Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Malicious File Creates Network Socket and Contacts fdh32fsdfhs.shop - Kunai Analysis Report sample - 2d266ab2597c72424aa21bc00718f9a13e5836e8

The provided information describes a malicious file that creates a network socket and attempts to contact an external domain named 'fdh32fsdfhs.shop'. This behavior is indicative of potentially malicious activity where the file may be establishing outbound communication to a command and control (C2) server or exfiltrating data. However, the details are limited: the threat is categorized under OSINT with a low severity rating and a 50% certainty level, suggesting that the analysis is preliminary or inconclusive. There is no information about the file type, affected software versions, or specific vulnerabilities exploited. No known exploits or patches are available, and no indicators of compromise (IOCs) are provided. The domain contacted appears suspicious and likely malicious, which is a common tactic used by malware to receive commands or send stolen information. The lack of detailed technical data, such as the method of infection, persistence mechanisms, or payload specifics, limits the depth of analysis. The threat does not require authentication or user interaction explicitly, but this is not confirmed. Overall, this appears to be an early-stage detection of a potentially malicious file exhibiting network communication to a suspicious domain, warranting further investigation and monitoring.

Detailed information about Malicious File Creates Network Socket and Contacts fdh32fsdfhs.shop - Kunai Analysis Report sample - 2d266ab2597c72424aa21bc00718f9a1

Malicious File Creates Network Socket and Contacts fdh32fsdfhs.shop - Kunai Analysis Report sample - 2d266ab2597c72424aa21bc00718f9a13e5836e8 - Live Threat Intelligence - Threat Radar | OffSeq.com

The Turla Outlook White Paper describes a threat associated with the Turla group, a well-known advanced persistent threat (APT) actor. This threat involves the exploitation of Microsoft Outlook through a technique known as Component Object Model (COM) hijacking (MITRE ATT&CK T1122). COM hijacking allows attackers to intercept and manipulate COM object calls, enabling them to persist within the victim's environment and execute malicious code. Specifically, this technique targets Outlook to facilitate email collection (MITRE ATT&CK T1114), allowing the adversary to harvest sensitive email communications stealthily. The threat is characterized by its use of persistence mechanisms that leverage artifacts dropped within the system to maintain long-term access. The targeting sectors include academic, research, and government organizations, with a focus on Western Europe. The threat intelligence indicates medium certainty and medium threat level, with no known exploits in the wild or available patches. The lack of affected versions and patch availability suggests this is more an analysis of a technique or campaign rather than a specific software vulnerability. The threat is documented as OSINT with medium IOC accuracy, indicating some confidence in the indicators but not definitive attribution or detection capability. Overall, this threat represents a sophisticated espionage toolset designed to infiltrate and maintain access to high-value targets through Outlook email interception and persistence via COM hijacking.

https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf

Detailed information about Turla Outlook White Paper. Get real-time updates, technical details, and mitigation strategies.

Turla Outlook White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Turla Outlook White Paper

The provided information references a threat labeled "OSINT - Gorilla DDoS," categorized primarily as an OSINT (Open Source Intelligence) observation related to denial of service (DoS) attack patterns. The threat is associated with multiple MITRE ATT&CK techniques: network denial of service (T1464), and endpoint denial of service (T1499 and T1642). These techniques describe attacks aimed at overwhelming network resources or endpoint systems to disrupt availability. However, the data lacks specific technical details about the Gorilla DDoS attack vector, such as the attack methodology, exploited vulnerabilities, or targeted platforms. The severity is marked as low with a certainty of 50%, indicating moderate confidence but limited concrete evidence. No affected versions or products are specified, and there are no known exploits in the wild or available patches. The threat appears to be an OSINT observation rather than a confirmed active threat campaign. The mention of network and endpoint denial of service suggests that the Gorilla DDoS could be a distributed denial of service attack leveraging multiple vectors to degrade or deny service to targeted systems or networks. The absence of detailed indicators or technical specifics limits the ability to fully characterize the attack or its mechanisms. Overall, this represents a potential low-severity denial of service threat with limited current impact or exploitation evidence.

Detailed information about OSINT - Gorilla DDoS. Get real-time updates, technical details, and mitigation strategies.

OSINT - Gorilla DDoS - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Gorilla DDoS

OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

The threat titled "OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions" details a sophisticated, long-term cyber espionage campaign attributed to the Chinese APT group Earth Estries. This group has been active since 2023, targeting critical sectors such as telecommunications, government entities, consulting, managed service providers, NGOs, technology, chemical, and transportation industries across multiple regions including the US, Asia-Pacific, Middle East, and South Africa. The group employs advanced attack techniques, leveraging multiple backdoors and malware families such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT. Their modus operandi involves exploiting public-facing server vulnerabilities to gain initial access, followed by lateral movement using living-off-the-land binaries to evade detection and maintain persistence for long-term espionage.

The campaign exploits a range of known vulnerabilities, notably several Microsoft Exchange Server remote code execution (RCE) vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) with CVSS scores up to 9.1, and a critical command injection vulnerability in Ivanti Connect Secure and Policy Secure appliances (CVE-2024-21887) with a CVSS score of 9.1. These vulnerabilities allow attackers to execute arbitrary commands remotely, often without user interaction, and in some cases without authentication (e.g., Exchange CVEs). The exploitation chain typically involves path traversal, command injection, deserialization of untrusted data, LDAP injection, and server-side request forgery (SSRF), exploiting weaknesses in input validation, improper access controls, and insecure deserialization.

The threat actors utilize a complex command and control (C&C) infrastructure managed by multiple teams, with overlapping tactics, techniques, and procedures (TTPs) shared among other Chinese APT groups or malware-as-a-service providers. Indicators of compromise include numerous IP addresses linked to campaigns named Beta (GHOSTSPIDER, DEMODEX) and Alpha (SNAPPYBEE), YARA rules for detecting backdoors, and hashes of malicious files and scripts. The campaign demonstrates a high level of operational security and sophistication, enabling persistent access and espionage capabilities over extended periods.

No patch is currently available for the specific CVE-2023-46805 vulnerability mentioned, and no known exploits in the wild have been reported for it. However, the presence of multiple high-severity vulnerabilities in widely deployed products like Microsoft Exchange Server and Ivanti appliances underscores the threat's potential impact.

Overall, this threat represents a multi-faceted, persistent cyber espionage campaign targeting critical infrastructure and sensitive sectors, leveraging a combination of high-impact vulnerabilities and advanced malware to maintain long-term access and data exfiltration capabilities.

Detailed information about OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions. Get real-time updates, technical details, and mitigation

OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

The threat intelligence report describes a newly identified Russia-affiliated threat actor known as Void Blizzard. This actor is reportedly targeting critical sectors for espionage activities. While specific technical details, such as attack vectors, malware payloads, or exploited vulnerabilities, are not provided, the classification under network activity and payload delivery suggests that Void Blizzard employs network-based intrusion techniques and possibly custom or known malware to infiltrate targeted environments. The actor's focus on critical sectors indicates a strategic intent to gather sensitive information, likely for intelligence or geopolitical advantage. The lack of known exploits in the wild and absence of patch availability imply that this threat actor may be leveraging novel or less understood tactics, techniques, and procedures (TTPs), or is in early stages of operational activity. The certainty level of 50% and low severity rating reflect limited confidence and currently low observed impact, but the perpetual nature of the OSINT feed suggests ongoing monitoring is warranted. Overall, Void Blizzard represents a persistent espionage threat with potential to compromise confidentiality of targeted organizations through sophisticated network intrusions and payload deployments.

Actor-controlled spear-phishing domain (Evilginx)

Actor-controlled spear-phishing domain (malicious sender)

Result from a rrset lookup on DNSDB about the hostname: outlook-office.micsrosoftonline.com

Detailed information about OSINT - New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. Get real-time updates, technical details, a

OSINT - New Russia-affiliated actor Void Blizzard targets critical sectors for espionage - Live Threat Intelligence - Threat Radar | OffSeq.com

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details a cyber espionage campaign attributed to the Sandworm intrusion set, a well-known advanced persistent threat (APT) group linked to Russian state-sponsored activities. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions deployed primarily on Linux servers. The attack leverages exploitation of public-facing applications (MITRE ATT&CK T1190) to gain initial access, followed by deployment of web shells (T1505.003) to maintain persistence and facilitate remote command execution. The adversaries perform file and directory discovery (T1083) to map the environment and identify valuable data. They also employ deobfuscation and decoding techniques (T1140) to analyze and manipulate files or information, likely to evade detection and understand system configurations. Communication with command and control (C2) servers is conducted over encrypted channels (T1573), using symmetric and asymmetric cryptography (T1573.001 and T1573.002), ensuring stealthy exfiltration of data (T1041). The attackers create or modify system processes (T1543) and Windows services (T1543.003) to establish persistence and facilitate lateral movement. The campaign is confirmed to target Linux systems in Western Europe, with high confidence in the indicators of compromise (IOCs) provided. Although no specific affected versions or patches are noted, the campaign's medium severity rating reflects the moderate threat level posed by this targeted espionage activity. The involvement of multiple threat actors such as Iridium, Telebots, Electrum, and Sandworm indicates a coordinated and persistent effort to compromise Centreon deployments for intelligence gathering or sabotage purposes.

Detailed information about [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and mitigation strate

[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

The threat involves two newly discovered Android spyware families attributed to the Russian Gamaredon APT group, as identified through OSINT by Lookout. Gamaredon is a known Russian state-sponsored threat actor group historically targeting Ukrainian entities and related interests. The spyware families are designed to operate on Android devices, likely aiming to conduct espionage by collecting sensitive information from infected mobile devices. Although specific technical details about the spyware capabilities, infection vectors, or payloads are not provided, the association with Gamaredon suggests these spyware families could be used for targeted surveillance, data exfiltration, and persistent access on compromised devices. The discovery is based on open-source intelligence with a moderate certainty level (50%), and no known exploits or patches are currently available. The campaign is categorized under network activity and payload delivery, indicating that the spyware is likely distributed through network-based vectors or social engineering. The severity is currently assessed as low, reflecting limited available details and no confirmed widespread exploitation. However, the presence of such spyware families highlights ongoing mobile threats from nation-state actors targeting Android platforms, which are widely used across Europe.

Detailed information about OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT. Get real-time updates, technical details, and miti

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT - Live Threat Intelligence - Threat Radar | OffSeq.com

VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature.

FluBot is a well-known Android banking Trojan that primarily spreads via SMS phishing campaigns. It tricks users into installing a malicious app that masquerades as legitimate software, often delivered through deceptive SMS messages containing links. Once installed, FluBot gains extensive control over the infected device, including the ability to intercept SMS messages, manipulate data, control call functions, and remotely wipe data without authorization. The malware leverages these capabilities to steal sensitive information such as banking credentials, intercept two-factor authentication codes sent via SMS, and potentially disrupt device availability by wiping data. The provided information references a VT collection of FluBot threat intelligence encoded in a STIX 2.1 bundle, imported via MISP-STIX. The tags and MITRE ATT&CK patterns associated with this threat highlight its multifaceted attack techniques: delivering malicious apps through alternative means (T1476), unauthorized remote data wiping (T1469), call control (T1616), data manipulation (T1641), SMS control (T1582), and SMS message capture (T1412). The threat is categorized under data and SMS interception, payload delivery, and network activity. Although no specific affected versions or patches are noted, FluBot’s modus operandi relies on social engineering and exploitation of user trust rather than software vulnerabilities. The threat is marked with low severity and 50% certainty, indicating moderate confidence in the intelligence. No known exploits in the wild are reported in this specific collection, but FluBot remains a persistent threat in mobile malware landscapes.

Detailed information about VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import fea

VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature. - Live Threat Intelligence - Threat Radar | OffSeq.com

CISA - AA24-131A #StopRansomware: Black Basta

The Black Basta ransomware is a malware threat characterized by its use of multiple attack techniques to gain initial access, evade defenses, and cause significant impact through data encryption and system recovery inhibition. Initial access methods include phishing campaigns (T1566) and the use of valid accounts (T1078), which allow attackers to infiltrate networks by tricking users or leveraging compromised credentials. Once inside, the malware employs defense evasion tactics such as disabling or modifying security tools (T1562.001) to avoid detection and prolong its presence. The ransomware then encrypts data to disrupt business operations (T1486) and inhibits system recovery mechanisms (T1490), preventing victims from restoring their systems without paying a ransom. Although no specific affected software versions or patches are noted, the threat is persistent and ongoing, as indicated by its perpetual lifetime tag. The severity is currently rated as low by the source, but the combination of attack patterns suggests a potentially impactful ransomware campaign. No known exploits in the wild or CVSS score are provided, but the tactics align with sophisticated ransomware operations that can cause substantial operational and financial damage.

Detailed information about CISA - AA24-131A #StopRansomware: Black Basta. Get real-time updates, technical details, and mitigation strategies.

CISA - AA24-131A #StopRansomware: Black Basta - Live Threat Intelligence - Threat Radar | OffSeq.com

Volt Typhoon targets US critical infrastructure with living-off-the-land techniques

Volt Typhoon is a threat actor group identified as targeting critical infrastructure, primarily within the United States, using sophisticated living-off-the-land (LotL) techniques. LotL methods involve leveraging legitimate system tools and processes to conduct malicious activities, thereby evading traditional detection mechanisms that focus on known malware signatures or anomalous binaries. This approach allows the adversary to maintain persistence, conduct reconnaissance, and potentially disrupt operations without deploying easily identifiable payloads. The threat is characterized by high confidence in analytic judgment and an almost-certain likelihood of activity, as reported by CIRCL OSINT Feed. Although specific technical details and affected software versions are not disclosed, the targeting of telecoms and critical infrastructure sectors suggests a focus on systems integral to national communications and operational continuity. The absence of known exploits or patches indicates that the threat leverages existing system capabilities rather than exploiting newly discovered vulnerabilities. The use of LotL techniques complicates detection and mitigation, requiring advanced monitoring of legitimate tool usage and behavior analytics. Given the high severity rating and the strategic importance of telecom infrastructure, Volt Typhoon represents a significant threat vector capable of impacting operational integrity and availability of critical services.

Detailed information about Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Get real-time updates, technical details, and mi

Title	Severity	Type	Source	Date

Threats Tagged 'osint:lifetime="perpetual"'

Filter Threats

Threats Tagged 'osint:lifetime="perpetual"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility