Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT Track to the future - How to use historical intelligence to get back to the future and defend your organization (example using APT28) by ThreatConnect

The provided information describes a cybersecurity campaign focused on the use of Open Source Intelligence (OSINT) to analyze historical intelligence data for defensive purposes, specifically using the example of the APT28 threat actor, also known as Sofacy. APT28 is a well-known advanced persistent threat group attributed to Russian state-sponsored actors, recognized for targeting government, military, security organizations, and critical infrastructure primarily in Europe and NATO countries. The campaign emphasizes leveraging historical intelligence to anticipate and defend against future attacks by understanding the tactics, techniques, and procedures (TTPs) of APT28. This approach involves collecting, analyzing, and correlating publicly available data and past attack patterns to build a proactive defense strategy. The campaign itself is not a direct exploit or vulnerability but rather a strategic intelligence methodology aimed at improving organizational security posture against APT28. The source is a blog-post style OSINT report published by CIRCL and ThreatConnect in 2017, categorized under a high severity threat due to the nature of the adversary and potential impact of their operations. No specific affected software versions or exploits are identified, and no direct technical vulnerabilities are described. Instead, the focus is on threat actor profiling and intelligence-driven defense mechanisms.

Detailed information about OSINT Track to the future - How to use historical intelligence to get back to the future and defend your organization (example using 

OSINT Track to the future - How to use historical intelligence to get back to the future and defend your organization (example using APT28) by ThreatConnect - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT Fancy Bear Pens the Worst Blog Posts Ever by ThreatConnect

The threat described pertains to a campaign attributed to the advanced persistent threat (APT) group known as Fancy Bear, also referred to as Sofacy or APT28. This group is widely recognized for its state-sponsored cyber espionage activities, primarily targeting government, military, security organizations, and critical infrastructure entities globally. The campaign is characterized by the publication of misleading or low-quality blog posts, which appear to be a form of open-source intelligence (OSINT) manipulation or disinformation. While the technical details are sparse, the involvement of Fancy Bear suggests a strategic use of information operations to influence public perception or to conduct psychological operations alongside their cyber espionage efforts. The campaign does not involve direct exploitation of software vulnerabilities or malware deployment, as indicated by the absence of known exploits in the wild and lack of affected software versions. Instead, it leverages the threat actor's capability to disseminate deceptive content, potentially to mislead analysts, disrupt intelligence gathering, or sow confusion among targeted audiences. The threat level and analysis scores provided (threatLevel: 1, analysis: 2) imply a recognized but not fully detailed threat profile. Given the nature of the campaign, the primary technical concern lies in the manipulation of OSINT channels and the potential indirect impact on decision-making processes within targeted organizations.

Detailed information about OSINT Fancy Bear Pens the Worst Blog Posts Ever by ThreatConnect. Get real-time updates, technical details, and mitigation strategies

OSINT Fancy Bear Pens the Worst Blog Posts Ever by ThreatConnect - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT Duping Doping Domains - Possible Fancy Bear Domains Spoofing Anti-Doping and Olympic Organizations by ThreatConnect

This threat campaign involves the use of spoofed domains by the advanced persistent threat (APT) group known as Sofacy, Fancy Bear, or APT28. The campaign is characterized by the creation and deployment of deceptive domains that impersonate legitimate anti-doping and Olympic organizations. These spoofed domains are designed to dupe targets into interacting with them, potentially enabling the threat actor to conduct espionage, credential harvesting, or deliver malware payloads. The campaign was publicly reported by ThreatConnect and sourced from CIRCL in early 2018. Sofacy is a well-known Russian state-sponsored threat actor with a history of targeting government, military, and strategic organizations globally. The spoofing of anti-doping and Olympic-related domains suggests a strategic interest in the international sports community, possibly to gather intelligence or disrupt activities related to doping controls and Olympic events. The technical details indicate a high threat level with moderate analysis confidence, but no specific vulnerabilities or exploits are identified. The absence of known exploits in the wild implies this campaign primarily relies on social engineering and domain impersonation rather than exploiting software vulnerabilities. The campaign fits the profile of an APT operation focusing on reconnaissance, information gathering, and possibly initial access through phishing or credential theft via the spoofed domains.

Detailed information about OSINT Duping Doping Domains - Possible Fancy Bear Domains Spoofing Anti-Doping and Olympic Organizations by ThreatConnect. Get real-t

OSINT Duping Doping Domains - Possible Fancy Bear Domains Spoofing Anti-Doping and Olympic Organizations by ThreatConnect - Live Threat Intelligence - Threat Radar | OffSeq.com

Finding Nemo(hosts) from Sofacy by ThreatConnect

The threat campaign titled "Finding Nemo(hosts) from Sofacy by ThreatConnect" is attributed to the Sofacy group, also known as APT28, a well-known advanced persistent threat actor with a history of cyber espionage activities primarily targeting government, military, and strategic sectors. This campaign was reported by CIRCL and documented in 2017, with a high severity rating assigned by the source. Sofacy is recognized for sophisticated, targeted intrusions often involving spear-phishing, zero-day exploits, and custom malware to gain persistent access to sensitive networks. Although specific technical details and affected versions are not provided, the campaign's designation as a high-severity APT operation implies significant risk to information confidentiality and integrity. The campaign appears to focus on identifying and exploiting hosts (Finding Nemo(hosts)) to establish footholds within targeted environments, likely leveraging advanced reconnaissance and tailored attack vectors. The lack of known exploits in the wild suggests this may be a targeted or emerging campaign rather than a widespread exploit. The threat level and analysis scores indicate a credible and concerning threat, though some uncertainty remains due to limited public technical details. Sofacy's historical modus operandi includes targeting NATO countries, defense contractors, and governmental institutions, often aiming to exfiltrate sensitive intelligence or disrupt operations. The campaign's association with information credibility and the admiralty-scale tags suggest a focus on validating or undermining data sources, possibly through misinformation or manipulation of network hosts to facilitate espionage or influence operations.

Detailed information about Finding Nemo(hosts) from Sofacy by ThreatConnect. Get real-time updates, technical details, and mitigation strategies.

Finding Nemo(hosts) from Sofacy by ThreatConnect - Live Threat Intelligence - Threat Radar | OffSeq.com

What's in a server name (on APT28/Sofacy) by ThreatConnect

The provided information relates to a campaign associated with the threat actor group known as APT28 or Sofacy, a well-documented advanced persistent threat (APT) actor linked to cyber espionage activities. The campaign is titled "What's in a server name (on APT28/Sofacy)" and was reported by ThreatConnect and sourced from CIRCL in 2016. Although specific technical details about the campaign are limited in the provided data, the reference to server names suggests an analysis or exploitation technique involving infrastructure naming conventions used by the threat actor. APT28 is known for sophisticated spear-phishing, malware deployment, and use of custom command-and-control (C2) servers to conduct espionage primarily targeting government, military, and security organizations. The campaign is categorized as medium severity, with no known exploits in the wild at the time of reporting. The lack of affected versions or patch links indicates this is more of an intelligence or reconnaissance campaign rather than a vulnerability exploitation. The threat level and analysis scores are moderate (both 2), consistent with a medium severity threat. The campaign likely involves OSINT techniques to identify or track APT28 infrastructure through server naming patterns, which can aid defenders in attribution and detection efforts.

Detailed information about What's in a server name (on APT28/Sofacy) by ThreatConnect. Get real-time updates, technical details, and mitigation strategies.

What's in a server name (on APT28/Sofacy) by ThreatConnect - Live Threat Intelligence - Threat Radar | OffSeq.com

Pivot on What's in a server name (on APT28/Sofacy) by ThreatConnect

The provided information pertains to a cyber threat campaign attributed to APT28, also known as Sofacy, a well-known advanced persistent threat group linked to Russian state-sponsored activities. The campaign is titled "Pivot on What's in a server name," as reported by ThreatConnect and sourced from CIRCL. The description suggests an intelligence gathering or pivoting technique that leverages server naming conventions to track or analyze the infrastructure used by APT28. While specific technical details of the campaign are limited, the reference to server names implies that the threat actors may be using patterns in domain or server naming to mask their operations or to facilitate lateral movement within compromised networks. The campaign is categorized as medium severity and is tagged with OSINT (Open Source Intelligence), indicating that the analysis likely involves publicly available information to uncover or track the threat actor's infrastructure. No specific affected software versions or exploits are mentioned, and no known exploits in the wild are reported. The threat level and analysis scores are moderate (2 out of an unspecified scale), and the information credibility is rated as 2 on the Admiralty scale, suggesting moderate confidence in the data. Overall, this campaign highlights the use of subtle indicators such as server names for threat actor infrastructure analysis and tracking, rather than a direct vulnerability or exploit targeting specific software.

Detailed information about Pivot on What's in a server name (on APT28/Sofacy) by ThreatConnect. Get real-time updates, technical details, and mitigation strateg

Title	Severity	Type	Source	Date

Threats Tagged 'threat:sofacy/apt28'

Filter Threats