CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

Suspected TencShell Infrastructure/Gshell (Antbox Networks Limited, HK) [VT: 14/91 malicious as of 2026-07-16]
[192.229.115.229] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      22.27983
LONGITUDE:   114.17068
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Suspected TencShell Infrastructure/Gshell (Antbox Networks Limited, HK) [VT: 0/91 malicious as of 2026-07-16]
[192.229.115.230] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Hong Kong, Hong Kong
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      22.27983
LONGITUDE:   114.17068
City:              Hong Kong
Country:         Hong Kong
ASN:               N/A


type:OSINT misp:threat-level="medium-risk" type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Suspected TencShell Infrastructure (Antbox Networks Limited, HK) [VT: 2/91 malicious as of 2026-07-16]
[192.238.134.166] ANTBOX NETWORKS LIMITED / Antbox Networks Limited (ASN: N/A) - Beijing, China
ISP:               ANTBOX NETWORKS LIMITED
ORGANIZATION:      Antbox Networks Limited
LATITUDE:      39.92781
LONGITUDE:   116.40963
City:              Beijing
Country:         China
ASN:               N/A


APVA phishing/scam indicators 2026-06-13 14:39 (48 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


Unmasking the Hidden Threat: Inside a Sophisticated Excel-Based Attack Delivering Fileless Remcos RAT

WARNING - Potential False positive:
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Third-party Software - T1072"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Execution through API - T1106"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Shortcut Modification - T1547.009"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities - T1127"

misp-galaxy:mitre-attack-pattern="Trusted Developer Utilities Proxy Execution - T1127"

misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Dynamic-link Library Injection - T1055.001"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:country="united states of america"

misp-galaxy:country="united states of america"

misp-galaxy:mitre-attack-pattern="Local Account - T1087.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Native API - T1106"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Template Injection - T1221"

misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Beware of Phishing Emails Disguised as Money Transfer Confirmations


Malicious GitHub Campaign Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer

NCSA NCSA_Research malicious tlp:clear Malware infostealer

Malware infostealer NCSA NCSA_Research malicious tlp:clear


misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


APVA phishing/scam indicators 2026-06-18 00:18 (28 indicators)


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


Daily Incremental ThreatFox Import - 2026-07-05


BumbleBee Webshell Activity on Exchange Server

Warning: Potential false positives
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


Daily Incremental ThreatFox Import - 2026-07-03


WinRAR as a "cyber weapon". Destructive cyber attack UAC-0165 (probably Sandworm) on the state sector of Ukraine using RoarBat (CERT-UA#6550)

WARNING:
POTENTIAL FALSE POSITIVE.
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters.

misp-galaxy:mitre-enterprise-attack-intrusion-set="Sandworm Team - G0034"

misp-galaxy:mitre-intrusion-set="Sandworm Team - G0034"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"


The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


VShell botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms

misp-galaxy:mitre-attack-pattern="Abuse Elevation Control Mechanism - T1548"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Compromise Client Software Binary - T1554"

misp-galaxy:mitre-attack-pattern="Drive-by Compromise - T1189"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Man in the Browser - T1185"

misp-galaxy:mitre-attack-pattern="Signed Binary Proxy Execution - T1218"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"


194.58.108.89: Enriched via the shodan module


Чергова атака UAC-0006 на фінансові підрозділи (CERT-UA#7648)

tlp:clear CERT-UA intel cssa:origin="manual_investigation"

CERT-UA cssa:origin="manual_investigation" intel tlp:clear


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


Unknown malware botnet C2 server (confidence level: 100%)


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Daily Incremental ThreatFox Import - 2026-07-02


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Chinese Alloy Taurus Updates PingPull Malware

tlp:white ncsc-nl-ndn:distribute="Z-CERT" ncsc-nl-ndn:feed="generic" retention:3m misp-galaxy:threat-actor="GALLIUM"

misp-galaxy:threat-actor="GALLIUM" ncsc-nl-ndn:distribute="Z-CERT" ncsc-nl-ndn:feed="generic" retention:3m tlp:white


Remcos botnet C2 server (confidence level: 75%)


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


AsyncRAT botnet C2 server (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Encoding - T1132.002"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"


XWorm botnet C2 server (confidence level: 75%)


Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Email Collection - T1114"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"


misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


tlp:white tlp:clear stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


AdaptixC2 botnet C2 server (confidence level: 75%)


Campaign Targeting Government of thailand via Hermes AI Agent & Hades

Hades C2 node for Linux ELF binary (port 12443), shared TLS cert pivot

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Internal Proxy - T1090.001"

misp-galaxy:mitre-attack-pattern="Match Legitimate Resource Name or Location - T1036.005"

misp-galaxy:mitre-attack-pattern="Password Spraying - T1110.003"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Software Deployment Tools - T1072"

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Unknown malware botnet C2 server (confidence level: 75%)


Telnet bruteforce Attackers [2026-07-03]

misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


kill-chain:Reconnaissance kill-chain:Exploitation tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk" splunk:OK tlp:clear

kill-chain:Exploitation kill-chain:Reconnaissance splunk:OK stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:clear tlp:white


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


CACTUS: Analyzing a Coordinated Ransomware Attack on Corporate Networks

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Browser Bookmark Discovery - T1217"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="File Permissions Modification - T1222"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002"

misp-galaxy:mitre-attack-pattern="Remote Access Software - T1219"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Linux and Mac File and Directory Permissions Modification - T1222.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Group Policy Modification - T1484.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Unsecured Credentials - T1552"

misp-galaxy:mitre-attack-pattern="Use Alternate Authentication Material - T1550"

misp-galaxy:mitre-attack-pattern="Domain Policy Modification - T1484"

misp-galaxy:mitre-attack-pattern="Develop Capabilities - T1587"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Local Accounts - T1078.003"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Pass the Hash - T1550.002"

misp-galaxy:mitre-attack-pattern="Private Keys - T1552.004"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Resource Hijacking - T1496"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

misp-galaxy:mitre-attack-pattern="Steal Web Session Cookie - T1539"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Malicious Link - T1204.001"

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"


UNC215: Spotlight on a Chinese Espionage Campaign in Israel

206.189.123.156: Enriched via the shodan module

misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

206.189.123.156: Enriched via the shodan module


misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

UNC215: Spotlight on a Chinese Espionage Campaign in Israel


misp-galaxy:mitre-attack-pattern="Access Token Manipulation - T1134"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Application Window Discovery - T1010"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="Code Signing Certificates - T1588.003"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Data from Information Repositories - T1213"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Indirect Command Execution - T1202"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Standard Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Owner/User Discovery - T1033"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Thread Execution Hijacking - T1055.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-course-of-action="System Network Configuration Discovery Mitigation - T1016"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Account Manipulation - T1098"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115"

misp-galaxy:mitre-attack-pattern="Code Signing - T1553.002"

misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Dynamic Data Exchange - T1559.002"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Hidden Window - T1564.003"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Modify Registry - T1112"

misp-galaxy:mitre-attack-pattern="Process Discovery - T1057"

misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Screen Capture - T1113"

misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002"

misp-galaxy:mitre-attack-pattern="Service Stop - T1489"

misp-galaxy:mitre-attack-pattern="Software Discovery - T1518"

misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"


Ivanti — Zero Day Vulnerabilities, BSI Translation and Technical Deep Analysis

WARNING:
Potential false positive.
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters.

misp-galaxy:mitre-enterprise-attack-attack-pattern="Modify Existing Service - T1031"

misp-galaxy:mitre-attack-pattern="Exploitation of Remote Services - T1428"

misp-galaxy:mitre-attack-pattern="Analyze architecture and configuration posture - T1288"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001"

misp-galaxy:mitre-attack-pattern="Application or System Exploitation - T1499.004"

misp-galaxy:mitre-attack-pattern="Enumerate client configurations - T1262"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Indicators of Compromise Associated with OnePercent  Group Ransomware

misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Romania Land Registry (ANCPI e-Terra) Cyberattack by ByteToBreach

ByteToBreach Global C2 / Exfiltration Server

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Data Destruction - T1485"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"


misp-galaxy:mitre-attack-pattern="Commonly Used Port - T1043"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Disabling Security Tools - T1089"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Network Service Scanning - T1046"

misp-galaxy:mitre-attack-pattern="Process Injection - T1055"

misp-galaxy:mitre-attack-pattern="Query Registry - T1012"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="Security Software Discovery - T1063"

misp-galaxy:mitre-attack-pattern="Service Execution - T1035"

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


Daily Incremental ThreatFox Import - 2026-07-04


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


DCRat botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-05


Daily Incremental ThreatFox Import - 2026-07-03


Cobalt Strike botnet C2 server (confidence level: 100%)


Cobalt Strike botnet C2 server (confidence level: 75%)


APVA phishing/scam indicators 2026-06-18 19:27 (48 indicators)

misp-galaxy:mitre-attack-pattern="Web Portal Capture - T1056.003"

misp-galaxy:mitre-attack-pattern="Phishing for Information - T1598"

misp-galaxy:mitre-attack-pattern="Browser Session Hijacking - T1185"

misp-galaxy:mitre-attack-pattern="Financial Theft - T1657"


Malware Analysis Report (AR20-216A) Chinese Remote Access Trojan: TAIDOOR

Queried whois.apnic.net with "210.68.69.82"...

% Information related to '210.68.0.0 - 210.68.255.255'

% Abuse contact for '210.68.0.0 - 210.68.255.255' is 'hostmaster@twnic.net.tw'

inetnum:        210.68.0.0 - 210.68.255.255
netname:        SEEDNET
descr:         Digital United Inc.
descr:         9F, No. 125, Song Jiang Road
descr:         Taipei, Taiwan
country:        TW
admin-c:        JC256-AP
tech-c:         JC256-AP
mnt-by:         MAINT-TW-TWNIC
mnt-irt:        IRT-TWNIC-AP
status:         ALLOCATED PORTABLE
last-modified: 2018-12-12T06:04:02Z
source:         APNIC

irt:            IRT-TWNIC-AP
address:        Taipei, Taiwan, 100
e-mail:         hostmaster@twnic.net.tw
abuse-mailbox: hostmaster@twnic.net.tw
admin-c:        TWA2-AP
tech-c:         TWA2-AP
auth:         # Filtered
remarks:        Please note that TWNIC is not an ISP and is not empowered
remarks:        to investigate complaints of network abuse.
mnt-by:         MAINT-TW-TWNIC
last-modified: 2015-10-08T07:58:24Z
source:         APNIC

person:         Jonas Chou
nic-hdl:        JC256-AP
e-mail:         Jonaschou@fareastone.com.tw
address:        2F, No.218, Rueiguang Road
address:        Taipei, 114, R.O.C
phone:         +886-2-7700-8888
fax-no:         +886-2-7700-8888
country:        TW
mnt-by:         MAINT-TW-TWNIC
last-modified: 2012-12-18T10:10:01Z
source:         APNIC

% Information related to '210.68.69.80 - 210.68.69.87'

inetnum:        210.68.69.80 - 210.68.69.87
netname:        42888423-TW
descr:         Taipei Taiwan
country:        TW
admin-c:        NN3251-TW
tech-c:         NN3251-TW
mnt-by:         MAINT-TW-TWNIC
remarks:        This information has been partially mirrored by APNIC from
remarks:        TWNIC. To obtain more specific information, please use the
remarks:        TWNIC whois server at whois.twnic.net.
changed:        DavidLin1@fareastone.com.tw 20180330
status:         ASSIGNED NON-PORTABLE
source:         TWNIC

person:         NULL
address:        N/A Taiwan
country:        TW
e-mail:         joy25488@gmail.com
nic-hdl:        NN3251-TW
changed:        hostmaster@twnic.net.tw 20180331
source:         TWNIC

% This query was served by the APNIC Whois Service version 1.88.15-SNAPSHOT (WHOIS-US4)
Relationships
210.68.69.82 	Connected_From 	363ea096a3f6d06d56dc97ff1618607d462f366139df70c88310bbf77b9f9f90
Description

svchost.dll (8cf683b7d181591b91e145985f32664c) attempts to connect to the following IP address.

misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090"

misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"


Remcos botnet C2 server (confidence level: 75%)


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


Locky 2016-08-31 : Affid=1, DGA=1313 - "bank transactions" -
 "12345678abc.zip"


Hook botnet C2 server (confidence level: 75%)


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Defending SaaS-based applications against ShinyHunters OAuth abuse

misp-galaxy:mitre-attack-pattern="Cloud Application Integration - T1671"

misp-galaxy:mitre-attack-pattern="Customer Relationship Management Software - T1213.004"

misp-galaxy:mitre-attack-pattern="Spearphishing Voice - T1566.004"

misp-galaxy:mitre-attack-pattern="Steal Application Access Token - T1528"


misp-galaxy:mitre-attack-pattern="Exfiltration Over Web Service - T1567"


The authoring agencies have observed the following malicious IP addresses targeting networks. The below can be considered high confidence indicators of malicious activity and organizations are reminded not to probe the provided IP addresses, but instead to check historical network logs, specifically for large volumes of data being transferred. Particular attention should be given if these IP addresses were observed through December 2023 to February 2024

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Threat Actor Targets Banking Users in Spain and Portugal with Ousaban Malware [ Javali (Ousaban)


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability

HTTP redirect to HTTPS, HTTPS cert Subject: C=US, CN=UBNT Router UI, O=Ubiquiti Networks

misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


Analysis of initial attack samples exploiting CVE-2023-23397 vulnerability


Inside the Dragon: DragonForce Ransomware Group

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"

misp-galaxy:mitre-attack-pattern="Domain Accounts - T1078.002"

misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003"

misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001"

misp-galaxy:mitre-attack-pattern="LSASS Memory - T1003.001"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


Warning: Potential false positives (show)
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001"


misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Domain Trust Discovery - T1482"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Remote File Copy - T1105"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="Data Encrypted for Impact - T1486"


type:OSINT misp:threat-level="medium-risk" tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"


Shathak botnet pushes Trickbot, followed by DarkVNC and Cobalt Strike


23.106.123.219: Enriched via the shodan module


DoppelPaymer 'Akamai" cluster infrastructure

misp-galaxy:mitre-enterprise-attack-tool="Cobalt Strike - S0154"


WARNING - Potential False positive:
- Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


HOUKEN SEEKING A PATH BY LIVING ON THE EDGE WITH ZERO-DAYS

misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Exploitation for Initial Access - T1664"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Specialized list of IPv4 addresses belonging to common VPN providers and datacenters, removed IDS flag

misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


DCRat botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-02


AdaptixC2 botnet C2 server (confidence level: 100%)


BumbleBee Webshell Activity on Exchange Server

Warning: Potential false positives
Specialized list of IPv4 addresses belonging to common VPN providers and datacenters

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001"

misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018"

misp-galaxy:mitre-attack-pattern="System Time Discovery - T1124"

misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation - T1047"

misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004"

misp-galaxy:mitre-attack-pattern="Lateral Tool Transfer - T1570"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"


Stealc botnet C2 server (confidence level: 75%)


misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059"

misp-galaxy:mitre-attack-pattern="Windows Command Shell - T1059.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Encoding - T1132.002"

misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053.005"

misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002"

misp-galaxy:mitre-attack-pattern="Scheduled Task/Job - T1053"

misp-galaxy:mitre-attack-pattern="User Execution - T1204"

misp-galaxy:mitre-attack-pattern="Data Encoding - T1132"

misp-galaxy:mitre-attack-pattern="Acquire Infrastructure - T1583"


From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

C2 NCSA WebDav dropper lnk spoofing tlp:clear


misp-galaxy:mitre-attack-pattern="Spear phishing messages with malicious attachments - T1367"

misp-galaxy:mitre-attack-pattern="Proxy/protocol relays - T1304"

misp-galaxy:mitre-attack-pattern="Compromise 3rd party or closed-source vulnerability/exploit information - T1354"


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"

tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


KdcSponge, NGLite, Godzilla Webshell Used in Targeted Attack Campaign

misp-galaxy:mitre-attack-pattern="Command-Line Interface - T1059"

misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001"

misp-galaxy:mitre-attack-pattern="Data Staged - T1074"

misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Server Software Component - T1505"

misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Credential API Hooking - T1056.004"

misp-galaxy:mitre-attack-pattern="Web Shell - T1505.003"


Daily Incremental ThreatFox Import - 2026-07-05


ValleyRAT botnet C2 server (confidence level: 75%)


Daily Incremental ThreatFox Import - 2026-07-03


misp-galaxy:mitre-attack-pattern="Scanning IP Blocks - T1595.001"

misp-galaxy:mitre-attack-pattern="Credential Access - TA0006"

misp-galaxy:mitre-attack-pattern="Password Guessing - T1110.001"


misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"


tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"


XMRIG payload delivery server (confidence level: 100%)


Attacks in the Wild on the Container Supply Chain and Infrastructure

misp-galaxy:threat-actor="TeamTNT" misp-galaxy:sector="Mining" aqua tlp:white TeamTNT WatchDog mining

TeamTNT WatchDog aqua mining misp-galaxy:sector="Mining" misp-galaxy:threat-actor="TeamTNT" tlp:white


misp-galaxy:threat-actor="TeamTNT" misp-galaxy:sector="Mining" Profero tlp:white TeamTNT WatchDog mining

Profero TeamTNT WatchDog mining misp-galaxy:sector="Mining" misp-galaxy:threat-actor="TeamTNT" tlp:white


MoustachedBouncer: Espionage against foreign diplomats in Belarus

[Auto] IDS disabled by warninglist checker. Matched: List of known GCP (Google Cloud Platform) IP address ranges


Brute Ratel C4 botnet C2 server (confidence level: 100%)


Daily Incremental ThreatFox Import - 2026-07-04


kill-chain:Exploitation kill-chain:Reconnaissance tlp:white stone:source="OSINT" stone:incident-classification="Attack" stone:threat-level="low-risk"

kill-chain:Exploitation kill-chain:Reconnaissance stone:incident-classification="Attack" stone:source="OSINT" stone:threat-level="low-risk" tlp:white


Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Exploitation for Privilege Escalation - T1068"

misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082"

misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Archive Collected Data - T1560"

misp-galaxy:mitre-attack-pattern="Data from Local System - T1005"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Container Administration Command - T1609"

misp-galaxy:mitre-attack-pattern="Network Device CLI - T1059.008"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="SSH Authorized Keys - T1098.004"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Command Obfuscation - T1027.010"

misp-galaxy:mitre-attack-pattern="Disable or Modify System Firewall - T1562.004"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Network Boundary Bridging - T1599"

misp-galaxy:mitre-attack-pattern="Modify Authentication Process - T1556"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Network Device Configuration Dump - T1602.002"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095"

misp-galaxy:mitre-attack-pattern="Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Active Scanning - T1595"

misp-galaxy:mitre-attack-pattern="Clear Persistence - T1070.009"

misp-galaxy:mitre-attack-pattern="Container Service - T1543.005"

misp-galaxy:mitre-attack-pattern="Deploy Container - T1610"

misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Multi-hop Proxy - T1090.003"

misp-galaxy:mitre-attack-pattern="Network Devices - T1584.008"

misp-galaxy:mitre-attack-pattern="Network Sniffing - T1040"

misp-galaxy:mitre-attack-pattern="Network Topology - T1590.004"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"

misp-galaxy:mitre-attack-pattern="OS Credential Dumping - T1003"

misp-galaxy:mitre-attack-pattern="Password Cracking - T1110.002"

misp-galaxy:mitre-attack-pattern="Protocol Tunneling - T1572"

misp-galaxy:mitre-attack-pattern="Remote Services - T1021"

misp-galaxy:mitre-attack-pattern="SNMP (MIB Dump) - T1602.001"

misp-galaxy:mitre-attack-pattern="System Services - T1569"

misp-galaxy:mitre-attack-pattern="Trusted Relationship - T1199"


misp:threat-level="medium-risk" type:OSINT tlp:clear MALWARE misp:threat-level="medium-risk" misp:event-type="observation" misp:automation-level="unsupervised" type:OSINT osint:lifetime="perpetual" osint:source-type="manual-collection"

MALWARE misp:automation-level="unsupervised" misp:event-type="observation" misp:threat-level="medium-risk" osint:lifetime="perpetual" osint:source-type="manual-collection" tlp:clear type:OSINT


misp-galaxy:mitre-attack-pattern="External Remote Services - T1133"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"

misp-galaxy:mitre-attack-pattern="Local Account - T1136.001"

misp-galaxy:mitre-attack-pattern="Default Accounts - T1078.001"

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls


DanaBot botnet C2 server (confidence level: 75%)


VShell botnet C2 server (confidence level: 100%)


misp:threat-level="medium-risk" type:OSINT type:OSINT MALWARE osint:source-type="manual-collection" misp:threat-level="medium-risk" tlp:clear misp:event-type="observation" misp:automation-level="unsupervised" osint:lifetime="perpetual"


Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

misp-galaxy:mitre-attack-pattern="Exploitation for Client Execution - T1203"

misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078"

misp-galaxy:mitre-attack-pattern="Exploitation for Credential Access - T1212"

misp-galaxy:mitre-attack-pattern="Input Capture - T1056"

misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083"

misp-galaxy:mitre-attack-pattern="Email Collection - T1114"

misp-galaxy:mitre-attack-pattern="Non-Standard Port - T1571"


Romania Land Registry (ANCPI e-Terra) Cyberattack by ByteToBreach

misp-galaxy:mitre-attack-pattern="Account Discovery - T1087"

misp-galaxy:mitre-attack-pattern="Permission Groups Discovery - T1069"

misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"

misp-galaxy:mitre-attack-pattern="Data Destruction - T1485"

misp-galaxy:mitre-attack-pattern="Inhibit System Recovery - T1490"


Cyber Attack: Data Exfiltration to Malicious IP - 38.45.248.13

Agencia de Transformación Digital y Telecomunicaciones


Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems

Malware Delivery (VMISS Inc., HK) [VT: 0/91 malicious as of 2026-07-16]
[38.55.105.143] XNNET LIMITED / VMISS Inc. (ASN: N/A) - Kowloon, Hong Kong
ISP:               XNNET LIMITED
ORGANIZATION:      VMISS Inc.
LATITUDE:      22.31933
LONGITUDE:   114.16942
City:              Kowloon
Country:         Hong Kong
ASN:               N/A

misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105"

misp-galaxy:mitre-attack-pattern="Cloud Accounts - T1078.004"

misp-galaxy:mitre-attack-pattern="Credentials In Files - T1552.001"

misp-galaxy:mitre-attack-pattern="Gather Victim Identity Information - T1589"

misp-galaxy:mitre-attack-pattern="Vulnerability Scanning - T1595.002"

misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190"