misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Daily Incremental ThreatFox Import - 2026-07-05


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk" tlp:white tlp:clear

stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:clear tlp:white


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


Telnet bruteforce Attackers [2026-07-03]

misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Daily Incremental ThreatFox Import - 2026-07-03


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222


ValleyRAT
Malware
China
Dll Side Loading
Manufacturing
NCSA
byovd
japan
tlp:clear


Cobalt Strike botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


VShell botnet C2 server (confidence level: 100%)


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

Staging Server (Open Dir ports 80/8080/8443), VShell C2 (port 21083), Hermes WebUI (port 8878)

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


ValleyRAT botnet C2 server (confidence level: 75%)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


tg.pe takedown: phishing · bestsaleoffers.shop

Hosting during active window 2026-06-15 to 2026-06-26 (AWS us-east-1); shared cloud IP, do not block


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


JADEPUFFER Agentic Ransomware Targets Production Database Servers by Exploiting Langflow and Nacos Vulnerabilities


APT41 Resurfaces as Earth Baku With New Cyberespionage Campaign


Unknown malware botnet C2 server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Remcos botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-02


tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Cobalt Strike botnet C2 server (confidence level: 75%)


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS

WARNING - Potential False positive:
- Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Specialized list of IPv4 addresses belonging to common VPN providers and datacenters, removed IDS flag

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


APVA phishing/scam indicators 2026-06-18 19:27 (48 indicators)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

Cato Networks IoC (CTG Server Limited, HK) [VT: 16/91 malicious as of 2026-07-16]
[45.64.52.242] MEGA II IDC / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               MEGA II IDC
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"


Suspected TencShell Infrastructure (CTG Server Limited, HK) [VT: 1/91 malicious as of 2026-07-16]
[45.64.52.245] MEGA II IDC / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               MEGA II IDC
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Suspected TencShell Infrastructure (CTG Server Limited, HK) [VT: 1/91 malicious as of 2026-07-16]
[45.64.52.246] MEGA II IDC / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               MEGA II IDC
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Threat Actors Target Huawei Cloud Using Upgraded Linux Malware

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Scheduled Task - T1053"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Cloud Infrastructure Discovery - T1580"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Compromise Client Software Binary - T1554"

misp-galaxy:mitre-attack-pattern="Compromise Infrastructure - T1584"

misp-galaxy:mitre-attack-pattern="Compromise Software Dependencies and Development Tools - T1195.001"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Gather Victim Host Information - T1592"

misp-galaxy:mitre-attack-pattern="Gather Victim Network Information - T1590"

misp-galaxy:mitre-attack-pattern="Implant Internal Image - T1525"

misp-galaxy:mitre-attack-pattern="Inter-Process Communication - T1559"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Data Manipulation - T1565"

misp-galaxy:mitre-attack-pattern="Data from Configuration Repository - T1602"

misp-galaxy:mitre-attack-pattern="Endpoint Denial of Service - T1499"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Implant Internal Image - T1525"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Data Manipulation - T1565"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"

misp-galaxy:mitre-attack-pattern="Data Manipulation - T1565"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Establish Accounts - T1585"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Implant Internal Image - T1525"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Shared Modules - T1129"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

Threat Actors Target Huawei Cloud Using Upgraded Linux Malware


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Daily Incremental ThreatFox Import - 2026-07-04


AsyncRAT botnet C2 server (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Remcos botnet C2 server (confidence level: 75%)


From Callback Phishing to Extortion: Luna Moth Abuse Reamaze Helpdesk and RMM Tools Against U.S. Legal and Financial Sectors

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Alternative Protocol - T1048"

misp-galaxy:mitre-attack-pattern="Spearphishing Voice - T1566.004"

misp-galaxy:mitre-attack-pattern="Spearphishing via Service - T1566.003"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"

misp-galaxy:mitre-attack-pattern="Exfiltration to Cloud Storage - T1567.002"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"


misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


DCRat botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-03


Cobalt Strike botnet C2 server (confidence level: 100%)


VShell botnet C2 server (confidence level: 100%)


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Daily Incremental ThreatFox Import - 2026-07-05


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"

THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation


Tomiris backdoor and its connection to Sunshuttle and Kazuar


Internals of Lazarus Operation Dream Job

misp-galaxy:mitre-enterprise-attack-intrusion-set="Lazarus Group - G0032"

misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Execution through Module Load - T1129"


misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Automated Collection - T1119"

misp-galaxy:mitre-attack-pattern="Automated Exfiltration - T1020"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Data Encoding - T1132"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Encoding - T1132.002"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Chinese Alloy Taurus Updates PingPull Malware

tlp:white ncsc-nl-ndn:distribute="Z-CERT" ncsc-nl-ndn:feed="generic" retention:3m misp-galaxy:threat-actor="GALLIUM"

misp-galaxy:threat-actor="GALLIUM" ncsc-nl-ndn:distribute="Z-CERT" ncsc-nl-ndn:feed="generic" retention:3m tlp:white


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


AA23-353A #StopRansomware: ALPHV Blackcat

misp-galaxy:mitre-attack-pattern="Steal or Forge Kerberos Tickets - T1558"

misp-galaxy:mitre-attack-pattern="Credentials from Password Stores - T1555"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Compromise Accounts - T1586"


stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk" tlp:white tlp:clear

stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:clear tlp:white


Brute Ratel C4 botnet C2 server (confidence level: 100%)


Attacks in the Wild on the Container Supply Chain and Infrastructure

misp-galaxy:threat-actor="TeamTNT" misp-galaxy:sector="Mining" aqua tlp:white TeamTNT WatchDog mining

TeamTNT WatchDog aqua mining misp-galaxy:sector="Mining" misp-galaxy:threat-actor="TeamTNT" tlp:white


misp-galaxy:threat-actor="TeamTNT" misp-galaxy:sector="Mining" Profero tlp:white TeamTNT WatchDog mining

Profero TeamTNT WatchDog mining misp-galaxy:sector="Mining" misp-galaxy:threat-actor="TeamTNT" tlp:white


Suspected PRC Cyber ActorsContinue to Globally Exploit Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868)

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622"


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"


DeathStalker APT Targeting Legal and Financial Organizations

Warning: Potential false positives
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Encoding - T1132.002"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Telnet bruteforce Attackers [2026-07-03]

misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="/etc/passwd and /etc/shadow - T1003.008"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Compromise Infrastructure - T1584"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Daily Incremental ThreatFox Import - 2026-07-04


AsyncRAT botnet C2 server (confidence level: 75%)


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


JADEPUFFER Agentic Ransomware Targets Production Database Servers by Exploiting Langflow and Nacos Vulnerabilities


Stealc botnet C2 server (confidence level: 75%)


Cobalt Strike botnet C2 server (confidence level: 75%)


WARNING:
This IP belongs to a specialized list of IPv4 addresses belonging to common VPN providers and datacenters.


Daily Incremental ThreatFox Import - 2026-07-03


Kimwolf botnet C2 server (confidence level: 100%)


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Daily Incremental ThreatFox Import - 2026-07-05


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Romania Land Registry (ANCPI e-Terra) Cyberattack by ByteToBreach

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Data Destruction - T1485"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, port UDP 10001


Inside the Dragon: DragonForce Ransomware Group

WARNING - Potential False positive:
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Accounts - T1078.002"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222


misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"