CTT Report Hub

#ParsedReport #CompletenessHigh 14-08-2026 Insurance Claim: Examining the Tools and Infrastructure of the New Malinsure Threat https://www.f6.ru/blog/malinsure/ Report completeness: High Threats: Malinsure Dll_sideloading_technique Lolbin_technique Lolbas_technique…

#ParsedReport #CompletenessHigh 14-08-2026 Insurance Claim: Examining the Tools and Infrastructure of the New Malinsure Threat https://www.f6.ru/blog/malinsure/ Report completeness: High Threats: Malinsure Dll_sideloading_technique Lolbin_technique Lolbas_technique…

#ParsedReport #CompletenessHigh 14-08-2026 Insurance Claim: Examining the Tools and Infrastructure of the New Malinsure Threat https://www.f6.ru/blog/malinsure/ Report completeness: High Threats: Malinsure Dll_sideloading_technique Lolbin_technique Lolbas_technique Victims: Insurance, Financial services, Oil and gas Industry: Healthcare, Financial, Petroleum Geo: Russian, Russian federation TTPs: Tactics: 2 Technics: 0 ChatGPT TTPs: do not use without manual check T1027.013, T1036.007, T1071.001, T1071.004, T1083, T1095, T1102.001, T1129, T1140, T1218.007, have more... IOCs: Hash: 129 Email: 1 IP: 36 File: 27 Path: 5 Url: 13 Domain: 67 Soft: Telegram, VKontakte, Viber, WhatsApp, owerpnt.ex, icrosoft Office ro, icrosoft Office Of, erpnt.exe, Internet Explorer, icrosoft Office Ca, have more... Algorithms: gzip, md5, zip, sha1, base64, sha256 Functions: makeInitialSettings, IsWindowsService, DllMain Win API: DllUnregisterServer, DllRegisterServer, EXE, NetGetJoinInformation, GetMessageW Win Services: powerpnt, owerpnt.ex, erpnt.exe Platforms: x64, x86 Links: https://github.com/durck/reverse\_ssh/blob/0eb974292661ecc286551e4d6264a081873dbc5a/cmd/client/detach\_windows.go https://github.com/durck/reverse\_ssh/blob/0eb974292661ecc286551e4d6264a081873dbc5a/internal/client/client.go https://github.com/durck/reverse\_ssh/blob/0eb974292661ecc286551e4d6264a081873dbc5a/cmd/client/main.go have more...

#ParsedReport #CompletenessHigh 13-08-2026 PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/…

#ParsedReport #CompletenessHigh 13-08-2026 PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/…

#ParsedReport #CompletenessHigh 13-08-2026 PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/ Report completeness: High Actors/Campaigns: Transparenttribe Silver_fox Threats: Patchcord Sheetcord Supershell Credential_harvesting_technique Regre_ssh_ion_vuln Hackerai Metasploit_tool Sheetcreep Spear-phishing_technique Gatesentinel_tool Hackbrowserdata_tool Pwnkit_tool Valleyrat Abcdoor Cobalt_strike_tool Havoc Victims: Telecommunications, Government, Defense, Energy, Critical infrastructure, Healthcare Industry: Healthcare, Petroleum, Energy, Military, Government, Critical_infrastructure, Telco Geo: Pakistan, Asia, Chinese, Indian, Afghanistan, India, Netherlands, Afghan, China, Asian, Guangdong CVEs: CVE-2024-6387 [Vulners] CVSS V3.1: 8.1, Vulners: Exploitation: True X-Force: Risk: Unknown X-Force: Patch: Unknown Soft: - sonicwall sma_6200_firmware (-) CVE-2021-4034 [Vulners] CVSS V3.1: 7.8, Vulners: Exploitation: True X-Force: Risk: Unknown X-Force: Patch: Unknown Soft: - polkit_project polkit (<121) TTPs: Tactics: 3 Technics: 0 ChatGPT TTPs: do not use without manual check T1027.002, T1027.016, T1033, T1036.005, T1041, T1049, T1057, T1059.001, T1059.005, T1071.001, have more... IOCs: Domain: 18 Command: 3 IP: 1 File: 21 Hash: 13 Soft: twitter, Embarcadero, NET Reactor, Microsoft Edge, Google Chrome, Mozilla Firefox, chrome, Internet Explorer, Chrome, Firefox, Opera, have more... Algorithms: base64, exhibit, zip, xor, sha256 Functions: FindAndHijackBrowserShortcut, SetIconLocation, TaskBar Win API: ShellExecuteW, InternetOpenW, CreateToolHelp32Snapshot, VirtualAlloc, VirtualProtect, CreateThread, CreateProcessA, RegSetValueExW, IsDebuggerPresent Languages: golang, delphi, vbscript, python

#ParsedReport #CompletenessMedium 13-08-2026 Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/ Report completeness: Medium…

#ParsedReport #CompletenessMedium 13-08-2026 Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/ Report completeness: Medium…

#ParsedReport #CompletenessMedium 13-08-2026 Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/ Report completeness: Medium…

#ParsedReport #CompletenessMedium 13-08-2026 Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/ Report completeness: Medium Actors/Campaigns: Stuffy_squirrel Shady_squirrel (motivation: financially_motivated) Swiping_squirrel Ta2726 Magecart Master134 Threats: Socgholish_loader Clearfake Scavenger Cloaking_technique Help_tds_tool Balada_injector Popunder_technique Tech-support-scam_kit_tool Supply_chain_technique Clickfix_technique Victims: Compromised websites, Online gambling, Advertising, E commerce, Adult content, Technology support services Industry: E-commerce Geo: Japan, Japanese, United states, Russian ChatGPT TTPs: do not use without manual check T1027, T1027.013, T1036, T1059.007, T1071.001, T1082, T1219, T1583.001, T1583.006, T1656, have more... IOCs: File: 3 Domain: 30 Soft: Keitaro, WordPress, Binom Algorithms: aes Functions: Keitaro Languages: javascript Platforms: arm, intel Links: https://github.com/infobloxopen/threat-intelligence

#ParsedReport #CompletenessLow 13-08-2026 North Korean hacker groups fully integrate AI: From phishing documents to self-built local large language models https://www.secrss.com/articles/92962 Report completeness: Low Actors/Campaigns: Kimsuky Gitpower…

#ParsedReport #CompletenessLow 13-08-2026 North Korean hacker groups fully integrate AI: From phishing documents to self-built local large language models https://www.secrss.com/articles/92962 Report completeness: Low Actors/Campaigns: Kimsuky Gitpower…

#ParsedReport #CompletenessLow 13-08-2026 North Korean hacker groups fully integrate AI: From phishing documents to self-built local large language models https://www.secrss.com/articles/92962 Report completeness: Low Actors/Campaigns: Kimsuky Gitpower…

#ParsedReport #CompletenessLow 13-08-2026 North Korean hacker groups fully integrate AI: From phishing documents to self-built local large language models https://www.secrss.com/articles/92962 Report completeness: Low Actors/Campaigns: Kimsuky Gitpower Scarcruft Threats: Flowerpower Spear-phishing_technique Whisper_backdoor Asyncrat Victims: Diplomatic institutions, Military organizations, Security agencies, Virtual assets, Financial investment, Game development Industry: Military, Financial Geo: South korean, North korea, Korean, North korean ChatGPT TTPs: do not use without manual check T1027, T1036, T1036.008, T1053.005, T1059.001, T1105, T1140, T1204.002, T1566.001, T1587.001, have more... IOCs: File: 4 Soft: Ollama, Llama, Mistral, Qwen, DeepSeek, LangChain, OpenAI, Astrill VPN Algorithms: gzip, zip, rc4, base64 Languages: python, powershell

#ParsedReport #CompletenessMedium 14-08-2026 Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/ Report completeness: Medium Threats: Windrelay Ngate Spynote_rat…

#ParsedReport #CompletenessMedium 14-08-2026 Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/ Report completeness: Medium Threats: Windrelay Ngate Spynote_rat…

#ParsedReport #CompletenessMedium 14-08-2026 Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/ Report completeness: Medium Threats: Windrelay Ngate Spynote_rat Ghost_tap_technique Nfcgate_tool Victims: Banking, Financial services, Payment services Industry: Financial Geo: Czechia, Slovakia, Czech, Slovenia, Poland, Czech republic ChatGPT TTPs: do not use without manual check T1036, T1041, T1105, T1204.002, T1219, T1557, T1566.004, T1636, T1657 IOCs: IP: 4 Hash: 29 Soft: Android, Telegram Algorithms: sha1

#ParsedReport #CompletenessHigh 13-08-2026 Armored Likho expands its cyber-espionage toolkit https://securelist.com/armored-likho-still-toolkit/121033/ Report completeness: High Actors/Campaigns: Eagle_werewolf (motivation: cyber_espionage) Threats: …

#ParsedReport #CompletenessHigh 13-08-2026 Armored Likho expands its cyber-espionage toolkit https://securelist.com/armored-likho-still-toolkit/121033/ Report completeness: High Actors/Campaigns: Eagle_werewolf (motivation: cyber_espionage) Threats: …

#ParsedReport #CompletenessHigh 13-08-2026 Armored Likho expands its cyber-espionage toolkit https://securelist.com/armored-likho-still-toolkit/121033/ Report completeness: High Actors/Campaigns: Eagle_werewolf (motivation: cyber_espionage) Threats: Still_toolkit_tool Still_sync Still_audio Aquilarat Shadow_copies_delete_technique Robocopy_tool Dead_drop_technique Victims: Private individuals, Corporate sector, Government organizations, Information technology companies, Educational institutions Industry: Education, Government Geo: Russian, Russia TTPs: Tactics: 1 Technics: 0 ChatGPT TTPs: do not use without manual check T1027, T1036, T1041, T1059.001, T1071.001, T1078, T1082, T1083, T1102.001, T1119, have more... IOCs: Domain: 8 Url: 3 File: 3 Hash: 9 IP: 8 Soft: Telegram, Starlink, Microsoft Store Algorithms: sha256, base64, blowfish Win API: SeBackupPrivilege, CreateFileW Languages: powershell, rust Platforms: intel Links: https://github.com/tokio-rs/tokio https://github.com/google/flatbuffers