misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


RatonRAT payload (confidence level: 95%)


Daily Incremental ThreatFox Import - 2026-07-04


GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"


Mirai elf mips ua-wget tlp:white type:OSINT

Mirai elf mips tlp:white type:OSINT ua-wget


Combined IOCs Netwalk/Netwalker Ransomware

Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai opendir sh ua-wget tlp:white type:OSINT

Mirai opendir sh tlp:white type:OSINT ua-wget


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"


Formbook payload (confidence level: 95%)


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Compromise Software Supply Chain - T1195.002"

misp-galaxy:mitre-attack-pattern="Container API - T1552.007"

misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1555.003"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Password Managers - T1555.005"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Sudo and Sudo Caching - T1548.003"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Systemd Service - T1543.002"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


Daily Incremental ThreatFox Import - 2026-07-05


CraxsRAT payload (confidence level: 100%)

dropper Android apk tlp:white type:OSINT

Android apk dropper tlp:white type:OSINT


Malicious GitHub Campaign Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer

NCSA NCSA_Research malicious tlp:clear Malware infostealer

Malware infostealer NCSA NCSA_Research malicious tlp:clear


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"


TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains


Prometei payload (confidence level: 95%)