stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

Attacker-Group-Predictor

Attacker-Group-Predictor 该工具根据使用的技术和软件预测攻击者组。它基于 MITRE ATT&CK™ 框架进行搜索 工作原理？ 1- 从 https://attack.mitre.org/ 收集关于攻击者组的数据 2- 从用户处获取关于攻击的数据 3- 比较数据并生成结果 安装 root@kitploit: git clone https://github.com/omergunal/Attacker-Group-Predictor.git cd Attacker-Group-Predictor/ pip3 install -r requirements.txt ...

PolinRider

PolinRider：朝鲜威胁行为者在数百个GitHub仓库中植入恶意软件 日期： 2026-03-07 最后更新： 2026-04-11 — 请参见下文 4月10–11日更新 严重性： 严重 — 活跃的供应链感染波及 1,950+ 个公开仓库，已确认与 TasksJacker / Contagious Interview 集群实现运营整合 OpenSourceMalware 团队发现了一场大规模威胁活动，该活动正在向 GitHub 用户和组织仓库中植入恶意软件。威胁行为者 PolinRider 已在 数百个公开 GitHub 仓库 （属于 数百个不同的所有者 ）中植入了恶意混淆的...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

CVE-2021-3122-Details

CVE-2021-3122-详情 关于我们如何在AlohaPOS中发现一个CVE的博客文章。 https://www.sentinelone.com/blog/cve-2021-3122-how-we-caught-a-threat-actor-exploiting-ncr-pos-zero-day/...

pyrdp

PyRDP PyRDP is a Python Remote Desktop Protocol RDP Monster-in-the-Middle MITM tool and library. It features a few tools: RDP Monster-in-the-Middle Logs plaintext credentials or NetNTLM hashes used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the...

gitxray

欢迎使用Gitxray Gitxray（Git X-Ray的简称）是一款多功能的GitHub仓库安全工具。它可用于多种用途，包括开源情报（OSINT）和取证分析。gitxray利用公开的GitHub REST API收集原本需要大量手动获取的信息。此外，它还能从非常规位置挖掘信息。...

EternalLiberty

EternalLiberty Description This repository contains all Threat Actor aliases used by different Threat Intelligence companies in their reports. Objectives This allows to find the Threats Actors that you want survey or search in getting the name used by different companies or for attribution of...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator 聚焦于 UNC2452 TTP 概述 本仓库包含一个 PowerShell 模块，用于检测可能指示 UNC2452 及其他威胁行为者活动的痕迹。某些痕迹是“高置信度”的入侵指标，而其他痕迹则属于所谓的“双重用途”痕迹。双重用途痕迹可能与威胁行为者活动有关，也可能与合法功能有关。需要对这些痕迹进行分析和验证。有关 UNC2452 所用技术的详细说明，请参阅我们的博客。 此工具为只读 工具。它不会对 Microsoft 365 环境进行任何更改。 总之，该模块将： 尽最大努力识别需要进一步验证和分析的入侵指标 它 不会 ： 100...

Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix,...

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actors are acquiring expired domains to inherit their website traffic and reputation with an aim to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain...

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web , a browser-centric...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most ...

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access SMA 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the...

The vulnerability of the `tunnel.allowNgrokFreeTierLoopbackBypass` parameter. This vulnerability is exploited by an AI agent named OpenClaw (previously known as ClawdBot or MoltBot), allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of the tunnel.allowNgrokFreeTierLoopbackBypass parameter is related to the AI agent OpenClaw previously ClawdBot or MoltBot. This vulnerability stems from the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to...

Malicious Package

Overview @vpmdhaj/devops-tools is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...

Malicious Package

Overview env-config-manager is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...

Malicious Package

Overview vpmdhaj-opensearch-setup is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...