Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

UMBRELLA STAND is a sophisticated malware targeting FortiGate 100D series firewalls produced by Fortinet. It contains remote shell execution functionality, configurable beacon frequency, and AES-encrypted C2 communications. The malware uses fake TLS on port 443 to beacon to its C2 server and has the ability to run shell commands. It employs various defense evasion techniques such as hidden folders, generic filenames, and string encryption. UMBRELLA STAND also has persistence mechanisms through reboot hooking and ldpreload. Associated tooling includes BusyBox, nbtscan, tcpdump, and openLDAP. The malware demonstrates operational security considerations and shares similarities with previously reported COATHANGER malware.

UMBRELLA STAND is a sophisticated malware strain specifically targeting Fortinet FortiGate 100D series firewalls. This malware is designed to compromise network perimeter security devices, enabling attackers to gain remote shell access to the affected firewall. It features configurable beaconing intervals to communicate with its command and control (C2) servers over port 443 using fake TLS traffic, which helps it blend in with legitimate encrypted traffic and evade network detection. The C2 communications are encrypted using AES, adding a layer of confidentiality to the attacker’s command channel. UMBRELLA STAND employs multiple defense evasion techniques, including the use of hidden folders and generic filenames to avoid detection by administrators and security tools, as well as string encryption to hinder static analysis. For persistence, it hooks into the system reboot process and uses the ldpreload mechanism to maintain its presence even after device restarts. The malware also leverages legitimate tools such as BusyBox, nbtscan, tcpdump, and openLDAP to facilitate network reconnaissance and data exfiltration, indicating a high level of operational security and sophistication. The malware shares similarities with the previously documented COATHANGER malware, suggesting possible shared development lineage or adversary tactics. Notably, there are no known exploits in the wild targeting this malware yet, and no specific affected firmware versions have been identified, which may indicate either a targeted or emerging threat. The malware’s ability to execute arbitrary shell commands remotely on a firewall device poses a significant risk to network integrity and confidentiality.

Detailed information about Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices. Get real-time updates, technical details, and mitigatio

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices - Live Threat Intelligence - Threat Radar | OffSeq.com

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

Threats Tagged 'umbrella stand'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'umbrella stand'

Lead Pen Test Professional