Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat titled "Dridex to Empire" appears to describe a linkage or transition between the Dridex malware and the PowerShell Empire post-exploitation framework. Dridex is a well-known banking Trojan primarily used to steal banking credentials and perform financial fraud. It typically spreads via malicious email attachments and macro-enabled documents. PowerShell Empire is a post-exploitation tool that provides an attacker with a range of capabilities such as privilege escalation, lateral movement, and persistence within compromised environments, leveraging PowerShell scripts. The mention of "Dridex to Empire" suggests a scenario where initial compromise is achieved using Dridex, which then deploys or hands off control to Empire to conduct further post-exploitation activities. This combination allows attackers to move beyond initial credential theft to deeper network infiltration and control. The technical details are sparse, with no specific affected versions or exploits in the wild noted, and the severity is marked as low by the source. The threat level and analysis scores are moderate (3 and 2 respectively), indicating some concern but limited detailed information. The lack of indicators or patch links suggests this is more an observed tactic or toolchain rather than a newly discovered vulnerability or exploit. Overall, this threat highlights a multi-stage attack methodology combining malware delivery with advanced post-exploitation frameworks to maximize attacker control and persistence.

Detailed information about Dridex to Empire. Get real-time updates, technical details, and mitigation strategies.

Dridex to Empire - Live Threat Intelligence - Threat Radar | OffSeq.com

Dridex to Empire

Updating: Tracking Powershell Empire C2 via Urlscan

The provided information pertains to tracking Command and Control (C2) infrastructure related to PowerShell Empire, a post-exploitation framework commonly used by threat actors for lateral movement, persistence, and data exfiltration within compromised networks. PowerShell Empire leverages PowerShell scripts to execute commands on victim machines, often bypassing traditional security controls. The mention of tracking via Urlscan.io indicates an OSINT (Open Source Intelligence) approach to monitor and identify malicious domains or URLs associated with PowerShell Empire C2 servers. Urlscan.io is a service that scans and indexes URLs, allowing analysts to detect suspicious or malicious web infrastructure. This tracking effort is not describing a new vulnerability or exploit but rather a method to observe and potentially disrupt botnet activity linked to PowerShell Empire. The threat is categorized as a botnet-related activity, with a medium severity level assigned, reflecting moderate risk primarily due to the potential for ongoing malicious operations if C2 servers remain active. No specific affected versions or patches are listed, and no known exploits in the wild are reported, indicating this is more an intelligence and monitoring update than a direct vulnerability or exploit notification.

Detailed information about Updating: Tracking Powershell Empire C2 via Urlscan. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'powershell empire'

Filter Threats

Threats Tagged 'powershell empire'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility