Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communication, and perform remote administration. They forge file signatures to disguise their toolset and mask malicious activities. The attackers are suspected to be acting as initial access brokers, creating footholds in financial institutions to sell access on darknet markets. Their playbook includes lateral movement techniques such as creating remote services, executing through DCOM, and using PsExec. The threat actor also employs evasion methods like using packers and signing tools with stolen signatures.

Since July 2023, a cybercriminal group identified as CL-CRI-1014 has been conducting targeted attacks against financial institutions across Africa. This threat actor leverages open-source and publicly available tools such as PoshC2, Chisel, and Classroom Spy to build flexible attack frameworks. PoshC2 is a well-known post-exploitation framework used for command and control (C2), Chisel is used to create encrypted tunnels for network communication, and Classroom Spy is a remote administration tool. By combining these tools, the attackers establish persistent footholds within victim networks, enabling remote control and data exfiltration. To evade detection, the attackers forge file signatures, making their malicious tools appear legitimate, and use packers and stolen digital signatures to mask their malware binaries. Their operational playbook includes lateral movement techniques such as creating remote services, executing commands via Distributed Component Object Model (DCOM), and leveraging PsExec for remote code execution. These techniques allow the threat actor to move laterally within compromised networks, escalating privileges and expanding access. The group is suspected to act as initial access brokers, compromising financial organizations and then selling access on darknet markets to other malicious actors. The attack chain involves sophisticated evasion and persistence mechanisms, including the use of scheduled tasks (T1053.005), masquerading (T1036.005), and code injection (T1055). Although no known exploits are currently reported in the wild for specific vulnerabilities, the use of legitimate tools and stolen signatures complicates detection and mitigation efforts. The threat is categorized as medium severity, reflecting the moderate but significant risk posed by these targeted intrusions.

Detailed information about Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector. Get real-time updates, technical details, and mitigation 

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector

Threats Tagged 'poshc2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'poshc2'

Lead Pen Test Professional