ThreatActors-TTPs

脅威アクターとランサムウェア - TTPs このリポジトリは、アクティブまたは非アクティブなランサムウェア事業者/グループ やその他の脅威アクター が採用している戦術、技術、手順（TTPs）を、MITRE ATT &CKフレームワークに基づいて研究する際に、企業 や独立した研究者を支援する目的で作成されました。 このコンテンツには、TTPマッピング、活動の履歴 、悪用されたCVE（Common Vulnerabilities and Exposures）の記録が含まれています。さらに、DFIR/CTI分野における コマンド、ツール 、およびアーティファクト調査に有用な場所...

ThreatActors-TTPs

注記：これはCrocodyliからのフォークです - 自分の目的のために追加しているだけです。https://incidentbuddy.ai のgapMATRIXページを動かすために使っています。 脅威アクターとランサムウェア - TTPs このリポジトリは、アクティブまたは非アクティブなランサムウェアオペレーター/グループ やその他の脅威アクター が採用している、MITRE ATT &CKフレームワークに基づく戦術、技術、手順（TTPs）を、企業 や独立研究者が研究するのを支援する目的で作成されました。 このコンテンツには、TTPマッピング、活動の歴史 、悪用されたCVE（Commo...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 はじめに Out-FINcodedCommand は、PowerShell v2.0 以降に対応した PowerShell POC スクリプトであり、FIN 脅威アクターが使用するいくつかの難読化手法を強調するために設計されています。このツールで重点的に扱う難読化手法は以下の通りです。 1. cmd.exe の変数文字/文字列置換機能 2. cmd.exe および powershell.exe の標準入力からのコマンド呼び出し機能 3. 「cmd」と「powershell」を難読化するための環境変数部分文字列機能 インストール...

IOCs

//////////////// ////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // /////////////////////////...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

SupplyChainAttacks

固件供应链攻击 该仓库提供了由 Binarly REsearch 团队发现或调查的、有据可查的固件供应链攻击的精选综合合集。该项目由 Binarly 维护，作为面向网络安全研究人员、专业人士和组织的教育与参考资源，帮助其更好地理解供应链攻陷中使用的攻击向量、战术和方法。 你将在这里找到的内容： 关于知名供应链攻击案例的详细信息 与这些事件相关联的入侵指标（IoC） 帮助防御者主动保护固件供应链组件的检测工具、参考资料和文档 该仓库旨在提升安全意识，并推动主动防御策略的实施，以应对以固件供应链为目标的复杂威胁行为者所带来的日益增长的风险。 ⸻...

CVE-2018-13379

IOC's for CObalt Strike/CVE-2018-13379 所有荣誉归功于 Awake/Arista/https://www.linkedin.com/in/kevin-romano-48071a42/ IOC复制自 DD: https://awakesecurity.com/blog/exploiting-cve-2018-13379-a-case-study-of-threat-actors-exploiting-years-old-cves/...

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect. That risk is no longer...

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

PYSEC-2026-3445

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210

Summary: OpenCTI prior to version 7.260326.0 contains an authorization bypass via the synchronized-upsert: true HTTP header, exploitable by any authenticated user with KNOWLEDGE_KNUPDATE permission. This allows bypassing Confidence Level validation and Object Marking restrictions, enabling attack...

PT-2026-56601

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260326.0 Description An authorization bypass allows authenticated users with KNOWLEDGE KNUPDATE permission to circumvent Confidence Level validation and Object Marking restrictions. This is achieved by injecting the...

Catan and Mouse

Welcome to this week's edition of the Threat Source newsletter. " I do not know everything; still many things I understand." ― Madeleine L'Engle, A Wrinkle in Time " Don't try to comprehend with your mind. Your minds are very limited. Use your intuition." ― Madeleine L'Engle, A Wind in the Door T...

New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis

A previously undocumented Rust-based macOS implant and information stealer has been found to embed a prompt injection payload designed to trick a malware analyst's artificial intelligence AI tools and trick it into aborting or refusing an analysis of the artifact. The malware has been codenamed...

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer

We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application infrastructure for their next foothold...

Reaper macOS Infostealer Abuses Script Editor to Steal Crypto and Passwords

Threat actors are deploying an updated SHub Stealer variant named Reaper that exploits the native macOS Script Editor to bypass OS-level protections and compromise cryptocurrency assets...

CVE-2026-10584

Graph Explorer before 3.0.1 uses an HTTP fallback when certificate files are missing, exposing potential interception of HTTPS requests. The vulnerability affects the proxy component of Graph Explorer and can lead to disclosure of sensitive information. The recommended remediations are to upgrade...