Elektrine
Log in Register

#openthreatexchange

4 posts · Last used 8d

Back to Timeline
techbot
OTX Bot @techbot@social.raytec.co · Aug 06, 2026
Security Update – August 2, 2026 Pulse ID: 6a740db739f5ddf6e048bf0a Pulse Link: https://otx.alienvault.com/pulse/6a740db739f5ddf6e048bf0a Pulse Author: Tr1sa111 Created: 2026-08-06 04:29:43 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #CyberSecurity #InfoSec #OTX #OpenThreatExchange #bot #Tr1sa111
0
0
0
techbot
OTX Bot @techbot@social.raytec.co · Jul 29, 2026
Analysis of BlueShell Variants Used by APT Groups BlueShell is an open-source remote access trojan developed in Go language, primarily used by Chinese-based threat actors. A variant of BlueShell has been identified in post-intrusion activities by APT groups including BlackTech, targeting organizations in Japan, South Korea, and Thailand. This variant differs from the original through a dedicated dropper mechanism, proxy server-based C2 communication, and anti-forensic capabilities. The dropper deploys the variant to /tmp/kthread, disguises it as a Linux kernel worker process, and removes filesystem traces. Recent variants observed since 2024 include XOR-encoded configuration data and proxy functionality, indicating continuous development. The malware performs hostname verification, validates C2 certificates, and implements commands for file transfer, remote shell, and SOCKS5 proxy capabilities. Pulse ID: 6a69c06b441d532a963887ee Pulse Link: https://otx.alienvault.com/pulse/6a69c06b441d532a963887ee Pulse Author: AlienVault Created: 2026-07-29 08:57:15 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Chinese #CyberSecurity #InfoSec #Japan #Korea #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteAccessTrojan #SouthKorea #Thailand #Trojan #bot #socks5 #AlienVault
0
0
0
techbot
OTX Bot @techbot@social.raytec.co · Jul 17, 2026
Contagious Interview malware in SVG images: DPRK campaign A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers. Pulse ID: 6a5a8ba0229db5a5b2686baa Pulse Link: https://otx.alienvault.com/pulse/6a5a8ba0229db5a5b2686baa Pulse Author: AlienVault Created: 2026-07-17 20:08:00 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Browser #Clipboard #CyberSecurity #DPRK #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #RemoteAccessTrojan #SVG #Steganography #SupplyChain #Trojan #bot #cryptocurrency #developers #AlienVault
1
0
1
techbot
OTX Bot @techbot@social.raytec.co · Jun 19, 2026
Analysis of Gamaredon campaign targeting Ukraine weaponizing CVE-2025-8088 A campaign exploiting the WinRAR path-traversal vulnerability CVE-2025-8088 has been actively targeting Ukraine since February 2026, with ongoing activity through June 2026. The operation uses Ukrainian military and conscription-themed documents as lures, distributed as RAR archives. The malicious archives contain NTFS alternate data streams with path-traversal sequences that automatically place LNK files into the Windows Startup folder upon extraction. These shortcuts execute hidden PowerShell stagers incorporating anti-analysis techniques including debugger checks, disk-space verification, and sleep delays to evade sandbox detection. The persistent nature of the attacks demonstrates continuous targeting of Ukrainian entities over a four-month period using social engineering focused on military documentation themes. Pulse ID: 6a34c6344468a941c924c02c Pulse Link: https://otx.alienvault.com/pulse/6a34c6344468a941c924c02c Pulse Author: AlienVault Created: 2026-06-19 04:31:48 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #CyberSecurity #Gamaredon #InfoSec #LNK #Military #OTX #OpenThreatExchange #PowerShell #RAT #SocialEngineering #UK #Ukr #Ukraine #Ukrainian #Vulnerability #WinRAR #Windows #bot #AlienVault
0
0
1

You've seen all posts