#IoC

9 posts8 participants0 posts today

VulDB :verified:Added more indicators for: AdaptixC2 (+1), MimiKatz (+1), Meterpreter (+1), Eye Pyramid (+1), DeimosC2 (+1), GuLoader (+1) and RemcosRAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

The Japan TimesThomas Bach's eventful 12-year tenure as president of the International Olympic Committee comes to an end on Monday. His top challenges included Russia's doping program and the pandemic-hit Tokyo Games. <a href="https://www.japantimes.co.jp/olympics/2025/06/22/thomas-bach-challenges/?utm_medium=Social&utm_source=mastodon" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.japantimes.co.jp/olympics/2025/06/22/thomas-bach-challenges/?utm_medium=Social&utm_source=mastodon</a> <a href="https://mastodon.social/tags/olympics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#olympics</a> <a href="https://mastodon.social/tags/thomasbach" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#thomasbach</a> <a href="https://mastodon.social/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a> <a href="https://mastodon.social/tags/2020tokyoolympics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2020tokyoolympics</a> <a href="https://mastodon.social/tags/russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#russia</a>

The Japan TimesAs the gender furor that engulfed boxing at the 2024 Paris Olympics rumbles on, the IOC is weighing reintroducing testing. <a href="https://www.japantimes.co.jp/olympics/2025/06/21/ioc-testing-gender/?utm_medium=Social&utm_source=mastodon" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.japantimes.co.jp/olympics/2025/06/21/ioc-testing-gender/?utm_medium=Social&utm_source=mastodon</a> <a href="https://mastodon.social/tags/olympics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#olympics</a> <a href="https://mastodon.social/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a> <a href="https://mastodon.social/tags/transgender" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#transgender</a> <a href="https://mastodon.social/tags/lgbtq" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lgbtq</a> <a href="https://mastodon.social/tags/kirstycoventry" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kirstycoventry</a>

VulDB :verified:Added some indicators for: NjRAT (+1), Rhadamanthys (+1), Venom RAT (+2), XWorm (+5), Meterpreter (+1), MooBot (+2) and BianLian (+2). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:Added indicators for: SpyMax (+1), FAKEUPDATES (+1), DeimosC2 (+1), NetSupport (+1), Orcus RAT (+1), RapperBot (+7) and Stealc (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:New indicators for: FAKEUPDATES (+1), Lumma Stealer (+1), Stealerium (+1), Agent Tesla (+1), Socks5 Systemz (+1), DeimosC2 (+1) and Bashlite (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:Updated threat actors: Houdini (+2), Brute Ratel C4 (+1), PowerShell (+1), Vidar (+2), FAKEUPDATES (+1), Mozi (+3) and Lumma Stealer (+4). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:We have improved indicators: Lumma Stealer (+3), xorbot (+2), Eye Pyramid (+1), Broomstick (+1), Bashlite (+1), Ghost RAT (+1) and RemcosRAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

DevorppaI note that the <a href="https://aus.social/tags/soccer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#soccer</a> <a href="https://aus.social/tags/worldcup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#worldcup</a> and the 2028 <a href="https://aus.social/tags/Olympics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Olympics</a> are scheduled to be held in the <a href="https://aus.social/tags/USA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USA</a>I wonder how long it will take for athletes across the non-USA world to start saying … ‘if they don’t move it then I’ll pass on this one’. It won’t be <a href="https://aus.social/tags/FIFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FIFA</a> or the <a href="https://aus.social/tags/IOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOC</a> that make the first move. I suspect they will be dragged kicking and screaming by athletes - especially the highly paid and high profile athletes who have their own profile that they can use to get their views known.And, of course, public opinion will be shaped by those athletes, not the peak organisations …

VulDB :verified:We have added indicators: Gafgyt (+1), AdaptixC2 (+1), Bashlite (+1), DCRat (+1), Koi Loader (+1), Rhadamanthys (+1) and XWorm (+3). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:New free CTI indicators in our GitHub repository: <a href="https://github.com/vuldb/cyber_threat_intelligence" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/vuldb/cyber_threat_intelligence</a> <a href="https://infosec.exchange/tags/vuldb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vuldb</a> <a href="https://infosec.exchange/tags/github" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#github</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a> <a href="https://infosec.exchange/tags/ttp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ttp</a> <a href="https://infosec.exchange/tags/ioa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioa</a>

VulDB :verified:We have updated indicators: Latrodectus (+2), P2Pinfect (+1), Gafgyt (+1), WarmCookie (+1), Bashlite (+1), Chaos (+1) and Katz Stealer (+2). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:We have updated these actors: Sality (+1), Ircbot (+1), DCRat (+1), QakBot (+2), Nimplant (+1), Metasploit (+1) and FAKEUPDATES (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:Improved indicators: AdaptixC2 (+1), Havoc (+1), WarmCookie (+1), XWorm (+2), SectopRAT (+4), ValleyRAT (+1) and RMS (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

VulDB :verified:Indicators added for: N-W0rm (+1), AdaptixC2 (+2), QakBot (+3), DeimosC2 (+1), BianLian (+2), MimiKatz (+1) and Hajime (+18). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

:mastodon: decioSVG phishing campaign delivers infostealerA few days ago, the excellent Risky Biz newsletter highlighted the growing abuse of the SVG format in malicious campaigns. ⬇️ <a href="https://risky.biz/risky-bulletin-svg-use-for-phishing-explodes-in-2025/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://risky.biz/risky-bulletin-svg-use-for-phishing-explodes-in-2025/</a>We’ve seen several of them since the beginning of the year — with a noticeable spike last week.The latest one is in German and aims to deploy an infostealer, through a well-crafted invoice-themed lure. ✉️ The lure: a professional-looking invoiceThe victim receives an email (often from a legitimate company address that has been hacked) with a subject line like:<blockquote>Rechnung Nr. 0XXXXXX</blockquote>The body thanks the recipient for a recent order and invites them to open the attached invoice. That attachment is a .svg file (e.g. <code>R_0494467.svg</code>, ) — an unusual format for invoices, but not enough to raise suspicion for many users.[Live analysis example in Joe] ⬇️ <a href="https://www.joesandbox.com/analysis/1705755/0/html#deviceScreen" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.joesandbox.com/analysis/1705755/0/html#deviceScreen</a> 🖼️ The decoy: a fake Adobe Acrobat screenWhen opened, the SVG displays a fake Adobe Acrobat Reader interface with the message:<blockquote>„Bitte warten Sie, Ihr Dokument wird hochgeladen…” ("Please wait, your document is being uploaded...")</blockquote>While the victim sees this reassuring screen, a heavily obfuscated JavaScript payload executes silently in the background. 🧪 Technical steps of the attack<ol><li>The SVG-embedded JavaScript decrypts and builds logic in memory.</li><li>It dynamically redirects to an intermediate script hosted at: hxxps://pdf-zone-update[.]com/script.php?id=... ⬇️ <a href="https://any.run/report/1528482540479dfdd79ba9cbf07d24c52c2ec39adb54a83a2287f008a21275a2/bf2e0e6f-871c-40b8-b7c5-abb4fd3d6bf0" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://any.run/report/1528482540479dfdd79ba9cbf07d24c52c2ec39adb54a83a2287f008a21275a2/bf2e0e6f-871c-40b8-b7c5-abb4fd3d6bf0</a></li><li>This script performs:</li><li>A user-agent check to avoid sandboxes/VMs,</li><li>Then sets the <code>href</code> of a hidden link to:<pre><code>hxxps://w-update-server3092[.]com/file.php?id=... </code></pre>[obfuscated javascript] ⬇️ <a href="https://www.virustotal.com/gui/file/25f9f7ab644ffcde8bf5b6e8835fce7fab981d4189418bb96c5f9e06d52e0ede/content" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.virustotal.com/gui/file/25f9f7ab644ffcde8bf5b6e8835fce7fab981d4189418bb96c5f9e06d52e0ede/content</a></li><li>The browser automatically follows this link and retrieves a PowerShell loader.</li><li>The PowerShell:</li><li>Executes a .NET infostealer in-memory,</li><li>Takes a screenshot and exfiltrates it via:<pre><code>hxxps://0x0[.]st </code></pre></li><li>Extracts Outlook and Thunderbird credentials (via DPAPI and local files),</li><li>Contacts a C2 server:<pre><code>hxxp://176.65.138[.]152/server.php </code></pre></li><li>Receives a registry-based persistence command:<pre><code>REG ADD "HKCU\...\Run" /V "System Update2" /D "wscript.exe \"%SCRIPT_NAME%\"" </code></pre> </li><li>Layered execution with obfuscation and intermediary JS filtering.</li><li>PowerShell payload is native (no dependencies).</li><li>Plaintext C2 communication.</li><li>Registry key name (<code>System Update2</code>) is designed to blend in.</li></ol> 📁 Key IOCs<ul><li>Initial file: <code>R_0494467.svg</code> (~15KB)</li><li>Intermediate JS URL: <code>pdf-zone-update[.]com/script.php</code></li><li>PowerShell loader: <code>w-update-server3092[.]com</code></li><li>C2: <code>176.65.138[.]152</code></li><li>Screenshot exfiltration: <code>0x0[.]st</code></li><li>Persistence key:HKCU\Software\Microsoft\Windows\CurrentVersion\Run→ "System Update2" → wscript.exe "%SCRIPT_NAME%"</li></ul><a href="https://infosec.exchange/tags/CyberVeille" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberVeille</a> <a href="https://infosec.exchange/tags/SVG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SVG</a> <a href="https://infosec.exchange/tags/infostealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infostealer</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/IoC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IoC</a>

VulDB :verified:Added some more indicators for: ValleyRAT (+1), MooBot (+1), Nimplant (+1), WarmCookie (+1), NjRAT (+2), GuLoader (+1) and Hajime (+7). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

umweltFAIRaendernImmer zu teuer: Olympia kostet und kostet Noch jede Olympischen Spiele haben am Ende deutlich mehr gekostet, als ehemals versprochen oder vermeintlich geplant. Das ist ein zentrales Fazit auch einer wissenschaftlichen Untersuchung, der sogenannten "Oxford Olympics Study", die am 30. Mai 2024 mit einem umfasse <a href="https://fairspielen.de/2025/06/10/immer-zu-teuer-olympia-kostet-und-kostet/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fairspielen.de/2025/06/10/immer-zu-teuer-olympia-kostet-und-kostet/</a> <a href="https://norden.social/tags/DOSB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DOSB</a> <a href="https://norden.social/tags/Hamburg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hamburg</a> <a href="https://norden.social/tags/IOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOC</a> <a href="https://norden.social/tags/Nolympia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nolympia</a> <a href="https://norden.social/tags/Olympia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Olympia</a> <a href="https://norden.social/tags/Kosten" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kosten</a> <a href="https://norden.social/tags/Kostenberschreitung" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kostenberschreitung</a> <a href="https://norden.social/tags/Olympia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Olympia</a> <a href="https://norden.social/tags/OlympischeSpiele" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OlympischeSpiele</a> <a href="https://norden.social/tags/Paris2024" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Paris2024</a>

Klaas EßmüllerFür <a href="https://troet.cafe/tags/Olympia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Olympia</a> in <a href="https://troet.cafe/tags/Hamburg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hamburg</a> müsste die Stadt den HostCity-Vertrag mit dem <a href="https://troet.cafe/tags/IOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOC</a> abschließen. Ein Rechtsgutachten zur Bewerbung in München 2018 hat Spannendes gezeigt. Oder wie <a href="https://troet.cafe/tags/SPD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SPD</a> und <a href="https://troet.cafe/tags/Gr%C3%BCne" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Grüne</a> sagen: „Hamburg+“🤦‍♂️ Quelle: <a href="https://www.nolympia.de/grunde-gegen-olympia-2018/vertrage-des-ioc/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.nolympia.de/grunde-gegen-olympia-2018/vertrage-des-ioc/</a>

VulDB :verified:Added more indicators for: Quasar RAT (+1), AdaptixC2 (+1), ERMAC (+1), ResolverRAT (+1), Hook (+1), ShadowPad (+1) and SectopRAT (+1). <a href="https://vuldb.com/?actor" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://vuldb.com/?actor</a> <a href="https://infosec.exchange/tags/apt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apt</a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/ioc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ioc</a>

Recent searches

Search options

Administered by:

Server stats: