Mirai elf geofenced USA superh ua-wget tlp:white type:OSINT

Mirai USA elf geofenced superh tlp:white type:OSINT ua-wget


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


Daily Incremental ThreatFox Import - 2026-07-04


LALALA Stealer payload (confidence level: 95%)


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


MaskGramStealer payload (confidence level: 95%)


Combined IOCs Netwalk/Netwalker Ransomware

Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


Daily Incremental ThreatFox Import - 2026-07-05


Mirai gafgyt opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir tlp:white type:OSINT ua-wget x86


APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"


PhantomStealer in .rar email attachment (SMTP exfil)


Venus Stealer payload (confidence level: 95%)


html censys ClickFix tlp:white type:OSINT

ClickFix censys html tlp:white type:OSINT


Malware Analysis Report (AR20-216A) Chinese Remote Access Trojan: TAIDOOR

misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


Mirai opendir elf m68k ua-wget tlp:white type:OSINT

Mirai elf m68k opendir tlp:white type:OSINT ua-wget


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"


Malware Analysis Report (AR21-102A) MAR-10331466-1.v1: China Chopper Webshell

misp-galaxy:mitre-malware="China Chopper - S0020"


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


New Stealthy Ransomware Deployed Against Asian IT Company


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Mirai gafgyt elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt tlp:white type:OSINT ua-wget


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


WannaCryptor payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


Emotet doc heodo epoch3 tlp:white type:OSINT

Emotet doc epoch3 heodo tlp:white type:OSINT


SalatStealer payload (confidence level: 95%)


Threat Actor Uses Malicious PyPI Dependencies to Deliver ChocoPoC RAT Through GitHub PoCs


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


Ghost RAT payload (confidence level: 95%)


html censys ClickFix tlp:white type:OSINT

ClickFix censys html tlp:white type:OSINT


HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Disk Wipe - T1561"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"


Krasue RAT payload (confidence level: 95%)


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"

tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


Unknown malware payload (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-03


Daily Incremental ThreatFox Import - 2026-07-04


Combined IOCs Netwalk/Netwalker Ransomware

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai gafgyt opendir elf mips ua-wget tlp:white type:OSINT

Mirai elf gafgyt mips opendir tlp:white type:OSINT ua-wget


Mirai gafgyt elf arm geofenced USA ua-wget tlp:white type:OSINT

Mirai USA arm elf gafgyt geofenced tlp:white type:OSINT ua-wget


TinyTurla Next Generation - Turla APT spies on Polish NGOs

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1027.005"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"


ValleyRAT payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course


Mirai gafgyt elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt tlp:white type:OSINT ua-wget


Mirai elf geofenced USA PowerPC ua-wget tlp:white type:OSINT

Mirai PowerPC USA elf geofenced tlp:white type:OSINT ua-wget


Daily Incremental ThreatFox Import - 2026-07-05


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


Mirai opendir elf mips ua-wget tlp:white type:OSINT

Mirai elf mips opendir tlp:white type:OSINT ua-wget


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


Custom CobaltStrike loader samples  SHA256 hashes

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Agent Tesla payload (confidence level: 95%)


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


Emotet doc heodo epoch3 tlp:white type:OSINT

Emotet doc epoch3 heodo tlp:white type:OSINT


Mirai gafgyt opendir elf arm ua-wget tlp:white type:OSINT

Mirai arm elf gafgyt opendir tlp:white type:OSINT ua-wget


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Malware Analysis Report (AR20-216A) Chinese Remote Access Trojan: TAIDOOR

misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"


misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


ACR Stealer payload (confidence level: 95%)


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Venus Stealer payload (confidence level: 95%)


AsyncRAT opendir vbs ua-wget tlp:white type:OSINT

AsyncRAT opendir tlp:white type:OSINT ua-wget vbs


TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead

C2
infostealer
NCSA
Social Engineering
Tiktok
tlp:clear


Mirai opendir elf arm ua-wget tlp:white type:OSINT

Mirai arm elf opendir tlp:white type:OSINT ua-wget


Coinminer payload (confidence level: 95%)


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


njRat Vidar AveMariaRAT dropped-by-amadey d52f85 tlp:white type:OSINT

AveMariaRAT Vidar d52f85 dropped-by-amadey njRat tlp:white type:OSINT


Threat Actor Uses Malicious PyPI Dependencies to Deliver ChocoPoC RAT Through GitHub PoCs


misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials

Hash of wayzgoose[%n].dll – where %n is a random number

misp-galaxy:groups="STRONTIUM - Associated Group"


Yanluowang: Further Insights on New Ransomware Threat

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"


misp-galaxy:mitre-attack-pattern="Process Injection - T1055"


TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains


From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

C2 NCSA WebDav dropper lnk spoofing tlp:clear


The Covert Operator's Playbook: Infiltration of Global Telecom Networks

misp-galaxy:region="034 - Southern Asia"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Invalid Code Signature - T1036.001"

misp-galaxy:mitre-attack-pattern="Pluggable Authentication Modules - T1556.003"

misp-galaxy:mitre-attack-pattern="Rename System Utilities - T1036.003"


MAR-10333243.r3.v1: Pulse Secure --> Malware Analysis Report (AR21-236B)


Quasar RAT payload (confidence level: 95%)


Daily Incremental ThreatFox Import - 2026-07-04


Combined IOCs Netwalk/Netwalker Ransomware

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


WannaCryptor payload (confidence level: 95%)


Mirai gafgyt opendir elf sparc ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir sparc tlp:white type:OSINT ua-wget


misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"


misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"

Malware Analysis Report (AR20-216A) Chinese Remote Access Trojan: TAIDOOR


misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course


Daily Incremental ThreatFox Import - 2026-07-05


Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities

Malware Masquerading NCSA Phishing lure tlp:clear


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


New Stealthy Ransomware Deployed Against Asian IT Company


Travel Themed Phishing URLs Set to Prey on Eager Travelers

misp-galaxy:mitre-attack-pattern="Brute Force - T1110"

misp-galaxy:mitre-attack-pattern="Create Account - T1136"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"


Mirai opendir elf arm ua-wget tlp:white type:OSINT

Mirai arm elf opendir tlp:white type:OSINT ua-wget


Luca Stealer payload (confidence level: 95%)


MAR-10339606.r1.v1: Pulse Secure -> Malware Analysis Report (AR21-236E)


Formbook payload (confidence level: 95%)


C2 NCSA WebDav dropper lnk spoofing tlp:clear

From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab


gafgyt elf Ngioweb ua-wget tlp:white type:OSINT

Ngioweb elf gafgyt tlp:white type:OSINT ua-wget


Fix the Click: Preventing the ClickFix Attack Vector

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="AutoHotKey & AutoIT - T1059.010"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Malicious Copy and Paste - T1204.004"

misp-galaxy:mitre-attack-pattern="Masquerade Task or Service - T1036.004"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Dynamic API Resolution - T1027.007"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Mutual Exclusion - T1480.002"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-malware="Lumma Stealer - S1213"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"


Remcos AsyncRAT opendir vbs ua-wget tlp:white type:OSINT

AsyncRAT Remcos opendir tlp:white type:OSINT ua-wget vbs


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


html censys ClickFix tlp:white type:OSINT

ClickFix censys html tlp:white type:OSINT


Inside the Dragon: DragonForce Ransomware Group

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Accounts - T1078.002"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Creal Stealer payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="AutoHotKey & AutoIT - T1059.010"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Malicious Copy and Paste - T1204.004"

misp-galaxy:mitre-attack-pattern="Masquerade Task or Service - T1036.004"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Dynamic API Resolution - T1027.007"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Mutual Exclusion - T1480.002"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-malware="Lumma Stealer - S1213"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


RatonRAT payload (confidence level: 95%)


TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains


Malware Masquerading NCSA Phishing lure tlp:clear


ACR Stealer payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai gafgyt opendir elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir tlp:white type:OSINT ua-wget


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Mirai gafgyt opendir elf superh ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir superh tlp:white type:OSINT ua-wget


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


CraxsRAT payload (confidence level: 100%)

dropper Android apk tlp:white type:OSINT

Android apk dropper tlp:white type:OSINT


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Malware Masquerading NCSA Phishing lure tlp:clear

Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities


Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


Nanocore RAT payload (confidence level: 95%)


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


WannaCryptor payload (confidence level: 95%)


Coinminer payload (confidence level: 95%)


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

Ar70qICi (TencShell x86 variant) [VT: 16/63 malicious as of 2026-07-16]

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"


misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry


tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf opendir tlp:white type:OSINT ua-wget x86


MAR-10339606.r1.v1: Pulse Secure -> Malware Analysis Report (AR21-236E)


misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"

Evil Corp - A Threat Actor with Multiple Alter Egos


Daily Incremental ThreatFox Import - 2026-07-04


Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials

misp-galaxy:groups="STRONTIUM - Associated Group"


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


Combined IOCs Netwalk/Netwalker Ransomware


Mirai elf geofenced USA m68k ua-wget tlp:white type:OSINT

Mirai USA elf geofenced m68k tlp:white type:OSINT ua-wget


Mirai gafgyt elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt tlp:white type:OSINT ua-wget


Remcos AsyncRAT opendir vbs ua-wget tlp:white type:OSINT

AsyncRAT Remcos opendir tlp:white type:OSINT ua-wget vbs


Mirai gafgyt opendir elf PowerPC ua-wget tlp:white type:OSINT

Mirai PowerPC elf gafgyt opendir tlp:white type:OSINT ua-wget


Malicious GitHub Campaign Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer

NCSA NCSA_Research malicious tlp:clear Malware infostealer

Malware infostealer NCSA NCSA_Research malicious tlp:clear


Malware Analysis Report (AR20-216A) Chinese Remote Access Trojan: TAIDOOR

misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"


CrossRAT payload (confidence level: 95%)


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


Formbook payload (confidence level: 95%)


Venus Stealer payload (confidence level: 95%)


Cobalt Strike Loaders Linked to Evil Corp Shared on Twitter


Daily Incremental ThreatFox Import - 2026-07-05


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai elf x86 ua-wget tlp:white type:OSINT

Mirai elf tlp:white type:OSINT ua-wget x86


gafgyt elf Ngioweb ua-wget tlp:white type:OSINT

Ngioweb elf gafgyt tlp:white type:OSINT ua-wget


Agenda Ransomware Propagates to vCenters and ESXi via Custom PowerShell Script

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Execution Guardrails - T1480"

misp-galaxy:mitre-attack-pattern="Exploitation for Defense Evasion - T1211"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"


Exploring the (Not So) Secret Code of Black Hunt Ransomware

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1548.002"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Safe Mode Boot - T1562.009"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"


Ghost RAT payload (confidence level: 95%)


Mirai opendir elf m68k ua-wget tlp:white type:OSINT

Mirai elf m68k opendir tlp:white type:OSINT ua-wget


ValleyRAT payload (confidence level: 95%)


Malware Analysis Report (AR21-102A) MAR-10331466-1.v1: China Chopper Webshell

misp-galaxy:mitre-malware="China Chopper - S0020"


Mirai gafgyt elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt tlp:white type:OSINT ua-wget


Mirai gafgyt opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir tlp:white type:OSINT ua-wget x86


tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


html censys ClickFix tlp:white type:OSINT

ClickFix censys html tlp:white type:OSINT


misp-galaxy:groups="STRONTIUM - Associated Group"


Agent Tesla payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"


New Stealthy Ransomware Deployed Against Asian IT Company


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Emotet doc heodo epoch2 tlp:white type:OSINT

Emotet doc epoch2 heodo tlp:white type:OSINT


Mirai opendir elf mips ua-wget tlp:white type:OSINT

Mirai elf mips opendir tlp:white type:OSINT ua-wget


From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

C2 NCSA WebDav dropper lnk spoofing tlp:clear


Mirai gafgyt opendir elf arm ua-wget tlp:white type:OSINT

Mirai arm elf gafgyt opendir tlp:white type:OSINT ua-wget


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course


AsyncRAT payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai gafgyt elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt tlp:white type:OSINT ua-wget


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


MimiKatz payload (confidence level: 95%)


Mirai gafgyt opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir tlp:white type:OSINT ua-wget x86


ACR Stealer payload (confidence level: 95%)


GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


NCSA NCSA_Research malicious tlp:clear Malware infostealer

Malware infostealer NCSA NCSA_Research malicious tlp:clear

Malicious GitHub Campaign Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

HSEWH-Ur, 8eA-GlbK, r4l3DqLA (TencShell ARM) [VT: 23/59 malicious as of 2026-07-16]

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"


Daily Incremental ThreatFox Import - 2026-07-04


Threat Actor Uses Malicious PyPI Dependencies to Deliver ChocoPoC RAT Through GitHub PoCs


MalwareBazaar: RemcosRAT C2:
renajazinw.duckdns.org:53848

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


WannaCryptor payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Process Injection - T1055"


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


Emotet doc heodo epoch2 tlp:white type:OSINT

Emotet doc epoch2 heodo tlp:white type:OSINT


TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains


Mirai gafgyt elf mips geofenced USA ua-wget tlp:white type:OSINT

Mirai USA elf gafgyt geofenced mips tlp:white type:OSINT ua-wget


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


Combined IOCs Netwalk/Netwalker Ransomware

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Mirai elf arm geofenced USA ua-wget tlp:white type:OSINT

Mirai USA arm elf geofenced tlp:white type:OSINT ua-wget


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


Mirai elf geofenced USA x86 ua-wget tlp:white type:OSINT

Mirai USA elf geofenced tlp:white type:OSINT ua-wget x86


html censys ClickFix tlp:white type:OSINT

ClickFix censys html tlp:white type:OSINT


Mirai gafgyt opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir tlp:white type:OSINT ua-wget x86


Mirai opendir elf mips ua-wget tlp:white type:OSINT

Mirai elf mips opendir tlp:white type:OSINT ua-wget


gafgyt opendir elf mips ua-wget tlp:white type:OSINT

elf gafgyt mips opendir tlp:white type:OSINT ua-wget


misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Compromise Software Supply Chain - T1195.002"

misp-galaxy:mitre-attack-pattern="Container API - T1552.007"

misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1555.003"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Password Managers - T1555.005"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Sudo and Sudo Caching - T1548.003"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Systemd Service - T1543.002"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


Formbook payload (confidence level: 95%)


tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

Trojan.Killdisk MalwareBazaar: FoxBlade ( #Hermetic) #Wiper MalwareBazaar: FoxBlade ( #Hermetic) #Wiper

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Disk Wipe - T1561"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"


ValleyRAT payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


C2 NCSA WebDav dropper lnk spoofing tlp:clear

From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course


MAR-10339606.r1.v1: Pulse Secure -> Malware Analysis Report (AR21-236E)


TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead

C2
infostealer
NCSA
Social Engineering
Tiktok
tlp:clear


Daily Incremental ThreatFox Import - 2026-07-05


Nanocore RAT payload (confidence level: 95%)


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


Mirai opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf opendir tlp:white type:OSINT ua-wget x86


New Stealthy Ransomware Deployed Against Asian IT Company


Mirai gafgyt elf ua-wget tlp:white type:OSINT

Mirai elf gafgyt tlp:white type:OSINT ua-wget


misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


LabubaRAT: Masquerading as NVIDIA Software


LabubaRAT A Rust Based Remote Access Tool Masquerading as NVIDIA Software

NCSA NCSA_Research RAT tlp:clear Create-By"Methanon"

Create-By"Methanon" NCSA NCSA_Research RAT tlp:clear


LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

Malware Masquerading NCSA RAT nvidia windows tlp:clear

Malware Masquerading NCSA RAT nvidia tlp:clear windows


misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Compromise Software Supply Chain - T1195.002"

misp-galaxy:mitre-attack-pattern="Container API - T1552.007"

misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1555.003"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Password Managers - T1555.005"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Sudo and Sudo Caching - T1548.003"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Systemd Service - T1543.002"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities

Malware Masquerading NCSA Phishing lure tlp:clear


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


C2
infostealer
NCSA
Social Engineering
Tiktok
tlp:clear


DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


WannaCryptor payload (confidence level: 95%)


Daily Incremental ThreatFox Import - 2026-07-04


Mirai opendir elf arm ua-wget tlp:white type:OSINT

Mirai arm elf opendir tlp:white type:OSINT ua-wget


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


CrossRAT payload (confidence level: 95%)


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"


Venus Stealer payload (confidence level: 95%)


TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


Mirai gafgyt opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir tlp:white type:OSINT ua-wget x86


Combined IOCs Netwalk/Netwalker Ransomware

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


PhantomStealer in .rar email attachment (SMTP exfil)


Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials

Hash of GooseEgg binary DefragmentSrv.exe

misp-galaxy:groups="STRONTIUM - Associated Group"


Malware Masquerading NCSA Phishing lure tlp:clear


Enriched via the openiocimport module MalwareBazaar: Zero2Automated Course


misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Compromise Software Supply Chain - T1195.002"

misp-galaxy:mitre-attack-pattern="Container API - T1552.007"

misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1555.003"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Password Managers - T1555.005"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Sudo and Sudo Caching - T1548.003"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Systemd Service - T1543.002"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"


Nanocore RAT payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

Hades Custom Go Implant (Linux ELF binary: multipathd_04d0)

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


WannaCryptor payload (confidence level: 95%)


Mirai elf arm geofenced USA ua-wget tlp:white type:OSINT

Mirai USA arm elf geofenced tlp:white type:OSINT ua-wget


WebMonitor RAT payload (confidence level: 95%)


Mirai gafgyt opendir elf PowerPC ua-wget tlp:white type:OSINT

Mirai PowerPC elf gafgyt opendir tlp:white type:OSINT ua-wget


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


TinyTurla Next Generation - Turla APT spies on Polish NGOs

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Indicator Removal from Tools - T1027.005"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"


Mirai botnet elf ua-wget tlp:white type:OSINT

Mirai botnet elf tlp:white type:OSINT ua-wget


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


Mirai opendir elf x86 ua-wget tlp:white type:OSINT

Mirai elf opendir tlp:white type:OSINT ua-wget x86


Daily Incremental ThreatFox Import - 2026-07-05


Mirai opendir elf arc ua-wget tlp:white type:OSINT

Mirai arc elf opendir tlp:white type:OSINT ua-wget


Mirai gafgyt opendir elf sparc ua-wget tlp:white type:OSINT

Mirai elf gafgyt opendir sparc tlp:white type:OSINT ua-wget


misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"


Mirai elf mips ua-wget tlp:white type:OSINT

Mirai elf mips tlp:white type:OSINT ua-wget


QuantLoader payload (confidence level: 95%)


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"


misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


MAR-10339606.r1.v1: Pulse Secure -> Malware Analysis Report (AR21-236E)


misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities

Malware Masquerading NCSA Phishing lure tlp:clear


Mirai opendir elf PowerPC ua-wget tlp:white type:OSINT

Mirai PowerPC elf opendir tlp:white type:OSINT ua-wget


misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"

misp-galaxy:mitre-attack-pattern="Junk Data - T1001.001"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Time Based Evasion - T1497.003"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543"

misp-galaxy:mitre-attack-pattern="Disk Wipe - T1561"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"


Mirai opendir elf m68k ua-wget tlp:white type:OSINT

Mirai elf m68k opendir tlp:white type:OSINT ua-wget


Daily Incremental ThreatFox Import - 2026-07-04


CrossRAT payload (confidence level: 95%)


tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


html censys ClickFix tlp:white type:OSINT

ClickFix censys html tlp:white type:OSINT


From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

C2 NCSA WebDav dropper lnk spoofing tlp:clear


misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Email Collection - T1114"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


MaskGramStealer payload (confidence level: 95%)


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Combined IOCs Netwalk/Netwalker Ransomware

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Creal Stealer payload (confidence level: 95%)


ValleyRAT payload (confidence level: 95%)


Malware Analysis Report (AR21-102A) MAR-10331466-1.v1: China Chopper Webshell

misp-galaxy:mitre-malware="China Chopper - S0020"


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


kill-chain:Installation tlp:white stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"

kill-chain:Installation stone:incident-classification="Malware" stone:source="OSINT" stone:threat-level="medium-risk" tlp:white


Domestic Kitten – An Inside Look at the Iranian Surveillance Operations


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Malware" stone:threat-level="medium-risk"


CrossRAT payload (confidence level: 95%)


Travel Themed Phishing URLs Set to Prey on Eager Travelers

misp-galaxy:mitre-attack-pattern="Brute Force - T1110"

misp-galaxy:mitre-attack-pattern="Create Account - T1136"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


WannaCryptor payload (confidence level: 95%)