ThreatActors-TTPs

NOTA: Esto es un fork de Crocodyli - Todo lo que hago es agregarle para mis propios fines. Lo estoy usando para alimentar las páginas de gapMATRIX en https://incidentbuddy.ai ACTORES DE AMENAZAS Y RANSOMWARES - TTPs Este repositorio fue creado con el objetivo de ayudar a empresas e investigadores...

ThreatActors-TTPs

ACTORES DE AMENAZAS Y RANSOMWARES - TTPs Este repositorio fue creado con el objetivo de ayudar a empresas e investigadores independientes a estudiar las Tácticas, Técnicas y Procedimientos TTPs , basadas en el marco MITRE ATT &CK, adoptadas por operadores/grupos de ransomware activos o inactivos ...

IOCs

////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // ///////////////////////// ///////////////////////...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

SupplyChainAttacks

Ataques a la Cadena de Suministro de Firmware Este repositorio proporciona una colección curada y exhaustiva de ataques documentados a la cadena de suministro de firmware descubiertos o investigados por el equipo de investigación de Binarly. Mantenido por Binarly, el proyecto sirve como un recurs...

CVE-2018-13379

IOC's for CObalt Strike/CVE-2018-13379 All credit goes to Awake/Arista/https://www.linkedin.com/in/kevin-romano-48071a42/ IOCs copied from DD: https://awakesecurity.com/blog/exploiting-cve-2018-13379-a-case-study-of-threat-actors-exploiting-years-old-cves/...

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect. That risk is no longer...

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access OWA, to target U.S. and European government entities, as well as the telecommunications, financial,...

Microsoft SharePoint CVE-2026-50522 Post-Exploitation Payload Collection

A collection of payloads, webshells, and HTTP request artifacts observed following exploitation of the Microsoft SharePoint CVE-2026-50522 vulnerability. The repository documents real-world payloads deployed by multiple threat actors rather than providing an exploit for the underlying vulnerabili...

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

PYSEC-2026-3445

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

PYSEC-2026-3445

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

EUVD-2026-42430

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210

Summary: OpenCTI prior to version 7.260326.0 contains an authorization bypass via the synchronized-upsert: true HTTP header, exploitable by any authenticated user with KNOWLEDGE_KNUPDATE permission. This allows bypassing Confidence Level validation and Object Marking restrictions, enabling attack...

PT-2026-56601

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260326.0 Description An authorization bypass allows authenticated users with KNOWLEDGE KNUPDATE permission to circumvent Confidence Level validation and Object Marking restrictions. This is achieved by injecting the...

Catan and Mouse

Welcome to this week's edition of the Threat Source newsletter. " I do not know everything; still many things I understand." ― Madeleine L'Engle, A Wrinkle in Time " Don't try to comprehend with your mind. Your minds are very limited. Use your intuition." ― Madeleine L'Engle, A Wind in the Door T...