated as 3 on an unspecified scale, and the certainty of the OSINT source is moderate (50%). No technical indicators or detailed tactics, techniques, and procedures (TTPs) are provided in this report. Overall, this entry serves as an intelligence note on the existence and historical activity of Emissary Panda rather than describing an active or emergent security threat or vulnerability.

Detailed information about OSINT - #EmissaryPanda #APT older sample (2018). Get real-time updates, technical details, and mitigation strategies.

OSINT - #EmissaryPanda #APT older sample (2018) - Live Threat Intelligence - Threat Radar | OffSeq.com

Emissary Panda Attacks Middle East Government Sharepoint Servers by Palo Alto Unit42

The threat known as Emissary Panda, also identified as Threat Group-3390 or LuckyMouse, is a sophisticated cyber espionage actor primarily targeting government entities in the Middle East. This campaign, as reported by Palo Alto Networks Unit42 and sourced from CIRCL, specifically focuses on compromising Microsoft SharePoint servers used by government organizations. SharePoint servers are critical collaboration platforms that often contain sensitive documents and internal communications, making them high-value targets for espionage. The attack methodology likely involves exploiting vulnerabilities or misconfigurations in SharePoint deployments to gain unauthorized access, establish persistence, and exfiltrate sensitive data. Although no specific affected versions or known exploits in the wild are documented, the high severity rating and the nature of the threat actor suggest advanced tactics, techniques, and procedures (TTPs) consistent with state-sponsored intrusion sets. The campaign's focus on Middle Eastern government SharePoint servers indicates a targeted approach aimed at intelligence gathering and possibly long-term surveillance. The lack of publicly disclosed technical details or indicators of compromise (IOCs) limits the ability to fully dissect the attack vectors, but the association with Emissary Panda implies the use of spear-phishing, zero-day exploits, or supply chain compromises as potential initial access vectors. The threat level and analysis scores indicate a credible and well-analyzed campaign, emphasizing the need for vigilance among organizations operating similar infrastructure.

Detailed information about Emissary Panda Attacks Middle East Government Sharepoint Servers by Palo Alto Unit42. Get real-time updates, technical details, and m

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:threat-actor="emissary panda"'

Filter Threats

Threats Tagged 'misp-galaxy:threat-actor="emissary panda"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility