type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Daily Incremental ThreatFox Import - 2026-07-05


Daily Incremental ThreatFox Import - 2026-07-03


ClearFake payload delivery domain (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


StrelaStealer payload delivery domain (confidence level: 100%)


Cobalt Strike botnet C2 domain (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-02


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Unknown malware botnet C2 domain (confidence level: 100%)


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Unknown malware payload delivery domain (confidence level: 100%)


EGoManiac | An Unscrupulous Turkish-Nexus Threat Actor


Ivanti Connect Secure VPN Post-Exploitation

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"


Mirai botnet C2 domain (confidence level: 100%)


FAKEUPDATES botnet C2 domain (confidence level: 100%)


CinaRAT Resurfaces With New Evasive Tactics and Techniques

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


The Jalisco Toolkit and AI-Powered Phishing Surge


tg.pe takedown: phishing · bestsaleoffers.shop

Destination host, removed by tg.pe — registered 2026-06-15 (10d old) · Registry serverHold applied 2026-07-02T20:50Z (RDAP last-changed); last observed serving 2026-06-26T12:10Z (urlscan, HTTP 200); NXDOMAIN confirmed 2026-07-03. Domain had a prior registration life Jan-Feb 2026 (VT pDNS), dropped, re-registered 2026-06-15.


misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Indirect Prompt Injection (IPI) Campaigns

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Unknown Stealer botnet C2 domain (confidence level: 100%)


Unknown Loader botnet C2 domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


AsyncRAT botnet C2 domain (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Romania Land Registry (ANCPI e-Terra) Cyberattack by ByteToBreach

ByteToBreach Victim Shaming & Extortion Website

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Data Destruction - T1485"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"


ClearFake payload delivery domain (confidence level: 100%)


TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains


StrelaStealer payload delivery domain (confidence level: 100%)


Fake pirated software sites serve up malware droppers as a service

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Daily Incremental ThreatFox Import - 2026-06-25


SmartApeSG payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)


misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


Daily Incremental ThreatFox Import - 2026-07-03


Daily Incremental ThreatFox Import - 2026-07-04


Daily Incremental ThreatFox Import - 2026-07-05


Indicators of Compromise Associated with OnePercent  Group Ransomware

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Defray Ransomware Targets Education and Healthcare Verticals

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="System Checks - T1497.001"


MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


EGoManiac | An Unscrupulous Turkish-Nexus Threat Actor


misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


Unknown malware botnet C2 domain (confidence level: 100%)


As Delta Variant Spreads, COVID-19 Themes Make Resurgence In Email Threats

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Satacom botnet C2 domain (confidence level: 100%)


KongTuke payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Unknown malware payload delivery domain (confidence level: 100%)


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


Mirai botnet C2 domain (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-02


Vidar botnet C2 domain (confidence level: 100%)


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

WARNING - Potential False positive:
Top 1,000,000 most-used sites from Tranco

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


ESET: UEFI threats moving to the ESP: Introducing ESPecter bootkit

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564"

misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562"

misp-galaxy:mitre-attack-pattern="Modify System Image - T1601"

misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542"

misp-galaxy:mitre-attack-pattern="Subvert Trust Controls - T1553"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564"

misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562"

misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564"

misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"


ClearFake payload delivery domain (confidence level: 100%)


Unknown Loader botnet C2 domain (confidence level: 100%)


The Jalisco Toolkit and AI-Powered Phishing Surge


Unknown Stealer botnet C2 domain (confidence level: 100%)


StrelaStealer payload delivery domain (confidence level: 100%)


Unknown Loader payload delivery domain (confidence level: 100%)


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


SmartApeSG payload delivery domain (confidence level: 100%)


Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities

Malware Masquerading NCSA Phishing lure tlp:clear


misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


Daily Emotet IoCs and Notes for 2021/01/20


Powershell ClearFake tlp:white type:OSINT

ClearFake Powershell tlp:white type:OSINT


Distribution of a CoinMiner Targeting Linux SSH Servers via Malware Distribution via Network Transmission

NCSA NCSA_Research Malware Cybercrime linux tlp:clear

Malware Cybercrime NCSA NCSA_Research linux tlp:clear


Travel Themed Phishing URLs Set to Prey on Eager Travelers

misp-galaxy:mitre-attack-pattern="Brute Force - T1110"

misp-galaxy:mitre-attack-pattern="Create Account - T1136"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"


Daily Incremental ThreatFox Import - 2026-07-03


APVA phishing/scam indicators 2026-07-05 07:39 (38 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


misp-galaxy:mitre-attack-pattern="Input Capture - T1056"


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Daily Incremental ThreatFox Import - 2026-07-05


Beware of Fake Offers for Celine Dion Concert Tickets

NCSA NCSA_Research fake tlp:clear Cybercrime

Cybercrime NCSA NCSA_Research fake tlp:clear


TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead

C2
infostealer
NCSA
Social Engineering
Tiktok
tlp:clear


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

The domain can be legit, BUT the particular resource sitting on that domain is definitely malicious.

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


New Stealthy Ransomware Deployed Against Asian IT Company


New campaign targeting security researchers

misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032"

misp-galaxy:amitt-misinformation-pattern="Twitter trolls amplify and manipulate"


Beware of Phishing Emails Disguised as Money Transfer Confirmations


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


NCSA NCSA_Research fake tlp:clear Cybercrime

Cybercrime NCSA NCSA_Research fake tlp:clear


SmartApeSG payload delivery URL (confidence level: 100%)


Vidar payload delivery URL (confidence level: 75%)


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


Phishing Campaign Related to Shipping Leverages WOFF Obfuscation and Telegram Channels for Communication

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


Daily Incremental ThreatFox Import - 2026-07-04


Satacom botnet C2 (confidence level: 100%)


KongTuke payload delivery URL (confidence level: 100%)


The Jalisco Toolkit and AI-Powered Phishing Surge


misp-galaxy:mitre-attack-pattern="Input Capture - T1056"


Daily Phishing list urlabuse.com - 2024-05-04


Redirect chain #1 from http://getstarts-ledgrscdn.wixstudio.com/en-us


Unknown malware botnet C2 (confidence level: 100%)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Analysis Report of Kimsuky Group's APT Attacks (AppleSeed, PebbleDash)

misp-galaxy:threat-actor="Kimsuky" AhnLab tlp:white kimsuky splunk:OK

AhnLab kimsuky misp-galaxy:threat-actor="Kimsuky" splunk:OK tlp:white


This Is Not a Test_ APT41 Initiates Global Intrusion Campaign Using Multiple Exploits _ FireEye Inc

misp-galaxy:mitre-attack-pattern="Custom Command and Control Protocol - T1094"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Uncommonly Used Port - T1065"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="New Service - T1050"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197"


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

APVA phishing/scam indicators 2026-07-05 07:39 (38 indicators)


Daily Incremental ThreatFox Import - 2026-07-03


APVA phishing/scam indicators 2026-07-05 07:39 (38 indicators)


Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities

Malware Masquerading NCSA Phishing lure tlp:clear


Daily Incremental ThreatFox Import - 2026-07-02


Vidar botnet C2 (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-05


Unknown malware payload delivery URL (confidence level: 90%)


misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1548.002"

misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1027.005"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1518.001"

misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1564.004"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Redirect chain #1 from https://ledger.app-and-web3.shop/start/


Redirect chain #2 from https://ledger.app-and-web3.shop/start/


misp-galaxy:mitre-attack-pattern="Input Capture - T1056"


misp-galaxy:malpedia="Unidentified 111 (IcedID Loader)"


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Daily Emotet IoCs and Notes for 2021/01/20


Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


Beware of Fake Offers for Celine Dion Concert Tickets

NCSA NCSA_Research fake tlp:clear Cybercrime

Cybercrime NCSA NCSA_Research fake tlp:clear


SmartApeSG payload delivery URL (confidence level: 100%)


LabubaRAT A Rust Based Remote Access Tool Masquerading as NVIDIA Software

NCSA NCSA_Research RAT tlp:clear Create-By"Methanon"

Create-By"Methanon" NCSA NCSA_Research RAT tlp:clear


LabubaRAT: Masquerading as NVIDIA Software


LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

Malware Masquerading NCSA RAT nvidia windows tlp:clear

Malware Masquerading NCSA RAT nvidia tlp:clear windows


Malware ClickFix infostealer DPRK NCSA blockchain etherhiding macOS tlp:clear


Unknown malware payload delivery URL (confidence level: 100%)


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

WARNING - Potential False positive:
Top 1,000,000 most-used sites from Tranco
Top 10K most-used sites from Tranco

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Vidar payload delivery URL (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead

C2
infostealer
NCSA
Social Engineering
Tiktok
tlp:clear


NCSA NCSA_Research fake tlp:clear Cybercrime

Cybercrime NCSA NCSA_Research fake tlp:clear


KongTuke payload delivery URL (confidence level: 100%)


DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


New campaign targeting security researchers

misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032"

misp-galaxy:amitt-misinformation-pattern="Twitter trolls amplify and manipulate"


Chinese Alloy Taurus Updates PingPull Malware

tlp:white ncsc-nl-ndn:distribute="Z-CERT" ncsc-nl-ndn:feed="generic" retention:3m misp-galaxy:threat-actor="GALLIUM"

misp-galaxy:threat-actor="GALLIUM" ncsc-nl-ndn:distribute="Z-CERT" ncsc-nl-ndn:feed="generic" retention:3m tlp:white


Phishing Campaign Related to Shipping Leverages WOFF Obfuscation and Telegram Channels for Communication

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


Daily Incremental ThreatFox Import - 2026-07-03


APVA phishing/scam indicators 2026-07-05 07:39 (38 indicators)


misp-galaxy:mitre-attack-pattern="Input Capture - T1056"


Unknown malware botnet C2 (confidence level: 100%)


The Jalisco Toolkit and AI-Powered Phishing Surge


NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Travel Themed Phishing URLs Set to Prey on Eager Travelers

misp-galaxy:mitre-attack-pattern="Brute Force - T1110"

misp-galaxy:mitre-attack-pattern="Create Account - T1136"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"


misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise

misp-galaxy:sector="Energy" FBI tlp:white Energy

Energy FBI misp-galaxy:sector="Energy" tlp:white


CU-000162-MW: Indicators of Compromise Associated with LockBit 2.0 Ransomware

misp-galaxy:ransomware="LockBit" FBI tlp:white lockbit

FBI lockbit misp-galaxy:ransomware="LockBit" tlp:white


PIN Number 20211101-001: Ransomware Actors Use Significant Financial Events and Stock Valuation to Facilitate Targeting and Extortion of Victims

misp-galaxy:ransomware="Darkside"
misp-galaxy:country="canada"
misp-galaxy:country="new zealand"
FBI
tlp:white
darkside
canada
new zealand

FBI
canada
darkside
misp-galaxy:country="canada"
misp-galaxy:country="new zealand"
misp-galaxy:ransomware="Darkside"
new zealand
tlp:white


CU-000161-MW: Indicators of Compromise Associated with Diavol Ransomware


AC-000159-MW: APT Actors Exploiting Newly-Identified Zero Day in ManageEngine Desktop Central (CVE-2021-44515)


misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032"

misp-galaxy:amitt-misinformation-pattern="Twitter trolls amplify and manipulate"


Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


Operation Blockbuster RAT and Staging Report


Guildma_ The Devil drives electric _ WeLiveSecurity

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Credentials in Files - T1081"

misp-galaxy:mitre-attack-pattern="XSL Script Processing - T1220"

misp-galaxy:mitre-attack-pattern="Custom Cryptographic Protocol - T1024"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="NTFS File Attributes - T1096"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Credentials in Registry - T1214"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="BITS Jobs - T1197"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Daily Incremental ThreatFox Import - 2026-07-04


Trash Panda as a Service: Raccoon Stealer steals cookies, cryptocoins, and more

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Multi-Stage Channels - T1104"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"


Mirai opendir elf ua-wget tlp:white type:OSINT

Mirai elf opendir tlp:white type:OSINT ua-wget


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


ClearFake payload delivery domain (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-05


Unknown Loader botnet C2 domain (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-02


Indirect Prompt Injection (IPI) Campaigns

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Phishing Campaign Related to Shipping Leverages WOFF Obfuscation and Telegram Channels for Communication

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


SmartApeSG payload delivery domain (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-03


StrelaStealer payload delivery domain (confidence level: 100%)


Vidar botnet C2 domain (confidence level: 75%)


APVA phishing/scam indicators 2026-06-18 19:27 (48 indicators)


Defray Ransomware Targets Education and Healthcare Verticals

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="System Checks - T1497.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


KongTuke payload delivery domain (confidence level: 100%)


Fake pirated software sites serve up malware droppers as a service

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


APVA phishing/scam indicators 2026-07-05 07:39 (38 indicators)

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


The Jalisco Toolkit and AI-Powered Phishing Surge


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Daily Incremental ThreatFox Import - 2026-06-07


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


UNC215: Spotlight on a Chinese Espionage Campaign in Israel

178.79.177.69: Enriched via the shodan module

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

178.79.177.69: Enriched via the shodan module


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Daily Incremental ThreatFox Import - 2026-07-04


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Vidar botnet C2 domain (confidence level: 50%)


CinaRAT Resurfaces With New Evasive Tactics and Techniques

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"


Agent Tesla
AgentTesla
keylogger/infostealer
tlp:white


PhantomStealer in .rar email attachment (SMTP exfil)


Daily Incremental ThreatFox Import - 2026-07-05


Indirect Prompt Injection (IPI) Campaigns

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Unknown RAT botnet C2 domain (confidence level: 100%)


Remus botnet C2 domain (confidence level: 100%)


misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


Daily Incremental ThreatFox Import - 2026-07-02


ClearFake payload delivery domain (confidence level: 100%)


Some URL shortener services distribute Android malware, including banking or SMS trojans

misp-galaxy:mitre-attack-pattern="Suppress Application Icon - T1508"

misp-galaxy:mitre-attack-pattern="Masquerade as Legitimate Application - T1444"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


Matryoshka : Variant of ROKRAT, APT37 (Scarcruft)

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


APVA phishing/scam indicators 2026-06-18 19:27 (48 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Daily Incremental ThreatFox Import - 2026-07-03


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)

Nameserver(s) for https://aboteleb.com/article/3sN9X_8-jL7g Related to https://aboteleb.com/article/3sN9X_8-jL7g, https://aboteleb.com/article/EE3PvmX-48mA


Ivanti Connect Secure VPN Post-Exploitation

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"


Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

Warning: Potential false positives
Top 1,000,000 most-used sites from Tranco

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Email Collection - T1114"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


StrelaStealer payload delivery domain (confidence level: 100%)


Fake pirated software sites serve up malware droppers as a service

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


SmartApeSG payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"

Indirect Prompt Injection (IPI) Campaigns


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


Unknown Stealer botnet C2 domain (confidence level: 100%)


Unknown malware payload delivery domain (confidence level: 100%)


Fake pirated software sites serve up malware droppers as a service


Unknown Loader botnet C2 domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Unknown malware botnet C2 domain (confidence level: 100%)


Agent Tesla
AgentTesla
keylogger/infostealer
tlp:white


Malware ClickFix infostealer DPRK NCSA blockchain etherhiding macOS tlp:clear


misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

APVA phishing/scam indicators 2026-06-18 19:27 (48 indicators)


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


The Jalisco Toolkit and AI-Powered Phishing Surge


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Daily Incremental ThreatFox Import - 2026-07-04


Unknown RAT payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

WARNING - Potential False positive:
Top 1,000,000 most-used sites from Tranco

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


ClearFake payload delivery domain (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-05


Unknown Loader botnet C2 domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)