Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated ransomware campaign has been uncovered, masquerading as a new SAP Ariba tool. The attack uses email lures, sender spoofing, and impersonation of legitimate software vendors to deliver LeeMe Ransomware. The malware employs SAP branding, a fake GUI, and a Portuguese ransom note. It targets various file types using AES-256 encryption and includes keylogging and data exfiltration capabilities. The ransomware creates autorun entries, bypasses Windows Defender, and sets up remote access. With a relatively low ransom demand, it appears to be a widespread campaign rather than targeting high-value individuals. The attack serves as a reminder of the importance of user vigilance and proper cybersecurity measures.

The threat described is a sophisticated ransomware campaign that masquerades as a legitimate SAP Ariba tool, specifically a fake 'SAP Ariba Quote' application. The attackers use social engineering techniques including email lures, sender spoofing, and impersonation of legitimate software vendors to trick victims into executing the malware. The ransomware, identified as LeeMe, employs SAP branding and a fake graphical user interface (GUI) to increase its credibility. The ransom note is written in Portuguese, indicating possible targeting or origin. LeeMe ransomware encrypts a wide range of file types using strong AES-256 encryption, rendering data inaccessible to victims. Beyond encryption, it also incorporates keylogging capabilities to capture user credentials and sensitive information, and it exfiltrates data to the attackers, increasing the risk of data breaches. The malware establishes persistence by creating autorun entries and evades detection by bypassing Windows Defender. It also sets up remote access, allowing attackers to maintain control over infected systems. The ransom demand is relatively low, suggesting a broad, opportunistic campaign rather than one focused on high-value targets. The attack leverages multiple MITRE ATT&CK techniques such as T1547 (boot or logon autostart execution), T1562 (impair defenses), T1566 (phishing), T1486 (data encrypted for impact), and others, indicating a multi-faceted approach to infection, persistence, and impact. This campaign highlights the ongoing threat of ransomware combined with data exfiltration and credential theft, emphasizing the importance of user vigilance and robust cybersecurity defenses.

Detailed information about This 'SAP Ariba Quote' Isn't What It Seems—It's Ransomware. Get real-time updates, technical details, and mitigation strategies.

This 'SAP Ariba Quote' Isn't What It Seems—It's Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

This 'SAP Ariba Quote' Isn't What It Seems—It's Ransomware

Threats Tagged 'sap ariba'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'sap ariba'

Lead Pen Test Professional