Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - BabyShark Malware Part Two â€“ Attacks Continue Using KimJongRAT and PCRat

The BabyShark malware campaign, as described in this OSINT report, represents a continuing threat involving the use of two remote access trojans (RATs): KimJongRAT and PCRat. These malware tools are typically employed by threat actors to gain unauthorized persistent access to compromised systems, enabling espionage, data exfiltration, and potentially further lateral movement within targeted networks. KimJongRAT is known for its stealth capabilities and modular architecture, allowing attackers to customize payloads and evade detection. PCRat similarly provides remote control functionalities, including keylogging, file manipulation, and command execution. The campaign's continuation suggests an ongoing interest in exploiting vulnerabilities or social engineering vectors to deploy these RATs. Although the report indicates a low severity and no known exploits in the wild at the time of publication, the presence of these RATs in targeted attacks can lead to significant security breaches if successful. The threat level and analysis scores (3 and 2 respectively) reflect moderate concern but limited confirmed impact or exploitation details. The lack of specific affected versions or patch information implies that the malware leverages general attack techniques rather than exploiting a particular software vulnerability. The campaign's persistence underscores the importance of monitoring for these RATs within network traffic and endpoint behaviors.

Detailed information about OSINT - BabyShark Malware Part Two â€“ Attacks Continue Using KimJongRAT and PCRat. Get real-time updates, technical details, and mit

OSINT - BabyShark Malware Part Two â€“ Attacks Continue Using KimJongRAT and PCRat - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New BabyShark Malware Targets U.S. National Security Think Tanks

The BabyShark malware campaign is a targeted threat identified through open-source intelligence (OSINT) that specifically aims at U.S. national security think tanks. The malware is associated with the threat actor group known as 'Stolen Pencil' and involves tactics such as the use of stolen developer credentials or signing keys (MITRE ATT&CK technique T1441). Although detailed technical specifics of the malware's operation are not provided, the campaign's focus on high-value intelligence organizations suggests a strategic espionage motive. The malware likely facilitates unauthorized access, data exfiltration, or persistent presence within targeted networks. The campaign was first reported in early 2019, with a low severity rating assigned by the source, indicating either limited impact or constrained operational scope at the time of discovery. No known exploits in the wild have been documented, and no specific affected software versions or patches are listed, which may imply the malware leverages social engineering or credential theft rather than exploiting software vulnerabilities directly. The absence of detailed indicators of compromise (IOCs) limits the ability to perform signature-based detection, emphasizing the need for behavioral and anomaly-based monitoring. The campaign's targeting of national security think tanks highlights the importance of securing intellectual property and sensitive policy research data from espionage threats.

Detailed information about OSINT - New BabyShark Malware Targets U.S. National Security Think Tanks. Get real-time updates, technical details, and mitigation st

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:tool="babyshark"'

Filter Threats

Threats Tagged 'misp-galaxy:tool="babyshark"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility