ESET: UEFI threats moving to the ESP: Introducing ESPecter bootkit

C&C IP addresses and domains from configurations

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Multi-Stage Channels - T1104"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Peripheral Device Discovery - T1120"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Scheduled Transfer - T1029"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564"

misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562"

misp-galaxy:mitre-attack-pattern="Modify System Image - T1601"

misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542"

misp-galaxy:mitre-attack-pattern="Subvert Trust Controls - T1553"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564"

misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562"

misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564"

misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Pre-OS Boot - T1542"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

C&C IP addresses and domains from configurations


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Daily Incremental ThreatFox Import - 2026-07-05


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Daily Incremental ThreatFox Import - 2026-07-04


Unknown Loader payload delivery domain (confidence level: 100%)


Malicious GitHub Campaign Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer

NCSA NCSA_Research malicious tlp:clear Malware infostealer

Malware infostealer NCSA NCSA_Research malicious tlp:clear


Daily Incremental ThreatFox Import - 2026-07-03


ClearFake payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Input Capture - T1056"


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


Unknown Loader botnet C2 domain (confidence level: 100%)


EGoManiac | An Unscrupulous Turkish-Nexus Threat Actor


KongTuke payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Search Victim-Owned Websites - T1594"

misp-galaxy:mitre-attack-pattern="Social Media Accounts - T1585.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1598.003"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Services - T1583.006"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


Fake pirated software sites serve up malware droppers as a service

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Vidar botnet C2 domain (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


Indirect Prompt Injection (IPI) Campaigns

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Link Target - T1608.005"

misp-galaxy:mitre-attack-pattern="Malicious Image - T1204.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Multi-Factor Authentication Interception - T1111"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Upload Malware - T1608.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Service - T1102"

misp-galaxy:mitre-course-of-action="Deobfuscate/Decode Files or Information Mitigation - T1140"


As Delta Variant Spreads, COVID-19 Themes Make Resurgence In Email Threats

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Unknown malware payload delivery domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Unknown malware botnet C2 domain (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Browser Extensions - T1176"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


StrelaStealer payload delivery domain (confidence level: 100%)


Bahamut botnet C2 domain (confidence level: 50%)


Remcos botnet C2 domain (confidence level: 75%)


APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"


Daily Incremental ThreatFox Import - 2026-07-02


CinaRAT Resurfaces With New Evasive Tactics and Techniques

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"


tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"