Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


VShell botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Unknown malware botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-02


Daily Incremental ThreatFox Import - 2026-07-03


AsyncRAT botnet C2 server (confidence level: 75%)


Remcos botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-05


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Internals of Lazarus Operation Dream Job

misp-galaxy:mitre-enterprise-attack-intrusion-set="Lazarus Group - G0032"

misp-galaxy:mitre-intrusion-set="Lazarus Group - G0032"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Execution through Module Load - T1129"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Mirai botnet C2 server (confidence level: 100%)


Aisuru botnet C2 server (confidence level: 100%)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Cobalt Strike botnet C2 server (confidence level: 100%)


Ivanti Connect Secure VPN Post-Exploitation

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

SSH Client IP connecting to staging server (43.246.208.207)

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Daily Incremental ThreatFox Import - 2026-05-02


Daily Incremental ThreatFox Import - 2026-04-28


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Hacks for sale: inside the Buer Loader malware-as-a-service

misp-galaxy:mitre-enterprise-attack-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-enterprise-attack-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-enterprise-attack-attack-pattern="Execution through Module Load - T1129"


PureRAT botnet C2 server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk" tlp:white tlp:clear


Cobalt Strike botnet C2 server (confidence level: 75%)


Unknown malware botnet C2 server (confidence level: 100%)


tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS

WARNING - Potential False positive:
- Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


XMRIG payload delivery server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


VShell botnet C2 server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

Malware Delivery/Open Directory (MEGA-II IDC, HK) [VT: 7/91 malicious as of 2026-07-16]
[112.213.124.132] MEGA II IDC / CTG Server Limited (ASN: N/A) - New Territories, Hong Kong
ISP:               MEGA II IDC
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.38488
LONGITUDE:   114.20259
City:              New Territories
Country:         Hong Kong
ASN:               N/A

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Malware Delivery/Open Directory (MEGA-II IDC, HK) [VT: 1/91 malicious as of 2026-07-16]
[112.213.124.159] MEGA II IDC / CTG Server Limited (ASN: N/A) - New Territories, Hong Kong
ISP:               MEGA II IDC
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.38488
LONGITUDE:   114.20259
City:              New Territories
Country:         Hong Kong
ASN:               N/A


Malware Delivery/Open Directory (MEGA-II IDC, HK) [VT: 2/91 malicious as of 2026-07-16]
[112.213.124.163] MEGA II IDC / CTG Server Limited (ASN: N/A) - New Territories, Hong Kong
ISP:               MEGA II IDC
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.38488
LONGITUDE:   114.20259
City:              New Territories
Country:         Hong Kong
ASN:               N/A


HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks, SSH on port 2222

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability


Remcos botnet C2 server (confidence level: 75%)


Cobalt Strike botnet C2 server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Install Root Certificate - T1130"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="/etc/passwd and /etc/shadow - T1003.008"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Compromise Infrastructure - T1584"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Account Access Removal - T1531"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Archive via Utility - T1560.001"

misp-galaxy:mitre-attack-pattern="Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Patch System Image - T1601.001"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Shutdown/Reboot - T1529"

misp-galaxy:mitre-attack-pattern="Unix Shell - T1059.004"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Evil Corp - A Threat Actor with Multiple Alter Egos

misp-galaxy:mitre-attack-pattern="Conduct social engineering - T1249"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"

misp-galaxy:mitre-attack-pattern="DNS poisoning - T1382"

misp-galaxy:mitre-attack-pattern="Unauthorized user introduces compromise delivery mechanism - T1387"


Daily Incremental ThreatFox Import - 2026-07-04


Aisuru botnet C2 server (confidence level: 100%)


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Hupigon botnet C2 server (confidence level: 50%)


VShell botnet C2 server (confidence level: 100%)


AsyncRAT botnet C2 server (confidence level: 75%)


Unknown Stealer botnet C2 server (confidence level: 100%)


Brute Ratel C4 botnet C2 server (confidence level: 100%)


Cobalt Strike botnet C2 server (confidence level: 75%)


Gshell Certificate Match (CTG Server Limited, HK) [VT: 1/91 malicious as of 2026-07-16]
[134.122.200.114] CTG Server Ltd. / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               CTG Server Ltd.
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"


Gshell Certificate Match (CTG Server Limited, HK) [VT: 4/91 malicious as of 2026-07-16]
[134.122.200.115] CTG Server Ltd. / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               CTG Server Ltd.
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Gshell Certificate Match (CTG Server Limited, HK) [VT: 1/91 malicious as of 2026-07-16]
[134.122.200.116] CTG Server Ltd. / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               CTG Server Ltd.
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Suspected TencShell Infrastructure (CTG Server Limited, HK) [VT: 5/91 malicious as of 2026-07-16]
[134.122.200.153] CTG Server Ltd. / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               CTG Server Ltd.
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Suspected TencShell Infrastructure (CTG Server Limited, HK) [VT: 7/91 malicious as of 2026-07-16]
[134.122.200.154] CTG Server Ltd. / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               CTG Server Ltd.
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Suspected TencShell Infrastructure (CTG Server Limited, HK) [VT: 6/91 malicious as of 2026-07-16]
[134.122.200.155] CTG Server Ltd. / CTG Server Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               CTG Server Ltd.
ORGANIZATION:      CTG Server Limited
LATITUDE:      22.27830
LONGITUDE:   114.16039
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


Kimwolf botnet C2 server (confidence level: 100%)


misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS


Indicators of Compromise Associated with OnePercent  Group Ransomware

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Cybercrime Groups Targeting Fuel Dispenser Merchants

inthreat:event-src="feed-osint" Cybercrime misp-galaxy:threat-actor="FIN8" tlp:white ncsc-nl-ndn:feed="generic" retention:1m

Cybercrime inthreat:event-src="feed-osint" misp-galaxy:threat-actor="FIN8" ncsc-nl-ndn:feed="generic" retention:1m tlp:white


Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks

WARNING - Potential False positive:
List of known Amazon AWS IP address ranges
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

feedly:source="Trend Micro Research, News and Perspectives"

misp-galaxy:mitre-attack-pattern="Fast Flux DNS - T1568.001"

misp-galaxy:mitre-attack-pattern="GUI Input Capture - T1056.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"


AsyncRAT botnet C2 server (confidence level: 100%)


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


Aisuru botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-03


misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Remcos botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-05


Defending SaaS-based applications against ShinyHunters OAuth abuse

misp-galaxy:mitre-attack-pattern="Cloud Application Integration - T1671"

misp-galaxy:mitre-attack-pattern="Customer Relationship Management Software - T1213.004"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"

misp-galaxy:mitre-attack-pattern="Spearphishing Voice - T1566.004"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Cobalt Strike botnet C2 server (confidence level: 100%)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


VShell botnet C2 server (confidence level: 100%)


Beware of Phishing Emails Disguised as Money Transfer Confirmations


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Daily Incremental ThreatFox Import - 2026-07-02


DCRat botnet C2 server (confidence level: 75%)


Stealc botnet C2 server (confidence level: 75%)


That Holiday Feelin’: TA575 Brings the Warm and Fuzzies with Year-end, Festive Lures

misp-galaxy:mitre-attack-pattern="Office Template Macros - T1137.001"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


THREAT ALERT: Ivanti Connect Secure VPN Zero-Day Exploitation

WARNING:
Potential false positive.
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"


Kimwolf botnet C2 server (confidence level: 100%)


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Rhadamanthys Malware Disguised as Groupware Installer (Detected by MDS)

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005"


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Office Template Macros - T1137.001"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

NCSA NCSA_Research Cybercrime tlp:clear proxy Create-By"Methanon"

Create-By"Methanon" Cybercrime NCSA NCSA_Research proxy tlp:clear


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Daily Incremental ThreatFox Import - 2026-07-04


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Unknown Loader botnet C2 server (confidence level: 75%)


Unknown malware botnet C2 server (confidence level: 100%)


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Remcos botnet C2 server (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls


XMRIG payload delivery server (confidence level: 100%)


HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


AsyncRAT botnet C2 server (confidence level: 100%)


Cybercrime Groups Targeting Fuel Dispenser Merchants

inthreat:event-src="feed-osint" Cybercrime misp-galaxy:threat-actor="FIN8" tlp:white ncsc-nl-ndn:feed="generic" retention:1m

Cybercrime inthreat:event-src="feed-osint" misp-galaxy:threat-actor="FIN8" ncsc-nl-ndn:feed="generic" retention:1m tlp:white


Indicators of Compromise Associated with OnePercent  Group Ransomware

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Specialized list of IPv4 addresses belonging to common VPN providers and datacenters, removed IDS flag


Daily Incremental ThreatFox Import - 2026-07-05


Aisuru botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-03


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


Stealc botnet C2 server (confidence level: 75%)


NjRAT botnet C2 server (confidence level: 99%)


misp-galaxy:mitre-enterprise-attack-attack-pattern="Exploitation of Remote Services - T1210"

misp-galaxy:mitre-attack-pattern="Remote Service Session Hijacking - T1563"

misp-galaxy:mitre-attack-pattern="User Evasion - T1618"

WARNING:
Potential false positive.
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


UNC215: Spotlight on a Chinese Espionage Campaign in Israel

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

UNC215: Spotlight on a Chinese Espionage Campaign in Israel


159.65.80.157: Enriched via the shodan module

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

159.65.80.157: Enriched via the shodan module


Cobalt Strike botnet C2 server (confidence level: 100%)


VShell botnet C2 server (confidence level: 100%)


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Kimwolf botnet C2 server (confidence level: 100%)


inthreat:event-src="feed-osint" Cybercrime misp-galaxy:threat-actor="FIN8" tlp:white ncsc-nl-ndn:feed="generic" retention:1m

Cybercrime inthreat:event-src="feed-osint" misp-galaxy:threat-actor="FIN8" ncsc-nl-ndn:feed="generic" retention:1m tlp:white


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

Microsoft
NCSA
Phishing
attack-pattern:QR Code Phishing
session-hijacking
tlp:clear


DCRat botnet C2 server (confidence level: 100%)