Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Updating: Tracking Powershell Empire C2 via Urlscan

The provided information pertains to tracking Command and Control (C2) infrastructure related to PowerShell Empire, a post-exploitation framework commonly used by threat actors for lateral movement, persistence, and data exfiltration within compromised networks. PowerShell Empire leverages PowerShell scripts to execute commands on victim machines, often bypassing traditional security controls. The mention of tracking via Urlscan.io indicates an OSINT (Open Source Intelligence) approach to monitor and identify malicious domains or URLs associated with PowerShell Empire C2 servers. Urlscan.io is a service that scans and indexes URLs, allowing analysts to detect suspicious or malicious web infrastructure. This tracking effort is not describing a new vulnerability or exploit but rather a method to observe and potentially disrupt botnet activity linked to PowerShell Empire. The threat is categorized as a botnet-related activity, with a medium severity level assigned, reflecting moderate risk primarily due to the potential for ongoing malicious operations if C2 servers remain active. No specific affected versions or patches are listed, and no known exploits in the wild are reported, indicating this is more an intelligence and monitoring update than a direct vulnerability or exploit notification.

Detailed information about Updating: Tracking Powershell Empire C2 via Urlscan. Get real-time updates, technical details, and mitigation strategies.

Updating: Tracking Powershell Empire C2 via Urlscan - Live Threat Intelligence - Threat Radar | OffSeq.com

Tracking Powershell Empire C2 via Urlscan

The provided information pertains to tracking the Command and Control (C2) infrastructure of the PowerShell Empire framework using the OSINT tool Urlscan.io. PowerShell Empire is a post-exploitation framework commonly used by threat actors to maintain persistence, execute commands, and exfiltrate data on compromised systems. The C2 servers are the backbone of this framework, enabling attackers to control infected hosts remotely. The threat described is not a direct vulnerability or exploit but rather an intelligence-gathering technique to identify and monitor PowerShell Empire C2 domains or URLs by leveraging Urlscan.io, a service that scans and indexes URLs for security analysis. This approach allows defenders and researchers to detect malicious infrastructure associated with PowerShell Empire campaigns by analyzing URL scan results and identifying patterns or indicators of compromise related to this tool. The threat level is medium, with no known active exploits in the wild, and the certainty of the OSINT information is moderate (50%). The technical details indicate a low threat level (2) and no direct analysis, suggesting this is primarily an intelligence or detection capability rather than an active attack vector. There are no affected product versions or patches since this is not a software vulnerability but a method for tracking malicious infrastructure. The tags emphasize the use of OSINT and the MITRE ATT&CK tool classification for Empire (S0363).

Detailed information about Tracking Powershell Empire C2 via Urlscan. Get real-time updates, technical details, and mitigation strategies.

Tracking Powershell Empire C2 via Urlscan - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT Following the Trail of BlackTechâ€™s Cyber Espionage Campaigns by TrendMicro

The threat described pertains to a cyber espionage campaign attributed to the threat actor group known as BlackTech, as analyzed and reported by TrendMicro. This campaign has been tracked through Open Source Intelligence (OSINT) methods, highlighting the use of publicly available information to follow the activities and infrastructure of BlackTech. BlackTech is known for conducting targeted cyber espionage operations, often focusing on government, military, and critical infrastructure sectors. Although specific technical details such as exploited vulnerabilities or malware variants are not provided in the available information, the campaign is characterized by its strategic intent to gather sensitive intelligence rather than widespread disruption. The absence of affected product versions and patch links suggests that the campaign leverages a combination of social engineering, custom malware, and possibly zero-day exploits or tailored intrusion techniques that are not publicly disclosed. The threat level is indicated as high, reflecting the sophisticated nature of the actor and the potential impact of their espionage activities. The campaign's detection through OSINT implies that defenders can leverage open-source data to identify indicators of compromise and track adversary infrastructure, although no specific indicators are currently listed. The lack of known exploits in the wild suggests that the campaign may rely on targeted, stealthy operations rather than mass exploitation.

Detailed information about OSINT Following the Trail of BlackTechâ€™s Cyber Espionage Campaigns by TrendMicro. Get real-time updates, technical details, and mit

Title	Severity	Type	Source	Date

Threats Tagged 'threat source:osint'

Filter Threats

Threats Tagged 'threat source:osint'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility