Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Daily Incremental ThreatFox Import - 2026-07-05


BumbleBee Webshell Activity on Exchange Server

Warning: Potential false positives
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Stealc botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-03


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


Fix the Click: Preventing the ClickFix Attack Vector

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="AutoHotKey & AutoIT - T1059.010"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Malicious Copy and Paste - T1204.004"

misp-galaxy:mitre-attack-pattern="Masquerade Task or Service - T1036.004"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Dynamic API Resolution - T1027.007"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Mutual Exclusion - T1480.002"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-malware="Lumma Stealer - S1213"


misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="AutoHotKey & AutoIT - T1059.010"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Malicious Copy and Paste - T1204.004"

misp-galaxy:mitre-attack-pattern="Masquerade Task or Service - T1036.004"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Dynamic API Resolution - T1027.007"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Mutual Exclusion - T1480.002"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-malware="Lumma Stealer - S1213"


From Callback Phishing to Extortion: Luna Moth Abuse Reamaze Helpdesk and RMM Tools Against U.S. Legal and Financial Sectors

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048"

misp-galaxy:mitre-attack-pattern="Spearphishing Voice - T1566.004"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


Daily Incremental ThreatFox Import - 2026-07-04


Cobalt Strike Loaders Linked to Evil Corp Shared on Twitter


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability


WARNING - Potential False positive:
- Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Email Collection - T1114"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


AdaptixC2 botnet C2 server (confidence level: 75%)


LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

Malware Masquerading NCSA RAT nvidia windows tlp:clear

Malware Masquerading NCSA RAT nvidia tlp:clear windows


LabubaRAT A Rust Based Remote Access Tool Masquerading as NVIDIA Software

NCSA NCSA_Research RAT tlp:clear Create-By"Methanon"

Create-By"Methanon" NCSA NCSA_Research RAT tlp:clear


LabubaRAT: Masquerading as NVIDIA Software


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Daily Incremental ThreatFox Import - 2026-07-05


DCRat botnet C2 server (confidence level: 100%)


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


BumbleBee Webshell Activity on Exchange Server

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

Warning: Potential false positives
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"

THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation


CraxsRAT botnet C2 server (confidence level: 100%)

Banker dropper RAT Android tlp:white type:OSINT

Android Banker RAT dropper tlp:white type:OSINT


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Evilginx botnet C2 server (confidence level: 75%)


VShell botnet C2 server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


WARNING:
This IP belongs to a specialized list of IPv4 addresses belonging to common VPN providers and datacenters.

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


Defending SaaS-based applications against ShinyHunters OAuth abuse

misp-galaxy:mitre-attack-pattern="Cloud Application Integration - T1671"

misp-galaxy:mitre-attack-pattern="Customer Relationship Management Software - T1213.004"

misp-galaxy:mitre-attack-pattern="Spearphishing Voice - T1566.004"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"


misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"


Mirai botnet C2 server (confidence level: 100%)


Telnet bruteforce Attackers [2026-07-03]

misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Unknown malware botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-03


That Holiday Feelin’: TA575 Brings the Warm and Fuzzies with Year-end, Festive Lures

misp-galaxy:mitre-attack-pattern="Office Template Macros - T1137.001"


XMRIG payload delivery server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="User Execution - T1204"


Inside the Dragon: DragonForce Ransomware Group

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Accounts - T1078.002"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


Ivanti Connect Secure VPN Post-Exploitation

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"