Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Kimwolf botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-03


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Aisuru botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Indicators of Compromise Associated with OnePercent  Group Ransomware

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Specialized list of IPv4 addresses belonging to common VPN providers and datacenters, removed IDS flag

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Mirai botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-05


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, port UDP 10001 Ubiquiti Networks Device_Hostname: _Product: N5N_Version: XM.ar7240.v5.6.6.29183.160526.1225 @2022-06-16


LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

Malware Masquerading NCSA RAT nvidia windows tlp:clear

Malware Masquerading NCSA RAT nvidia tlp:clear windows


LabubaRAT A Rust Based Remote Access Tool Masquerading as NVIDIA Software

NCSA NCSA_Research RAT tlp:clear Create-By"Methanon"

Create-By"Methanon" NCSA NCSA_Research RAT tlp:clear


LabubaRAT: Masquerading as NVIDIA Software


Stealc botnet C2 server (confidence level: 75%)


Masters of Mimicry: new APT group ChamelGang and its arsenal

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1574.001"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Digital Certificates - T1588.004"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1564.001"

misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Internet Connection Discovery - T1016.001"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Local Groups - T1069.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Rename System Utilities - T1036.003"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Local Groups - T1069.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Local Groups - T1069.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

Masters of Mimicry: new APT group ChamelGang and its arsenal


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

WARNING:
This IP belongs to a specialized list of IPv4 addresses belonging to common VPN providers and datacenters.

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk" tlp:white tlp:clear

stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:clear tlp:white


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"


DoppelPaymer 'Akamai" cluster infrastructure


Cobalt Strike botnet C2 server (confidence level: 100%)


Cobalt Strike botnet C2 server (confidence level: 75%)


Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="/etc/passwd and /etc/shadow - T1003.008"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Compromise Infrastructure - T1584"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Beware of Phishing Emails Disguised as Money Transfer Confirmations


Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"


Daily Incremental ThreatFox Import - 2026-04-21


Daily Incremental ThreatFox Import - 2026-05-02


Daily Incremental ThreatFox Import - 2026-04-28


Daily Incremental ThreatFox Import - 2026-04-30


Daily Incremental ThreatFox Import - 2026-07-03


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


WARNING - Potential False positive:
- Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Daily Incremental ThreatFox Import - 2026-07-02


AsyncRAT botnet C2 server (confidence level: 75%)


VShell botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


AdaptixC2 botnet C2 server (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Stealc botnet C2 server (confidence level: 100%)


Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Email Collection - T1114"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"


DanaBot botnet C2 server (confidence level: 75%)


Aisuru botnet C2 server (confidence level: 100%)


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Stealc botnet C2 server (confidence level: 75%)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Romania Land Registry (ANCPI e-Terra) Cyberattack by ByteToBreach

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Data Destruction - T1485"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


UNC215: Spotlight on a Chinese Espionage Campaign in Israel

178.79.177.69: Enriched via the shodan module

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

178.79.177.69: Enriched via the shodan module


misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"


misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

UNC215: Spotlight on a Chinese Espionage Campaign in Israel


Unknown malware botnet C2 server (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Masquerade Account Name - T1036.010"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-enterprise-attack-attack-pattern="User Execution - T1204"


MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability


Daily Incremental ThreatFox Import - 2026-07-05


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Remcos botnet C2 server (confidence level: 75%)


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


New Stealthy Ransomware Deployed Against Asian IT Company


Cybercrime Groups Targeting Fuel Dispenser Merchants

inthreat:event-src="feed-osint" Cybercrime misp-galaxy:threat-actor="FIN8" tlp:white ncsc-nl-ndn:feed="generic" retention:1m

Cybercrime inthreat:event-src="feed-osint" misp-galaxy:threat-actor="FIN8" ncsc-nl-ndn:feed="generic" retention:1m tlp:white


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Daily Incremental ThreatFox Import - 2026-07-03


NjRAT botnet C2 server (confidence level: 99%)


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"


BumbleBee Webshell Activity on Exchange Server

Warning: Potential false positives
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


From Callback Phishing to Extortion: Luna Moth Abuse Reamaze Helpdesk and RMM Tools Against U.S. Legal and Financial Sectors

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048"

misp-galaxy:mitre-attack-pattern="Spearphishing Voice - T1566.004"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Campagne d’attaque du mode opératoire APT31 ciblant la France

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"


Beware of Phishing Emails Disguised as Money Transfer Confirmations


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Encoding - T1132.002"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"


misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024


misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Yanluowang: Further Insights on New Ransomware Threat

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Credentials from Web Browsers - T1503"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"


Inside the Dragon: DragonForce Ransomware Group

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Accounts - T1078.002"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"


Daily Incremental ThreatFox Import - 2026-07-04


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


AsyncRAT botnet C2 server (confidence level: 75%)


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Kimwolf botnet C2 server (confidence level: 100%)


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


FAKEUPDATES payload delivery server (confidence level: 100%)


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


misp-galaxy:sector="Energy"
misp-galaxy:sector="Oil"
misp-galaxy:sector="Construction"
misp-galaxy:country="egypt"
misp-galaxy:country="israel"
misp-galaxy:country="jordan"
misp-galaxy:country="saudi arabia"
VxUnderground
tlp:white
Energy
Oil
Construction
egypt
israel
jordan
saudi arabia
tlp:clear

Construction
Energy
Oil
VxUnderground
egypt
israel
jordan
misp-galaxy:country="egypt"
misp-galaxy:country="israel"
misp-galaxy:country="jordan"
misp-galaxy:country="saudi arabia"
misp-galaxy:sector="Construction"
misp-galaxy:sector="Energy"
misp-galaxy:sector="Oil"
saudi arabia
tlp:clear
tlp:white


WinRAR as a "cyber weapon". Destructive cyber attack UAC-0165 (probably Sandworm) on the state sector of Ukraine using RoarBat (CERT-UA#6550)

WARNING:
POTENTIAL FALSE POSITIVE.
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters.

misp-galaxy:mitre-enterprise-attack-intrusion-set="Sandworm Team - G0034"

misp-galaxy:mitre-intrusion-set="Sandworm Team - G0034"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"


misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


LabubaRAT A Rust Based Remote Access Tool Masquerading as NVIDIA Software

NCSA NCSA_Research RAT tlp:clear Create-By"Methanon"

Create-By"Methanon" NCSA NCSA_Research RAT tlp:clear


LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

Malware Masquerading NCSA RAT nvidia windows tlp:clear

Malware Masquerading NCSA RAT nvidia tlp:clear windows


LabubaRAT: Masquerading as NVIDIA Software


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Daily Incremental ThreatFox Import - 2026-07-05


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Stealc botnet C2 server (confidence level: 75%)


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

Gshell Certificate Match (Antbox Networks Limited, HK) [VT: 0/91 malicious as of 2026-07-16]
[192.163.167.10] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"


Gshell Certificate Match (Antbox Networks Limited, HK) [VT: 0/91 malicious as of 2026-07-16]
[192.163.167.5] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Gshell Certificate Match (Antbox Networks Limited, HK) [VT: 0/91 malicious as of 2026-07-16]
[192.163.167.6] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Gshell Certificate Match (Antbox Networks Limited, HK) [VT: 0/91 malicious as of 2026-07-16]
[192.163.167.7] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A