Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Anubis is a new ransomware-as-a-service (RaaS) group that combines file encryption with file destruction capabilities. Active since December 2024, it features a 'wipe mode' that permanently erases files, making recovery impossible even if ransom is paid. The group operates a flexible affiliate program, offering negotiable revenue splits and supporting additional monetization paths like data extortion and access sales. Anubis has claimed victims in multiple sectors including healthcare and construction, across regions such as Australia, Canada, Peru, and the U.S. The ransomware uses spear-phishing for initial access, employs command-line execution, privilege escalation, and shadow copy deletion. Its encryption algorithm is similar to EvilByte/Prince ransomware, using Elliptic Curve Integrated Encryption Scheme (ECIES).

Anubis is a recently identified ransomware-as-a-service (RaaS) campaign active since December 2024. It distinguishes itself by combining traditional ransomware encryption with a destructive 'wipe mode' that irreversibly deletes files, preventing recovery even if victims pay the ransom. The ransomware employs spear-phishing emails as the primary initial access vector, targeting users with tailored messages to deliver malicious payloads. Once inside a system, Anubis executes commands via command-line interfaces, escalates privileges to gain higher system control, and deletes shadow copies to hinder recovery efforts. Its encryption mechanism uses the Elliptic Curve Integrated Encryption Scheme (ECIES), similar to the EvilByte/Prince ransomware family, providing strong cryptographic protection of victim files. The group operates a flexible affiliate program with negotiable revenue splits and supports multiple monetization strategies, including data extortion and selling access to compromised networks. Anubis has targeted multiple sectors such as healthcare and construction, with known victims primarily in Australia, Canada, Peru, and the United States. The ransomware’s tactics, techniques, and procedures (TTPs) include spear-phishing (T1566), command-line execution (T1059), privilege escalation (T1134.002), shadow copy deletion (T1490), and file encryption (T1486), reflecting a sophisticated and multi-faceted attack chain designed to maximize impact and complicate remediation.

Detailed information about Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper. Get real-time updates, technical details, and mitigation strateg

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper - Live Threat Intelligence - Threat Radar | OffSeq.com

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper

APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanese government website. Their attack chain involves spear-phishing emails, malicious ZIP archives, and a three-module malware system called ToughProgress. This malware uses stealthy techniques like in-memory execution, encryption, and process hollowing to evade detection. The unique aspect of ToughProgress is its use of Google Calendar events for covert data exchange, creating a stealthy communication channel for remote command execution and data exfiltration.

APT41 is a highly sophisticated Chinese state-sponsored threat actor known for combining cyber espionage with financially motivated cybercrime activities. Their recent operations have targeted diverse sectors globally, including healthcare, telecommunications, and government entities. A notable recent campaign involved the use of Google Calendar as a covert command-and-control (C2) channel, specifically observed targeting a Taiwanese government website. The attack chain typically begins with spear-phishing emails containing malicious ZIP archives, which deliver a modular malware family named ToughProgress. ToughProgress consists of three modules that employ advanced stealth techniques such as in-memory execution, encryption, and process hollowing to evade traditional detection mechanisms. The malware's unique innovation lies in leveraging Google Calendar events to exchange commands and exfiltrate data covertly, bypassing many network security controls that do not inspect legitimate cloud service traffic. This method allows remote attackers to execute commands and extract sensitive information without raising typical network alarms. The campaign also uses multiple domains and file hashes associated with the malware, indicating a well-resourced and persistent adversary. The tactics, techniques, and procedures (TTPs) employed by APT41 align with several MITRE ATT&CK techniques, including spear-phishing (T1566.001), process hollowing (T1055.012), and use of trusted cloud services for C2 (T1102.003). Although no known public exploits are currently in the wild for this malware, the threat actor's sophistication and stealth capabilities make detection and mitigation challenging.

MD5 of 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360

MD5 of 151257e9dfda476cdafd9983266ad3255104d72a66f9265caa8417a5fe1df5d7

MD5 of 3b88b3efbdc86383ee9738c92026b8931ce1c13cd75cd1cda2fa302791c2c4fb

MD5 of 469b534bec827be03c0823e72e7b4da0b84f53199040705da203986ef154406a

SHA1 of 469b534bec827be03c0823e72e7b4da0b84f53199040705da203986ef154406a

SHA1 of 3b88b3efbdc86383ee9738c92026b8931ce1c13cd75cd1cda2fa302791c2c4fb

SHA1 of 50124174a4ac0d65bf8b6fd66f538829d1589edc73aa7cf36502e57aa5513360

SHA1 of 151257e9dfda476cdafd9983266ad3255104d72a66f9265caa8417a5fe1df5d7

Detailed information about APT 41: Threat Intelligence Report and Malware Analysis. Get real-time updates, technical details, and mitigation strategies.

APT 41: Threat Intelligence Report and Malware Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

APT 41: Threat Intelligence Report and Malware Analysis

Arctic Wolf Labs discovered a new campaign by Venom Spider targeting corporate HR departments with fake resumes containing the More_eggs backdoor. The financially motivated threat group uses spear-phishing emails and abuses legitimate job platforms to apply for real jobs. The backdoor can steal credentials, customer data, and intellectual property. Several upgrades were found, including server-side polymorphism and evasion techniques. The attack chain involves obfuscated JavaScript, LNK files, and a dropper that generates polymorphic code. Organizations are advised to train employees on phishing awareness, especially those in HR who regularly open attachments from unknown senders.

The Venom Spider threat group has launched a sophisticated campaign targeting corporate Human Resources (HR) departments by exploiting the hiring process. The attack vector involves spear-phishing emails containing fake resumes that are crafted to appear as legitimate job applications. These emails often abuse legitimate job platforms to increase credibility and bypass initial suspicion. The payload delivered is the More_eggs backdoor, a malware capable of credential theft, exfiltration of customer data, and intellectual property theft. A notable technical advancement in this campaign is the use of server-side polymorphism, which dynamically changes the malware code on the server before delivery, making detection by traditional signature-based antivirus solutions more difficult. The attack chain includes obfuscated JavaScript, malicious LNK (Windows shortcut) files, and a dropper that generates polymorphic code, further complicating detection and analysis. The malware leverages multiple tactics and techniques such as command execution via scripting (T1059.007, T1059.003), network communication (T1071.001), persistence mechanisms (T1547.001), credential dumping (T1003.001), and evasion techniques (T1497.003). The campaign is financially motivated and specifically targets HR personnel who are more likely to open attachments from unknown senders due to the nature of their work. Indicators of compromise include numerous file hashes and suspicious domains, some of which appear to be used for command and control or data exfiltration. No known exploits in the wild have been reported yet, but the polymorphic nature and evasion techniques suggest a high level of sophistication and potential for widespread impact if successful.

Detailed information about Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims. Get real-time updates, technical details, and mitigation st

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims - Live Threat Intelligence - Threat Radar | OffSeq.com

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.

Earth Kasha, an advanced persistent threat (APT) group linked to the notorious APT10, has initiated a new cyber espionage campaign as of March 2025, primarily targeting government agencies and public institutions in Taiwan and Japan. This campaign employs spear-phishing techniques to deliver a refined version of the ANEL backdoor malware. The spear-phishing emails leverage compromised legitimate email accounts and contain malicious Excel attachments designed to exploit user interaction and evade detection. Key technical enhancements in this campaign include the introduction of a new command within the ANEL backdoor that facilitates the execution of Beacon Object Files (BOF) directly in memory, which enables stealthier and more flexible payload execution without writing to disk. For persistence, the attackers utilize SharpHide, a known tool that hides malicious code within legitimate .NET assemblies, complicating detection by traditional antivirus and endpoint detection systems. The second-stage payload, NOOPDOOR, has been updated to support Command and Control (C&C) communications over DNS over HTTPS (DoH), a technique that encrypts DNS traffic and helps evade network monitoring and filtering mechanisms. The attack chain is sophisticated, involving multiple evasion tactics such as the use of legitimate compromised accounts, obfuscated payloads, and living-off-the-land binaries to reduce forensic footprints. This campaign reflects Earth Kasha's ongoing evolution in tactics, techniques, and procedures (TTPs), emphasizing stealth, persistence, and secure communications to maintain long-term access for espionage objectives. Although currently observed targeting Taiwan and Japan, the techniques and tools used could be adapted to other regions, especially those with geopolitical significance or similar institutional profiles.

MD5 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc

SHA1 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc

Detailed information about Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Get real-time updates, technical details, and mitigation stra

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan - Live Threat Intelligence - Threat Radar | OffSeq.com

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

This analysis covers APT attacks detected in South Korea during April 2025. Spear phishing emerged as the primary distribution method for these attacks. Two main types of spear phishing were observed: Type A, which uses LNK files to distribute compressed malicious scripts for information leakage and additional malware downloads, and Type B, which executes RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks often employ decoy documents and target specific individuals or groups with crafted emails. Various file names were used to disguise the malicious content, often mimicking official documents or applications. The report highlights the sophisticated nature of these APT attacks and their potential impact on South Korean targets.

The April 2025 Threat Trend Report details a series of advanced persistent threat (APT) attacks targeting South Korea, primarily distributed through spear phishing campaigns. These attacks utilize two distinct spear phishing methods. Type A involves the use of LNK shortcut files, which execute compressed malicious scripts designed to exfiltrate sensitive information and facilitate the download of additional malware payloads. Type B spear phishing attacks deploy Remote Access Trojans (RATs), specifically XenoRAT and RoKRAT, leveraging cloud storage APIs such as Dropbox and Google Drive to execute malicious code. The attackers employ decoy documents to increase the likelihood of victim engagement, often crafting emails that appear to be official communications or applications, thereby targeting specific individuals or groups with tailored content. The malicious files are disguised under various filenames mimicking legitimate documents, enhancing their stealth. Indicators of compromise include multiple file hashes associated with the malware, IP addresses, and domains linked to command and control infrastructure. Although no known exploits in the wild are reported, the sophistication of the attack vectors and the use of legitimate cloud services for malware delivery highlight a well-resourced adversary capable of evading traditional detection mechanisms. The campaign's focus on information leakage and RAT deployment suggests objectives aligned with espionage and long-term network persistence within targeted environments.

Detailed information about April 2025 Threat Trend Report on APT Attacks (South Korea). Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'spear-phishing'

Filter Threats

Threats Tagged 'spear-phishing'