Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report details a cyberattack where threat actors gained initial access through a password spray attack on an exposed RDP server. They used Mimikatz and Nirsoft for credential harvesting, and employed living-off-the-land techniques along with tools like Advanced IP Scanner for network discovery. The attackers utilized Rclone for data exfiltration via SFTP and deployed RansomHub ransomware across the network using SMB and remote services. The intrusion lasted six days, culminating in widespread encryption and ransom demands. Key phases included initial access, lateral movement, credential theft, data exfiltration, and ransomware deployment, demonstrating a sophisticated and multi-staged attack methodology.

This threat report describes a sophisticated multi-stage cyberattack leveraging exposed Remote Desktop Protocol (RDP) servers as the initial attack vector. The attackers employed a password spray technique to gain unauthorized access to vulnerable RDP endpoints. Password spraying involves systematically attempting commonly used passwords across many accounts to avoid account lockouts and detection. Once initial access was achieved, the adversaries used credential harvesting tools such as Mimikatz and Nirsoft utilities to extract plaintext credentials and hashes from compromised systems. This credential theft facilitated lateral movement within the network, allowing the attackers to escalate privileges and expand their foothold.

The attackers utilized living-off-the-land (LotL) techniques, leveraging legitimate system tools and utilities to avoid detection. For network discovery, they used Advanced IP Scanner, enabling them to map the internal network and identify additional targets. Data exfiltration was conducted using Rclone, a legitimate cloud storage synchronization tool, configured to transfer stolen data via SFTP to attacker-controlled infrastructure. The final stage involved deploying RansomHub ransomware across the network, using SMB and remote services to propagate and encrypt files on multiple systems. The entire intrusion persisted for six days, culminating in widespread encryption of organizational data and ransom demands.

This attack chain highlights the threat actor’s operational sophistication, combining brute-force initial access, credential theft, stealthy lateral movement, data exfiltration, and ransomware deployment. The use of common administrative tools and legitimate software complicates detection and response efforts. The absence of a CVSS score notwithstanding, the attack demonstrates significant risk due to its multi-vector approach and potential for severe operational disruption.

Detailed information about Hide Your RDP: Password Spray Leads to RansomHub Deployment. Get real-time updates, technical details, and mitigation strategies.

Hide Your RDP: Password Spray Leads to RansomHub Deployment - Live Threat Intelligence - Threat Radar | OffSeq.com

Hide Your RDP: Password Spray Leads to RansomHub Deployment

Threats Tagged 'password spray'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'password spray'

Lead Pen Test Professional