-
Notifications
You must be signed in to change notification settings - Fork 1
/
Events.txt
5441 lines (5441 loc) · 577 KB
/
Events.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
"feedname","timestamp","id","info"
"CIRCL","16/02/2017 21:40:33","1","OSINT - menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations"
"wilbursecurity.com","28/02/2020 18:47:18","2","Interesting Recon Script"
"CIRCL","01/06/2016 07:58:52","3","A Universal Windows Bootkit An analysis of the MBR bootkit referred to as “HDRoot”"
"CIRCL","28/04/2017 19:23:44","4","OSINT - Carbon Paper: Peering into Turla’s second stage backdoor"
"CIRCL","28/08/2017 15:24:36","5","OSINT - New Arena Crysis Ransomware Variant Released"
"CIRCL","08/03/2016 01:28:45","6","OSINT - The Connections Between MiniDuke, CosmicDuke and OnionDuke"
"CIRCL","16/06/2017 13:37:38","7","M2M - Jaff 2017-06-14 : ""Emailing: 123456789"" - ""123456789.ZIP"""
"CIRCL","03/03/2019 17:43:54","8","OSINT - The Supreme Backdoor Factory"
"CthulhuSPRL.be","15/12/2015 08:26:37","9","OSINT The Casino Malvertising Campaign by MalwareBytes"
"CIRCL","28/10/2018 09:56:15","10","OSINT - CoalaBot: http Ddos Bot"
"CIRCL","16/02/2019 22:21:59","11","VMRay Analyzer Report for Sample #252574 (related amf-fr.org)"
"CthulhuSPRL.be","24/11/2014 10:41:51","12","OSINT Evil Bunny: Suspect #4"
"CthulhuSPRL.be","02/07/2016 19:19:32","13","OSINT H-Worm IOCs from WooYun"
"CIRCL","06/09/2018 13:52:32","14","OSINT - New Bip Dharma Ransomware Variant Released"
"CIRCL","23/08/2019 10:59:37","15","OSINT - Trojan downloader found on Google Play by @Maler360"
"CIRCL","16/04/2018 08:52:30","16","Vurten Ransomware"
"CIRCL","15/09/2016 08:42:11","17","Malspam 2016-09-15 (.wsf in .zip) - campaign: ""Documents Requested"""
"CIRCL","01/09/2016 08:09:59","18","Malspam 2016-09-01 (.js in .zip) - campaign: ""flight tickets"""
"NCSC-NL","07/10/2016 15:42:57","19","Dridex IoC's"
"CIRCL","11/01/2017 22:54:25","20","OSINT - Second Wave of Shamoon 2 Attacks Identified"
"CIRCL","12/04/2016 07:59:41","21","Rokku Ransomware shows possible link with Chimera"
"CIRCL","17/09/2018 21:23:22","22","OSINT - Familiar Feeling A Malware Campaign Targeting the Tibetan Diaspora Resurfaces"
"CIRCL","24/06/2018 07:21:51","23","OSINT - Tick Group Weaponized Secure USB Drives to Target Air-Gapped Critical Systems"
"CIRCL","27/12/2019 12:07:05","24","OSINT - The #BronzeUnion/#LuckyMouse/#APT27 infection checker"
"CIRCL","03/05/2018 18:37:19","25","OSINT - New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia"
"CthulhuSPRL.be","18/08/2016 13:32:42","26","OSINT Shakti Trojan: Document Thief by Malwarebytes"
"Synovus Financial","05/05/2020 17:06:21","27","powerpool-malware-exploits-zero-day-vulnerability"
"CIRCL","23/05/2016 07:21:47","28","Locky of the day (20160520)"
"CIRCL","04/07/2017 14:43:07","29","M2M - Locky 2017-06-26 : Affid=3 : ""12_Invoice_3456"" - ""001_4321.zip"""
"CIRCL","24/04/2017 10:04:19","30","OSINT - Lifting the lid on Sednit: A closer look at the software it uses"
"CIRCL","10/04/2018 21:13:54","31","OSINT - PUBG Ransomware Decrypts Your Files If You Play PlayerUnknown's Battlegrounds"
"CIRCL","09/05/2017 19:26:18","32","OSINT - EPS Processing Zero-Days Exploited by Multiple Threat Actors"
"CthulhuSPRL.be","05/11/2015 16:28:17","33","OSINT Gaza cybergang, where’s your IR team? by Kaspersky"
"CIRCL","09/09/2019 15:27:32","34","SectorJ04 Group’s Increased Activity in 2019"
"CIRCL","25/08/2016 09:24:32","35","Malspam 2016-08-25 (.js in .zip) - campaign: ""Contract"""
"CIRCL","25/03/2016 11:13:08","36","OSINT - PETYA Crypto-ransomware Overwrites MBR to Lock Users Out of Their Computers"
"CthulhuSPRL.be","16/09/2015 13:19:34","37","OSINT The Shade Encryptor: a Double Threat by Kaspersky"
"CIRCL","30/01/2019 21:03:39","38","OSINT - Cisco Job Posting Targets Korean Candidates"
"CIRCL","02/02/2018 04:00:35","39","OSINT - Smominru Monero mining botnet making millions for operators"
"CIRCL","18/05/2017 12:30:40","40","Invoice ###### 05/17/2017 from dontreply@random"
"CIRCL","17/07/2019 06:29:33","41","OSINT - Turla renews its arsenal with Topinambour"
"VK-Intel","05/05/2020 16:53:10","42","2019-01-22: Emotet->TrickBot"
"CIRCL","02/03/2017 09:45:22","43","OSINT - Google Play Apps Infected with Malicious IFrames"
"CIRCL","25/05/2016 19:57:30","44","MalSpam - Locky - 2016-05-25 (.js in .zip)"
"CIRCL","06/02/2017 18:51:30","45","OSINT - ikittens: iranian actor resurfaces with malware for mac (macdownloader)"
"CIRCL","14/09/2018 13:20:10","46","OSINT - old njRAT activity"
"CIRCL","15/11/2016 08:02:13","47","OSINT - Microsoft Word Intruder 8 Adds Support for Flash Vulnerability CVE-2016-4117"
"CIRCL","06/09/2016 13:27:03","48","Malspam 2016-09-06 (.wsf in .zip) - campaign: ""Invoice INV[x]"""
"CIRCL","26/04/2016 12:23:49","49","Malspam (2016-04-26) - Dridex botnet 122"
"CthulhuSPRL.be","03/11/2015 17:34:17","50","OSINT Dyre Malware Campaigners Innovate with Distribution Techniques by ProofPoint"
"CIRCL","19/09/2016 15:48:50","51","OSINT - Malicious Macros Add Sandbox Evasion Techniques to Distribute New Dridex"
"CIRCL","30/04/2018 15:22:15","52","OSINT - On the Economic Significance of Ransomware Campaigns: A Bitcoin Transactions Perspective"
"CIRCL","31/10/2017 17:09:47","53","Suspicious domains extrapolated from fake Microsoft scammer domain"
"CIRCL","26/10/2018 14:58:57","54","OSINT - New Backup Cryptomix Ransomware Variant Actively Infecting Users"
"CIRCL","16/09/2016 08:25:55","55","Malspam 2016-09-15 (.js in .zip) - campagin: ""Booking confirmation"""
"CIRCL","01/10/2018 14:47:22","56","OSINT - Matrix Ransomware Spreads to Other PCs Using Malicious Shortcuts"
"CIRCL","17/03/2016 16:47:21","57","Malspam (2016-03-17) - Dridex (122), Locky"
"Synovus Financial","03/07/2018 14:39:23","58","Clipboard CryptoCoin Hijacker"
"CIRCL","25/08/2017 12:50:52","59","OSINT - WAP-billing Trojan-Clickers on rise"
"CthulhuSPRL.be","22/02/2017 11:05:19","60","OSINT APT Volatile Cedar APT yara rules by Florian Roth"
"CIRCL","24/03/2016 17:25:02","61","OSINT - Petya Ransomware"
"CIRCL","29/01/2019 15:03:55","62","2019-01-28: APT28 XTunnel Backdoor"
"CthulhuSPRL.be","18/08/2016 15:06:16","63","OSINT Bad News Bears - Panda Banker Starts Looking More Like a Grizzly by ProofPoint"
"CIRCL","05/12/2017 04:00:30","64","OSINT - Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions"
"CIRCL","19/09/2018 06:25:32","65","OSINT - Iron Cybercrime Group Under The Scope"
"CIRCL","17/03/2017 15:08:57","66","Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor!"
"CIRCL","28/06/2016 07:34:24","67","OSINT - Retefe banking Trojan targets UK banking customers"
"CIRCL","17/06/2018 13:46:47","68","Malware Analysis Report (AR18-165A) MAR-10135536-12 – North Korean Trojan: TYPEFRAME"
"CIRCL","12/04/2016 08:02:01","69","OSINT - New Locky Variant Implements Evasion Techniques"
"CIRCL","09/11/2017 22:14:53","70","M2M - Locky 2017-11-07 : Affid=3, offline, "".asasin"" : ""Invoice #123456789,"" - ""987654321_11_07_2017_12_34_56.doc"""
"CIRCL","03/08/2018 08:05:35","71","OSINT - Attacks on industrial enterprises using RMS and TeamViewer"
"CIRCL","21/10/2017 13:06:50","72","OSINT - JadeRAT mobile surveillanceware spikes in espionage activity"
"CIRCL","16/08/2016 15:32:28","73","Malspam 2016-08-16 (.wsf in .zip) - campaign: 'Blank 2'"
"CthulhuSPRL.be","28/11/2014 09:23:31","74","Expansion based on pDNS + whois from OSINT Roaming tiger by Anton Cherepanov from ESET"
"CIRCL","16/03/2016 15:29:10","75","OSINT - Malicious iBanking application with new uninstall countermeasures"
"CIRCL","02/05/2016 08:59:26","76","OSINT - MULTIGRAIN – Point of Sale Attackers Make an Unhealthy Addition to the Pantry"
"CIRCL","09/11/2017 14:13:12","77","M2M - Locky 2017-11-03 : Affid=3, offline, "".asasin"" : ""12345678.doc"""
"CIRCL","28/02/2017 17:11:56","78","OSINT - Android malware on the rise"
"CthulhuSPRL.be","18/08/2016 13:19:56","79","OSINT Shark Ransomware: Ransomware as a service"
"CIRCL","18/08/2016 13:49:24","80","Malspam 2016-08-18 (.wsf in .zip) - campaign: ""Emailing: Label"""
"Synovus Financial","05/06/2018 20:52:55","81","Phishing Domains"
"CthulhuSPRL.be","22/06/2017 21:33:13","82","OSINT Regin samples shared by VirusShare"
"CIRCL","24/03/2016 17:49:37","83","OSINT - Malware is being signed with multiple digital certificates to evade detection"
"CIRCL","30/09/2016 08:49:47","84","Malspam 2016-09-29 (.xls) - campaign: ""Receipt"""
"CthulhuSPRL.be","16/02/2015 09:17:55","85","OSINT MSRT February update from Microsoft"
"CIRCL","12/06/2019 13:43:53","86","OSINT - ThreatHunting/India/"
"MalwareMustDie","20/04/2020 09:00:10","87","Hajime Linux IoT botnet's P2P nodes (activity since Jan 2020)"
"CIRCL","15/05/2017 07:33:43","88","OSINT - Jaff Ransomware: Player 2 Has Entered The Game"
"CIRCL","30/05/2016 09:40:09","89","Malspam - 2016-05-27 - Locky - .docm"
"CIRCL","08/05/2016 09:48:44","90","Fake scan campaings (20160505 - 20160507) using docm - Dridex"
"CIRCL","04/09/2017 15:27:46","91","OSINT - Emotet Trojan Acts as Loader, Spreads Automatically"
"CIRCL","27/11/2018 18:09:14","92","OSINT - DNSpionage Campaign Targets Middle East"
"CIRCL","23/09/2018 19:09:06","93","OSINT - Poison Ivy Group and the Cyberespionage Campaign Against Chinese Military and Goverment"
"CIRCL","01/12/2016 12:09:47","94","OSINT - New SmsSecurity Variant Roots Phones, Abuses Accessibility Features and TeamViewer"
"CIRCL","07/09/2016 10:44:52","95","Webshells - 2016-04-14 - origin: pastebin.com/Fev3n8SG"
"CthulhuSPRL.be","14/12/2015 23:58:02","96","OSINT IOC from ponmocup malware"
"Synovus Financial","05/05/2020 17:07:41","97","US-CERT Alert (TA18-149A) HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm"
"CIRCL","08/03/2016 01:26:46","98","OSINT - THE DUKES 7 years of Russian cyberespionage"
"MalwareMustDie","12/03/2020 22:24:50","99","Rhombus - Linux DDoS botnet aims VPS & IoT, w/persistence & dropper"
"CIRCL","20/02/2017 20:18:19","100","OSINT - The Rise of Dridex and the Role of ESPs"
"CIRCL","27/05/2016 12:59:36","101","OSINT - Turbo Twist: Two 64-bit Derusbi Strains Converge"
"Synovus Financial","30/05/2018 17:27:15","102","""TrickBot"" and ""IcedID"" Botnet IOCs"
"CthulhuSPRL.be","18/03/2018 22:50:02","103","Regin Scanner"
"CIRCL","13/02/2017 17:24:57","104","OSINT - Fileless attacks against enterprise networks"
"CIRCL","11/04/2018 15:57:01","105","OSINT - IcedID Banking Trojan Teams up with Rovnix for Distribution"
"MiSOC","17/06/2020 02:40:08","106","Emotet in Depth TTP 10-07-19"
"CthulhuSPRL.be","22/12/2015 15:36:27","107","OSINT Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites by Citizen Labs"
"CIRCL","23/10/2017 16:38:13","108","M2M - Locky 2017-09-25 : Affid=3, offline, "".ykcol"" : ""12_Invoice_3456"" - ""001_1234.7z"""
"CIRCL","27/03/2019 12:07:59","109","OSINT - Operation ShadowHammer"
"CIRCL","17/12/2018 21:20:53","110","OSINT - Password Protected ZIP with Maldoc"
"CIRCL","14/09/2017 15:57:06","111","M2M - Locky 2017-09-14 : Affid=3, "".lukitus"" : ""Copy of Invoice 12345"" - /invoice.html links"
"CIRCL","11/11/2017 10:24:38","112","M2M - Locky 2017-11-09 : Affid=3, offline, "".asasin"" : ""Documents"" - ""ABY001234.doc"""
"CthulhuSPRL.be","18/08/2016 13:10:08","113","OSINT Aveo Malware Family Targets Japanese Speaking Users by Palo Alto networks Unit 42"
"CIRCL","30/12/2016 12:55:05","114","OSINT - Packrat: Seven Years of a South American Threat Actor"
"CthulhuSPRL.be","25/08/2015 09:26:13","115","OSINT Tinted CVE decoy spearphising attempt on Central Bank of Armenia employees by BlueCoat"
"CIRCL","01/03/2017 17:01:58","116","OSINT - Malware Leveraging PowerSploit"
"CIRCL","09/03/2018 11:46:53","117","OSINT - Apache SOLR: the new target for cryptominers"
"CIRCL","04/07/2016 14:17:21","118","Malspam 2016-07-04 (testrun, subject 'Scanned image'), .docm"
"CIRCL","08/06/2020 08:59:41","119","OSINT - TA505 IoC - 2020-06-06"
"CIRCL","10/10/2020 01:34:34","120","OSINT - Repository containting orignal and decompiled files of TRISIS/TRITON/HATMAN malware"
"CIRCL","03/10/2016 14:20:04","121","Malspam 2016-10-03 (.xls) - campaign: ""[Scan]"""
"CthulhuSPRL.be","21/05/2015 14:38:34","122","OSINT Trojanized PuTTY Software by Cisco CSIRT"
"CthulhuSPRL.be","16/01/2018 14:46:49","123","OSINT Phantom of the Opaera: New KASPERAGENT Malware Campaign by ThreatConnect"
"CIRCL","09/06/2017 07:54:50","124","M2M - Jaff 2017-06-06 : ""Order"" - ""MX-2310U_20170606_123456.pdf"""
"CIRCL","10/02/2017 11:14:32","125","OSINT - Shell Crew Variants Continue to Fly Under Big AV’s Radar"
"CIRCL","10/11/2016 22:21:36","126","OSINT - Floki Bot and the stealthy dropper"
"CIRCL","26/05/2017 14:48:40","127","Jaff 2017-05-26 : ""Scanned Image from a Xerox WorkCentre"" - ""Scan_0012_123456789.zip"""
"CIRCL","15/12/2016 09:27:14","128","Malspam 2016-12-15 (.js in .zip) - campaign: ""Amount Payable"""
"CIRCL","04/10/2017 09:55:48","129","M2M - Locky 2017-10-02 : Affid=3, offline, "".ykcol"" : ""Emailed Invoice - 123456"" - ""I_123456.7z"""
"CthulhuSPRL.be","22/06/2017 21:18:42","130","OSINT Potao Express samples from contagiodump"
"CIRCL","29/01/2019 14:19:12","131","2019-01-28: Turla Kazuar RAT"
"CIRCL","26/09/2017 21:06:46","132","OSINT - Striking Oil: A Closer Look at Adversary Infrastructure"
"CIRCL","06/11/2019 21:00:02","133","OSINT - BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0"
"CIRCL","24/03/2016 21:20:46","134","OSINT - Evolution of SamSa Malware Suggests New Ransomware Tactics In Play"
"VK-Intel","15/01/2019 21:44:35","135","2019-01-10: North Korea Lazarus Targeting REDBANC"
"CIRCL","13/01/2017 11:38:43","136","OSINT - Targeted Threat Leads to Keylogger via Fake Silverlight Update"
"CIRCL","22/12/2018 09:13:28","137","Malicious ELF binary (Mirai) - 2018-12-22 (collected on a router)"
"CIRCL","23/03/2017 11:01:17","138","OSINT - Hunt Case Study: Hunting Campaign Indicators on Privacy Protected Attack Infrastructure"
"CthulhuSPRL.be","22/06/2017 21:26:37","139","OSINT APT 30 and the Mechanics of a Long-Running Cyber Espionage Operation by FireEye"
"CIRCL","06/07/2016 13:06:51","140","Malspam 2016-07-05 (subject 'Scanned image'), .docm"
"CIRCL","10/02/2018 04:00:54","141","OSINT - WORK Cryptomix Ransomware Variant Released"
"CIRCL","04/10/2018 10:01:50","142","OSINT - Indicators of Compromise for Malware used by APT28"
"CIRCL","29/11/2017 08:47:50","143","OSINT - ROKRAT Reloaded"
"CIRCL","31/03/2017 07:49:44","144","OSINT - Part I. Russian APT - APT28 collection of samples including OSX XAgent"
"The DFIR Report","21/06/2020 13:25:57","145","Dharma Ransomware Event"
"CIRCL","22/06/2016 12:57:01","146","Malspam (2016-06-22) - .js in .zip - Locky is back"
"CIRCL","12/10/2017 20:45:04","147","M2M - Locky 2017-10-09 : Affid=3, offline, "".ykcol"" : ""Invoice IP1234567"" - ""Invoice-IP1234567.7z"""
"CIRCL","19/01/2017 08:53:47","148","OSINT - Uncovering the Inner Workings of EyePyramid"
"CIRCL","05/12/2018 11:18:18","149","MAR-10219351.r1.v2 (SamSam ransomware)"
"CthulhuSPRL.be","18/08/2016 15:05:36","150","OSINT Android Marcher: Continuously Evolving Mobile Malware by Zscaler"
"CIRCL","27/04/2016 14:18:57","151","OSINT - RuMMS: The Latest Family of Android Malware Attacking Users in Russia Via SMS Phishing"
"CIRCL","03/10/2017 09:44:13","152","Malspam 2017-10-03"
"CIRCL","14/11/2018 20:52:32","153","OSINT - Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware"
"CthulhuSPRL.be","15/06/2015 08:25:43","154","OSINT Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website by Palo Alto Unit 42"
"CIRCL","16/01/2018 04:00:30","155","OSINT - Experts analyzed an Advanced ""all in memory"" CryptoWorm"
"CthulhuSPRL.be","18/08/2016 11:04:01","156","OSINT SSH bruteforce logs from burberry user on AlienVault OTX"
"CIRCL","02/02/2017 14:13:44","157","OSINT - Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society"
"CthulhuSPRL.be","22/06/2017 21:03:38","158","OSINT OrcaRAT - A whale of a tale blog post by PWC"
"Synovus Financial","31/07/2018 17:29:51","159","Massive Malvertising Campaign Discovered Attempting 40,000 Infections per Week"
"Synovus Financial","22/05/2018 17:03:10","160","TrickBot pir4 loader config"
"CIRCL","27/06/2017 22:47:00","161","OSINT - New Variant of Petya Ransomware Spreading Like Wildfire"
"CIRCL","26/01/2017 23:48:01","162","OSINT - Dridex Banking Trojan Returns, Leverages New UAC Bypass Method"
"CIRCL","29/09/2017 14:07:44","163","M2M - Locky 2017-09-27 : Affid=3, offline, "".ykcol"" : ""Scanned image from MX-2600N"" - ""20170927_123456.7z"""
"CIRCL","13/02/2016 15:20:40","164","OSINT - Hunting for Malware with Machine Learning"
"CIRCL","29/09/2017 14:20:16","165","M2M - Locky 2017-09-29 : Affid=3, offline, "".ykcol"" : ""Invoice"" - ""123456.7z"""
"CthulhuSPRL.be","29/10/2015 08:04:01","166","OSINT Trojan.Win32.Banker.NWT by AlienVault and Telus"
"CIRCL","23/09/2019 08:43:00","167","OSINT - Emotet Updated C2 Info 9/20"
"wilbursecurity.com","12/03/2020 01:22:58","168","Harma and Odveta Ransomware"
"CIRCL","10/10/2020 08:36:28","169","IoT malware - Gafgyt.Gen28 (active) - 20190220 - 20190222"
"CIRCL","15/10/2017 17:16:42","170","M2M - Locky 2017-10-06 : Affid=3, offline, "".ykcol"" : ""Your Remittance Advice"" - ""12345 Remittance.7z"""
"CthulhuSPRL.be","18/08/2016 12:57:51","171","OSINT TorrentLocker Ransomware Email IoCs 8/16/2016 by neonPrimeTime user on AlienVault OTX"
"CIRCL","08/09/2017 16:21:26","172","M2M - new locky"
"CIRCL","08/05/2018 13:35:57","173","OSINT - Lojack Becomes a Double-Agent"
"CIRCL","03/02/2017 22:42:04","174","OSINT - Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX"
"CIRCL","24/06/2016 09:25:47","175","Malspam 2016-06-23 (Locky)"
"CIRCL","08/09/2017 12:45:24","176","OSINT - Cryptocurrency Miner Uses WMI and EternalBlue To Spread Filelessly"
"Synovus Financial","03/01/2019 14:04:43","177","Phishing Sites"
"CIRCL","11/04/2016 13:58:39","178","OSINT - Mobile Devices Used to Execute DNS Malware Against Home Routers"
"CIRCL","12/06/2017 14:07:09","179","M2M - Trickbot 2017-06-12 : mac1 : Facture N 1234 du 12/06/2017 - ""FACTURE_1234.zip"""
"CIRCL","01/09/2016 15:35:16","180","Malware Posing as Human Rights Organizations and Commercial Software Targeting Iranians, Foreign Policy Institutions and Middle Eastern Countries (ExtremeDownloader and Strealer)"
"NCSC-NL","28/04/2020 14:56:53","181","Kaspersky Lab: Spearphishing attack hits industrial companies"
"CIRCL","07/10/2016 08:37:33","182","Malspam 2016-10-07 (.js in .zip) - campaign: ""wrong paychecks"""
"CIRCL","16/03/2016 15:45:31","183","Dridex of the day (2016-03-16) - botnet 120"
"CIRCL","07/01/2017 15:12:19","184","OSINT - The curious case of a Sundown EK variant dropping a Cryptocurrency Miner"
"CIRCL","25/09/2017 12:44:17","185","M2M - Locky 2017-09-19 : Affid=3, offline, "".ykcol"" : ""Emailing - 10008001234"" - ""10008001234.7z"""
"CIRCL","17/11/2017 13:40:35","186","OSINT - New Malware with Ties to SunOrcal Discovered"
"CIRCL","12/03/2018 09:46:43","187","OSINT - Turla Nautilus Implant"
"CIRCL","10/12/2019 10:24:40","188","OSINT - Dans l’œil de notre CyberSOC : la campagne malspam Aggah diversifie ses outils"
"CIRCL","09/05/2019 16:22:57","189","OSINT - keepass(dot)com spreading malware acting as the official site for KeePass password manager. Download for .dmg and .exe files are available on the site."
"CIRCL","08/09/2016 13:48:35","190","Malspam 2016-09-08 (.wsf in .zip) - campaign: ""New voice mail message from"""
"CthulhuSPRL.be","27/05/2016 11:59:19","191","OSINT Introducing Hi-Zor RAT by Fidelis"
"CIRCL","04/05/2018 14:45:29","192","OSINT - Who's who in the zoo. Cyberespionage operation targets android users in the Middle East."
"CIRCL","01/09/2016 13:49:10","193","Malspam 2016-09-01 (.wsf in .zip) - campaign: ""Please find attached invoice no:"""
"CIRCL","03/02/2017 22:06:05","194","OSINT: Malicious software targeting financial sector internals"
"CIRCL","28/09/2017 21:25:12","195","OSINT - Threat Actors Target Government of Belarus Using CMSTAR Trojan"
"CthulhuSPRL.be","18/08/2015 09:39:34","196","OSINT OSX/Pintsized Backdoor Additional Details by Zataz / Eric Romang"
"CIRCL","08/05/2019 16:20:32","197","OSINT - Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak"
"CIRCL","05/02/2017 13:26:57","198","OSINT - Doctor Web detects several thousand infected Linux devices Linux.Proxy.10"
"CIRCL","05/07/2017 21:51:23","199","OSINT - The MeDoc Connection"
"CthulhuSPRL.be","02/02/2016 09:17:28","200","OSINT Puttering into the Future...by Cylance"
"CIRCL","28/02/2017 10:13:17","201","OSINT - The Gamaredon Group Toolset Evolution"
"CIRCL","21/06/2017 09:50:38","202","Malspam 2017-06-21 'Job Application'"
"CthulhuSPRL.be","20/11/2015 15:35:30","203","OSINT Enrichment on OSINT - STRONTIUM: A profile of a persistent and motivated adversary"
"CIRCL","01/06/2019 10:26:08","204","Linux server infection with coinminers (derived from original post with iptables rules)"
"Synovus Financial","05/06/2018 20:54:01","205","Phishing Domains"
"CIRCL","25/09/2017 12:40:45","206","M2M - Locky 2017-09-20 : Affid=3, offline, "".ykcol"" : ""New voice message..."" - ""msg0321.7z"""
"CIRCL","02/06/2019 08:33:22","207","OSINT - 10 years of virtual dynamite: A high-level retrospective of ATM malware"
"CIRCL","28/07/2016 08:15:14","208","OSINT - The Mad Max DGA"
"CthulhuSPRL.be","22/06/2017 21:12:07","209","What's in a server name (on APT28/Sofacy) by ThreatConnect"
"CthulhuSPRL.be","16/12/2014 09:28:40","210","OSINT Fidelis Threat Advisory #1014 ""Bots, Machines, and the Matrix"""
"CIRCL","19/07/2016 14:30:34","211","Malspam 2016-07-19 .wsf (campaign: ""new invoice"")"
"CIRCL","05/09/2017 20:29:56","212","OSINT - Jimmy Nukebot: from Neutrino with love"
"CIRCL","13/06/2018 13:09:19","213","OSINT - PLEAD Downloader Used by BlackTech"
"CIRCL","04/10/2017 09:51:18","214","OSINT - Evidence Aurora Operation Still Active Part 2: More Ties Uncovered Between CCleaner Hack & Chinese Hackers"
"CthulhuSPRL.be","22/06/2017 21:18:30","215","OSINT New activity of the Blue Termite APT by AlienVault"
"CIRCL","12/09/2017 13:02:51","216","Malspam 2017-09-12 - 'Your Amazon.co.uk order' phishing"
"CIRCL","06/12/2016 23:31:04","217","OSINT - Readers of popular websites targeted by stealthy Stegano exploit kit hiding in pixels of malicious ads"
"CIRCL","24/11/2016 08:59:51","218","OSINT - Fareit Spam: Rocking Out to a New File Type"
"CIRCL","21/07/2017 15:35:14","219","OSINT - Rurktar - Spyware under Construction"
"CthulhuSPRL.be","26/01/2015 11:52:09","220","OSINT Operation Double Tap from FireEye"
"CIRCL","05/04/2019 10:35:09","221","OSINT - Hancitor domains"
"CthulhuSPRL.be","13/10/2014 09:17:38","222","OSINT Democracy in Hong Kong Under Attack blog post from Volexity (Steven Adair)"
"CIRCL","14/09/2016 14:06:04","223","Malspam 2016-09-14 (.js in .zip) - campaign: ""Delivery Confirmation"""
"CIRCL","18/01/2018 17:05:48","224","M2M - ""..doc"" 2017-12-01 : ""12_Invoice_3456"" - ""I_4321.7z"""
"CIRCL","17/05/2016 17:17:00","225","OSINT - TWO BYTES TO $951M (SWIFT payment system abuse)"
"CIRCL","25/10/2017 09:20:05","226","Bad Rabbit (via Pastebin)"
"CIRCL","22/10/2016 09:19:03","227","OSINT - The new .LNK between spam and Locky infection"
"CthulhuSPRL.be","05/03/2015 15:43:26","228","OSINT Threat Spotlight: Angler Lurking in the Domain Shadows by Cisco Talos group"
"CIRCL","11/03/2016 16:45:30","229","Malspam (2016-03-11) - Locky"
"CthulhuSPRL.be","15/04/2015 16:12:41","230","OSINT Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets by Palo Alto Unit42"
"CIRCL","21/12/2017 04:00:23","231","OSINT - Malspam pushing Locky ransomware tries HoeflerText notifications for Chrome and FireFox"
"CIRCL","05/08/2017 21:34:04","232","OSINT - Tale of the Two Payloads – TrickBot and Nitol"
"CIRCL","30/01/2017 20:19:47","233","OSINT - Saga 2.0 (Sage 2.0) comes with IP Generation Algorithm (IPGA)"
"CIRCL","02/01/2017 09:12:26","234","OSINT - BlackNurse Denial of Service Attack"
"CIRCL","27/06/2016 16:41:13","235","Malspam 2016-06-27"
"CIRCL","26/10/2018 10:07:39","236","OSINT - Multi-stage malware sneaks into Google Play"
"CIRCL","07/01/2016 14:10:25","237","OSINT - Android-based Smart TVs Hit By Backdoor Spread Via Malicious App"
"CIRCL","09/09/2016 06:58:03","238","Malspam 2016-09-08 (.wsf in .zip) - campaign: icloud.com"
"CIRCL","12/09/2017 15:45:14","239","M2M - Locky 2017-09-12 : Affid=3, "".lukitus"" : ""Your Amazon.co.uk order..."" / AmazonSignIn.html links"
"laskowski-tech.com","28/06/2020 00:51:28","240","Ostap Maldoc Samples"
"CIRCL","02/08/2017 11:18:52","241","OSINT - FIN7/Carbanak threat actor unleashes Bateleur JScript backdoor"
"CIRCL","10/07/2020 14:26:48","242","Soft Cell case - Related indicators from correlations"
"CIRCL","09/06/2017 11:56:13","243","M2M - Trickbot 2017-06-09 : mac1 : ""Facture AA-123-RR"" / ""Copy Credit Note"" - ""1234567.zip"""
"CIRCL","20/12/2017 04:00:44","244","OSINT - Operation Dragonfly Analysis Suggests Links to Earlier Attacks"
"CIRCL","25/09/2017 12:46:25","245","M2M - Locky 2017-09-20 : Affid=3, offline, "".ykcol"" : ""Status of invoice A2171234-56"" - ""A2171234-56.rar"""
"CIRCL","02/07/2020 01:57:39","246","Shamoon potential samples"
"CIRCL","02/05/2016 14:51:44","247","OSINT - Prince of Persia: Infy Malware Active In Decade of Targeted Attacks"
"CIRCL","12/10/2017 18:31:22","248","M2M - Locky Affid=3, "".asasin""/Trickbot ""mac1"" 2017-10-05 : ""Invoice INV0000123"" - ""Invoice INV0000123.7z"""
"CIRCL","25/05/2017 12:47:11","249","OSINT - Tainted Leaks: Disinformation and Phishing With a Russian Nexus"
"CIRCL","09/06/2020 08:10:50","250","OSINT - IQ-FA006:Dridex XLS Documents with Fancy Lures"
"CthulhuSPRL.be","28/05/2015 09:01:32","251","OSINT Cylance SPEAR Team: A Threat Actor Resurfaces from Cylance"
"CIRCL","02/06/2016 15:49:32","252","OSINT - IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems"
"CIRCL","30/11/2018 13:10:06","253","OSINT - Hancitor active again yith new macro - IoCs"
"CIRCL","03/05/2018 18:38:11","254","OSINT - Maktub ransomware: possibly rebranded as Iron"
"CIRCL","23/03/2017 10:29:19","255","OSINT - Winnti Abuses GitHub for C&C Communications"
"CIRCL","12/06/2017 09:49:22","256","OSINT - Dvmap: the first Android malware with code injection"
"CIRCL","29/09/2017 14:06:37","257","M2M - Locky Affid=3/Trickbot ""mac1"" 2017-09-29 : ""Voice Message from ..."" - ""/voicemsg.html"" links"
"CIRCL","11/01/2019 14:58:10","258","OSINT - DarkHydrus is launching attacks to targets in Middle East"
"CIRCL","08/09/2017 16:18:15","259","M2M - Locky 2017-09-06 : Affid=3 : ""Voice Message from 011234567890 - name unavailable"" - /message.html links"
"CIRCL","14/07/2017 19:54:53","260","M2M - Encrypted Docx Campaign"
"CIRCL","09/08/2018 14:52:50","261","OSINT - CYBER THREATSCAPE REPORT 2018 - MIDYEAR CYBERSECURITY RISK REVIEW"
"CIRCL","09/09/2016 16:42:43","262","Malspam 2016-09-09 (.wsf in .zip) - campaign: ""Documents Requested"""
"CIRCL","09/11/2017 21:21:04","263","M2M - Locky Affid=3, "".asasin"" 2017-11-02 : ""Scan"" - ""Scan00123.doc"""
"CIRCL","11/04/2016 08:10:59","264","OSINT - Locky Ransomware Domains – Followup Analysis Uncovers 130 New Indicators"
"CIRCL","09/04/2019 15:53:34","265","OSINT - Mirai Compiled for New Processors Surfaces in the Wild"
"CIRCL","11/06/2019 08:56:47","266","OSINT - The Elderwood Project"
"CIRCL","28/03/2016 09:23:37","267","OSINT - Malware Employs PowerShell to Infect Systems"
"The DFIR Report","30/04/2020 12:27:24","268","Trickbot to Pyxie"
"CIRCL","15/11/2016 11:43:55","269","OSINT - HackingTeam back for your Androids, now extra insecure!"
"CIRCL","22/10/2017 14:01:52","270","OSINT - US CERT TA17-293A report - renamed PsExec execution (sigma/SIEM ruleset)"
"CIRCL","14/05/2017 15:41:53","271","OSINT - Massive outbreak of ransomware variant infects large amounts of computers around the world"
"CIRCL","04/05/2017 13:23:07","272","OSINT - A Mole exposing itself to sunlight Snake: Coming soon in Mac OS X flavour"
"CIRCL","16/01/2018 04:00:22","273","OSINT - Sednit espionage group now using custom exploit kit"
"CthulhuSPRL.be","08/12/2014 09:41:22","274","OSINT Assorted IOCs associated to Andromeda restlesz.su domain"
"CIRCL","04/04/2017 19:54:06","275","OSINT - An Investigation of Chrysaor Malware on Android"
"VK_INTEL_EVIL","05/05/2020 17:12:02","276","2019-07-18: Newer ""PoSeidon"" aka ""FindPOS"" aka ""FindStr"" 15.10 Point-of-Sale Malware"
"CIRCL","12/07/2017 16:08:00","277","OSINT - Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind"
"Synovus Financial","13/03/2020 09:34:51","278","Emotet - 5/17/2018"
"FOXIT-CERT","19/07/2016 09:59:34","279","OSINT - Mofang: A politically motivated information stealing adversary"
"CthulhuSPRL.be","25/09/2015 15:57:51","280","OSINT An Update on Nuclear (Reverse) Engineering by Zscaler"
"CIRCL","16/03/2016 15:00:27","281","OSINT - Operation Transparent Tribe"
"CIRCL","11/08/2017 15:01:36","282","OSINT - APT28 Targets Hospitality Sector, Presents Threat to Travelers"
"CIRCL","16/12/2016 07:47:25","283","OSINT - One, if by email, and two, if by EK: The Cerbers are coming!"
"CthulhuSPRL.be","02/07/2016 18:38:57","284","Pivot around IP 193.109.68.87 (from ns1.carbon2u.com) - potential Sofacy"
"CthulhuSPRL.be","15/04/2016 19:54:40","285","OSINT New Discovery: Ties Between Corebot and Darknet Crypt Service by Damballa"
"CthulhuSPRL.be","17/08/2016 14:28:57","286","OSINT EFF Report Operation Manul"
"CIRCL","01/05/2019 08:01:15","287","OSINT - Kernel Mode Malicious Loader"
"CIRCL","11/12/2019 10:19:39","288","OSINT - trickbot cashcore hashes"
"CIRCL","16/06/2017 13:38:39","289","M2M - #LokiBot goes with SWIFT theme"
"CthulhuSPRL.be","09/10/2015 18:12:12","290","OSINT Expansion on hacking team VPS IPs using PassiveTotal by Brandon Dixon"
"CIRCL","16/03/2016 16:44:41","291","Potential SpamBots (2016-03-16)"
"CIRCL","20/11/2019 22:07:04","292","OSINT - Trojan.ElectrumDoSMiner - a Trojan responsible for the denial of service attacks against Electrum bitcoin wallets."
"MalwareMustDie","17/04/2020 12:32:27","293","Linux/Mirai-Fbot - New variant with strong infection spreading rate"
"CIRCL","28/08/2017 15:23:55","294","OSINT - Ursnif variant found using mouse movement for decryption and evasion"
"CIRCL","30/09/2016 15:27:02","295","Malspam 2016-09-30 (.doc) - campaign: ""Receipt"""
"CthulhuSPRL.be","22/06/2017 21:12:20","296","OSINT DarkHotel samples at WooYun"
"CIRCL","14/05/2017 15:41:25","297","OSINT - Player 3 Has Entered the Game: Say Hello to 'WannaCry'"
"CIRCL","27/09/2017 16:17:26","298","M2M - Locky 2017-09-26 : Affid=3, offline, "".ykcol"" : ""Invoice PIS1234567"" - ""InvoicePIS1234567.7z"""
"CIRCL","28/10/2018 09:58:51","299","OSINT - MuddyWater expands operations"
"Synovus Financial","15/05/2018 16:49:20","300","Late Emotet yesterday 5/8/2018"
"CthulhuSPRL.be","08/09/2015 13:15:41","301","OSINT Carbanak gang is back and packing new guns by Eset"
"CIRCL","03/08/2018 13:57:31","302","OSINT - Malicious document targets Vietnamese officials"
"CthulhuSPRL.be","14/09/2017 14:16:45","303","OSINT New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving by Intezer"
"CIRCL","24/03/2020 15:40:42","304","OSINT - Pivot from IP address (105.235.129.138) where the C2 was running"
"CthulhuSPRL.be","25/08/2015 10:24:27","305","OSINT The Curious Case of the Document Exploiting an Unknown Vulnerability – Part 2: RATs, Hackers and Rihanna by Fortinet"
"CIRCL","10/03/2016 11:20:35","306","Cerber Ransomware"
"CthulhuSPRL.be","02/02/2016 09:46:44","307","OSINT phishing sites and php kits - January 2016 - Part 2 by TechHelpList"
"CIRCL","19/07/2016 15:06:28","308","Malspam 2016-07-19 .docm (campaign: ""Documents from work"")"
"CIRCL","12/10/2017 18:46:15","309","M2M - Locky 2017-10-10 : Affid=3, offline, "".asasin"" : ""Document ... is complete"" - ""invoice_1234_sign_and_return.7z"""
"CthulhuSPRL.be","07/04/2015 22:43:51","310","OSINT Threat Spotlight: Spam Served With a Side of Dridex from Cisco Talos"
"CthulhuSPRL.be","22/06/2017 21:26:55","311","OSINT Backdoor.Win32.Equationdrug.A report by Telus"
"CIRCL","04/07/2017 14:40:24","312","M2M - Emailing: ########.jpg zip|wsf"
"CIRCL","11/04/2017 13:18:20","313","OSINT - Ewind – Adware in Applications’ Clothing"
"CIRCL","24/06/2019 10:48:40","314","Information stealer malware via fake malicious document as ""University of Luxembourg"""
"CthulhuSPRL.be","03/04/2015 15:23:06","315","OSINT The Dyre Wolf report from IBM"
"CthulhuSPRL.be","05/02/2018 08:53:58","316","Import of CitizenLab public DB of malware indicators"
"CIRCL","07/09/2016 07:30:55","317","Malspam 2016-09-06 (.js in .zip) - campaign: ""Suspected Purchases"""
"CIRCL","10/12/2017 09:39:48","318","OSINT - StrongPity2 spyware replaces FinFisher in MitM campaign – ISP involved?"
"CIRCL","27/04/2016 07:32:48","319","OSINT - Malware Campaign Using Google Docs Intercepted, Thousands of Users Affected"
"CIRCL","16/03/2018 21:16:09","320","OSINT - Sofacy Uses DealersChoice to Target European Government Agency"
"CIRCL","06/06/2016 14:44:37","321","OSINT - Lame proxychanger, apparently related to a clickfraud botnet."
"CIRCL","23/09/2018 12:50:09","322","OSINT - Operation SMN (Novetta)"
"CIRCL","03/03/2017 13:49:07","323","OSINT - Update on the Fancy Bear Android malware (poprd30.apk)"
"CthulhuSPRL.be","02/02/2018 14:28:38","324","OSINT I Know You Want Me - Unplugging PlugX from Takahiro Haruyama & Hiroshi Suzuki Black Hat Asia 2014 presentation"
"CthulhuSPRL.be","08/08/2016 15:46:22","325","Expansion on OSINT Lost your iPhone? Be on guard for a perfectly-timed Apple ID phishing attack by Hot For Security"
"CIRCL","07/09/2016 08:19:37","326","Malspam 2016-09-06 (.wsf in .zip) - campaign: 'Message from ""CUKPR[x]""'"
"CIRCL","01/12/2015 08:52:48","327","OSINT - PlugX-т өртсөн системийг цэвэрлэх нь"
"CthulhuSPRL.be","25/01/2018 13:47:21","328","Malicious Chrome browser extensions injecting code"
"VK-Intel","05/05/2020 18:14:21","329","2019-01-21: APT28 Autoit Zebrocy Progression"
"CthulhuSPRL.be","15/06/2015 08:28:02","330","OSINT A deeper look into ScanBox TLP:WHITE report from PWC UK"
"CIRCL","11/08/2017 15:39:58","331","OSINT - Fake Snapchat in Google Play Store"
"CIRCL","26/10/2018 13:43:31","332","Clipboard Hijacker Targeting Bitcoin & Ethereum Users Infects Over 300,0000 PCs"
"Synovus Financial","05/05/2020 17:15:55","333","Emotet 5-18-2018"
"CIRCL","23/08/2019 10:36:07","334","OSINT - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications"
"Synovus Financial","07/06/2018 13:17:43","335","New Phishing Attacks Abuse Excel Internet Query Files"
"CIRCL","06/01/2017 11:12:54","336","OSINT - Exposing an AV-Disabling Driver Just in Time for Lunch"
"CIRCL","06/06/2019 13:23:49","337","OSINT - Spam Warns about Boeing 737 Max Crashes While Pushing Malware"
"CIRCL","26/08/2016 17:04:57","338","Malspam 2016-08-26 (.wsf in .zip) - campaign: ""Voice Message from Outside Caller"""
"CIRCL","24/02/2019 15:45:36","339","OSINT - New BabyShark Malware Targets U.S. National Security Think Tanks"
"CIRCL","03/12/2017 15:10:23","340","OSINT - Android Malware Appears Linked to Lazarus Cybercrime Group"
"CIRCL","09/06/2017 16:41:24","341","M2M - Jaff 2017-06-09 : missing subject - ""IMG_1234.ZIP"" / ""DOC_1234.docm"""
"CthulhuSPRL.be","25/08/2015 10:24:10","342","OSINT RTF Exploit Installs Italian RAT: uWarrior by Palo Alto"
"CIRCL","29/02/2016 12:01:52","343","OSINT - ATMZombie: banking trojan in Israeli waters"
"CthulhuSPRL.be","04/05/2015 10:36:47","344","OSINT Introducing HATs: Highly Annoying Threats by BlueCoat"
"CIRCL","13/01/2018 04:00:22","345","OSINT - Operation Ke3chang Resurfaces With New TidePool Malware"
"CIRCL","30/07/2017 17:54:23","346","OSINT - CowerSnail, from the creators of SambaCry"
"CthulhuSPRL.be","02/02/2018 14:28:26","347","Expansion on two IPs listed in OSINT IOCs from various campaigns listed in Detecting Bleeding Edge Malware presentation at hack.lu 2014"
"CIRCL","28/10/2018 09:53:34","348","OSINT - Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware"
"CIRCL","03/07/2018 15:00:12","349","OSINT - Down but Not Out: A Look Into Recent Exploit Kit Activities"
"CIRCL","28/09/2017 21:39:08","350","OSINT - Banking Trojan Attempts To Steal Brazillion$"
"CIRCL","07/04/2017 13:21:18","351","OSINT - Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA"
"CIRCL","16/03/2016 15:45:58","352","Malspam (2016-03-16) - Locky"
"CIRCL","28/04/2017 19:22:09","353","OSINT - ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms"
"CIRCL","30/03/2017 14:26:47","354","OSINT - Websites compromised in ‘Decimal IP’ campaign"
"CIRCL","07/04/2016 16:07:13","355","Kegotip downloader"
"CIRCL","12/04/2016 21:25:19","356","OSINT - MS Office exploit analysis – CVE-2015-1641"
"CIRCL","21/12/2017 04:01:12","357","OSINT - How Mobile Bankbots Disguise as Perfectly Trustworthy Apps"
"CthulhuSPRL.be","21/09/2015 12:47:35","358","OSINT In Pursuit of Optical Fibers and Troop Intel: Targeted Attack Distributes PlugX in Russia by ProofPoint"
"CIRCL","21/03/2016 18:37:30","359","OSINT - STOP SCANNING MY MACRO"
"CIRCL","06/09/2016 13:04:44","360","Malspam 2016-09-06 (.js in .zip) - campaign: ""August invoice"""
"CIRCL","13/05/2016 13:17:33","361","OSINT - Cyber Heist Attribution"
"CIRCL","13/12/2017 17:02:59","362","M2M - Locky 2017-09-26 : Affid=3, offline, "".ykcol"":""INVOICE"" - ""A1234567890.7z"""
"CIRCL","16/04/2018 09:28:42","363","Crypren Ransomware"
"Synovus Financial","25/05/2018 16:37:22","364","Hancitor"
"CIRCL","23/11/2018 10:14:13","365","OSINT - RAT Gone Rogue: Meet ARS VBS Loader"
"CthulhuSPRL.be","21/05/2015 12:58:44","366","OSINT Cmstar Downloader: Lurid and Enfal’s New Cousin by Palo Alto Unit 42"
"CIRCL","19/09/2016 10:20:07","367","Malspam 2016-09-19 (.js in .zip) - campaign: ""Express Parcel service"""
"CIRCL","12/01/2018 04:00:24","368","OSINT - MICROCIN MALWARE"
"CthulhuSPRL.be","22/06/2017 21:28:37","369","OSINT Analysis of Project Cobra Another extensible framework used by the Uroburos’ actors from Gdata"
"CIRCL","08/09/2017 12:42:36","370","OSINT - Votiro Labs exposed a new hacking campaign targeting Vietnamese organisations using weaponized Word documents"
"CIRCL","25/10/2017 10:04:21","371","OSINT - Bad Rabbit ransomware"
"CthulhuSPRL.be","21/05/2015 14:11:56","372","OSINT Attacks on East Asia using Google Code for Command and Control by Palo Alto Unit 42"
"CIRCL","13/06/2018 08:29:13","373","OSINT - Goodfellas, the Brazilian carding scene is after you"
"CthulhuSPRL.be","22/06/2017 20:59:05","374","OSINT Operation Molerats: Middle East Cyber Attacks Using Poison Ivy by Fire Eye"
"CIRCL","01/06/2016 10:26:25","375","OSINT - PLATINUM Targeted attacks in South and Southeast Asia"
"CIRCL","04/10/2017 18:28:32","376","OSINT - Malicious Chrome Extensions Stealing Roblox In-Game Currency, Sending Cookies via Discord"
"CthulhuSPRL.be","23/08/2016 14:32:47","377","OSINT Rex -Linux P2P Ransom botnet by This Is Security blog"
"CIRCL","04/10/2018 20:15:09","378","OSINT - Persirai: New Internet of Things (IoT) Botnet Targets IP Cameras"
"CIRCL","14/10/2016 15:18:19","379","Spam 2016-10-14 (mule acquisition) - probably related to Locky resources"
"CthulhuSPRL.be","06/03/2015 13:51:15","380","OSINT Who's Really Spreading through the Bright Star? by Securelist / Kaspersky"
"CIRCL","18/05/2017 12:39:53","381","Password-protected docs 2017-05-10 : Ursnif 2002 - ""payment confirmation.ab1_c23def4lg56hi#78j.docx"""
"CIRCL","07/09/2016 14:09:50","382","OSINT - Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems"
"CIRCL","11/06/2019 15:38:31","383","Dharma Ransomware sample"
"laskowski-tech.com","04/02/2020 04:02:31","384","Updating: Tracking Powershell Empire C2 via Urlscan"
"CIRCL","22/06/2016 22:02:42","385","OSINT - The Curious Case of an Unknown Trojan Targeting German-Speaking Users"
"CIRCL","28/06/2019 09:42:04","386","OSINT - OSX/Linker: New Mac malware attempts zero-day Gatekeeper bypass"
"EUROLEA","05/05/2020 17:17:33","387","Targeted phishing - PDF documents / phishkit"
"CthulhuSPRL.be","27/04/2015 23:11:18","388","OSINT Without a Trace: Fileless Malware Spotted in the Wild by Trend Micro"
"CIRCL","10/07/2018 07:56:08","389","OSINT - APT Attack In the Middle East: The Big Bang"
"CIRCL","20/05/2016 13:08:26","390","OSINT - Bolek: Leaked Carberp KBot Source Code Complicit in New Phishing Campaigns"
"CthulhuSPRL.be","08/02/2016 13:32:45","391","OSINT phishing sites and php kits - January 2016 - Part 1 by TechHelpList"
"Synovus Financial","23/09/2019 14:47:04","392","[TIA-REPO Consumption] KeyPass ransomware"
"CthulhuSPRL.be","03/08/2020 07:40:59","393","OSINT Expansion on Systematic cyber attacks against Israeli and Palestinian targets going on for a year by Norman"
"CIRCL","12/12/2016 11:48:23","394","OSINT - New Scheme: Spread Popcorn Time Ransomware, get chance of free Decryption Key"
"CIRCL","22/02/2017 08:45:05","395","OSINT - Additional Insights on Shamoon2"
"CIRCL","21/05/2019 15:54:07","396","HIDDEN COBRA - North Korean Malicious Cyber Activity (MAR-10135536.r21.v2)"
"CIRCL","16/04/2018 08:53:27","397","OSINT - Goodbye Cerber? Hello Magniber Ransomware!"
"CthulhuSPRL.be","01/02/2016 16:03:48","398","OSINT Android.Bankosy: All ears on voice call-based 2FA by Symantec"
"CIRCL","29/06/2016 08:36:32","399","OSINT - The Latest Android Overlay Malware Spreading via SMS Phishing in Europe"
"CIRCL","06/02/2019 19:06:02","400","Malicious XLS claiming to be from Deloitte"
"CIRCL","16/11/2017 09:22:21","401","M2M - Locky Affid=3, "".asasin""/Trickbot ""mac1"" 2017-10-18 : ""Invoice 123456789 10.18.2017.7z"""
"CIRCL","29/12/2016 10:10:15","402","Android spyware"
"CIRCL","24/08/2016 16:04:30","403","Malspam 2016-08-24 (.hta in .zip) - campaign: ""Emailing{N}.jpg"""
"CIRCL","20/01/2020 16:41:08","404","OSINT - More than a Dozen Obfuscated APT33 Botnets Used for Extreme Narrow Targeting"
"CIRCL","13/07/2016 09:57:30","405","Malspam 2016-07-12 (Locky campaign 'Fw:')"
"CIRCL","12/02/2017 19:56:30","406","OSINT - Attackers target dozens of global banks with new malware"
"CIRCL","25/10/2016 22:36:25","407","OSINT - Houdini’s Magic Reappearance"
"CIRCL","12/02/2018 04:00:18","408","OSINT - Dasan Unauthenticated Remote Code Execution - and ongoing abuse"
"CIRCL","17/09/2018 06:27:38","409","OSINT - Dangerous Invoices and Dangerous Infrastructure"
"CIRCL","09/06/2017 07:46:02","410","M2M - Trickbot 2017-06-07 : ""mac1"" : ""12_Invoice_3456"" - ""001_4321.pdf"""
"CIRCL","27/11/2015 16:23:01","411","OSINT - Botnet bruteforcing Point Of Sale terminals via Remote Desktop"
"CIRCL","01/09/2016 08:23:24","412","Malspam 2016-09-01 (.hta in .zip) - campaign: ""Voice Message from Outside Caller"""
"Synovus Financial","02/07/2018 18:34:32","413","Malware with legit company names in metadata"
"CIRCL","30/08/2016 08:53:34","414","Bitcoinminer installed by malware"
"CIRCL","07/04/2016 16:01:31","415","PWS: Win32/Kegotip.C"
"CIRCL","29/04/2016 13:52:55","416","OSINT - Over 100,000 South Korean Users Affected by BlackMoon Campaign"
"CIRCL","22/07/2016 09:32:18","417","Malspam 2016-07-22 .js in .zip with embedded Locky (campaign: ""Financial statement"")"
"CIRCL","31/03/2018 11:46:24","418","OSINT - Crypter-as-a-Service Helps jRAT Fly Under The Radar"
"CthulhuSPRL.be","20/08/2015 09:53:55","419","OSINT Cheshire Cat"
"CIRCL","06/12/2017 10:46:02","420","M2M - ""..doc"" 2017-12-04 : ""Emailing: 1234567"" - ""1234567.7z"""
"CthulhuSPRL.be","31/07/2015 10:30:04","421","OSINT Milano Hacking Team malware detection tool & IOCs by Rook Security"
"CIRCL","15/10/2017 17:24:35","422","M2M - Locky 2017-10-04 : Affid=3, offline, "".ykcol"" : ""Copy of invoice A1234567890..."" - ""InvoiceA1234567890.7z"""
"CIRCL","03/07/2018 10:28:06","423","OSINT - RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families"
"CIRCL","21/03/2018 13:53:46","424","OSINT - Qwerty Ransomware Utilizes GnuPG to Encrypt a Victims Files"
"CIRCL","06/04/2017 18:59:15","425","OSINT - LMAOxUS Ransomware: Another Case of Weaponized Open Source Ransomware"
"CthulhuSPRL.be","18/11/2014 13:51:44","426","OSINT Analysis of DHS NCCIC Indicators blog post by Secureworks"
"CIRCL","17/05/2016 17:29:45","427","OSINT - Exploring CVE-2015-2545 and its users"
"CIRCL","24/04/2017 11:17:39","428","OSINT - Cardinal RAT Active for Over Two Years"
"CIRCL","11/08/2019 07:43:15","429","OSINT - From Carnaval to Cinco de Mayo – The journey of Amavaldo"
"CthulhuSPRL.be","24/02/2016 16:51:47","430","OSINT Black Vine: Formidable cyberespionage group targeted aerospace, healthcare since 2012 by Symantec"
"CthulhuSPRL.be","29/10/2014 03:06:02","431","OSINT Emerging Threat Alert - CVE-2014-4114 blog post by Cylance"
"CIRCL","09/03/2016 14:55:54","432","Dridex (2016-03-09) - botnet 220"
"CIRCL","05/12/2018 11:18:49","433","MAR-10164494.r1.v1 (SamSam ransomware)"
"CIRCL","29/09/2017 13:44:18","434","M2M - Locky / Trickbot: ""Emailing: Scan0xxx"" from ""Sales"""
"CIRCL","19/05/2019 15:13:28","435","OSINT - 200+ hosts attempting Linksys RCE exploits"
"CIRCL","07/12/2016 09:37:11","436","Malspam 2016-12-07 (.js in .zip) - campaign: ""receipt"""
"CIRCL","24/01/2019 22:10:13","437","IOCs Associated with DNS Infrastructure Tampering"
"CIRCL","02/12/2016 22:43:44","438","OSINT - Shamoon 2: Return of the Disttrack Wiper"
"CIRCL","22/04/2019 09:06:52","439","OSINT - Nueva campaña del grupo ruso TA505 dirigida a Chile y Argentina. #ServHelper"
"CIRCL","14/08/2018 13:38:23","440","OSINT - RedAlpha: New Campaigns Discovered Targeting the Tibetan Community"
"CthulhuSPRL.be","25/08/2015 12:52:50","441","OSINT Pony Up: Tracing Pony’s Threat Cycle and Multi-Stage Infection Chain by Damballa"
"CthulhuSPRL.be","22/12/2015 15:35:56","442","OSINT Pay No Attention to the Server Behind the Proxy: Mapping FinFisher’s Continuing Proliferation by Citizen Lab"
"CthulhuSPRL.be","16/01/2015 10:49:17","443","OSINT Backdoor.Win32.Shiz from Lavasoft"
"laskowski-tech.com","09/10/2020 15:33:46","444","Trickbot Gtag QW1"
"CIRCL","24/01/2018 04:00:22","445","OSINT - First C&C (IPv6) - Azorult"
"CIRCL","11/04/2019 09:54:41","446","OSINT - OSINT Reporting Regarding DPRK and TA505 Overlap"
"CIRCL","27/09/2016 13:33:31","447","Malspam 2016-09-27 (.wsf in .zip) - campaign: ""{integer}.zip"""
"CIRCL","07/02/2017 20:53:59","448","OSINT - The Curious Case of a Reconnaissance Campaign Targeting Ministry and Embassy Sites"
"CIRCL","12/03/2018 13:28:45","449","OSINT - APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS"
"CthulhuSPRL.be","13/11/2014 15:32:53","450","OSINT Expansion on Rotten Tomato campaign"
"CIRCL","21/11/2019 09:32:54","451","OSINT - Wrong hashes (from getmonero.org) #6151 - malicious binaries"
"CIRCL","08/05/2018 07:54:45","452","OSINT - GandCrab Version 3 Released With Autorun Feature and Desktop Background"
"CIRCL","31/08/2016 13:28:17","453","Malspam 2016-08-31 (.js in .zip) - campaign: ""bank transactions"""
"CthulhuSPRL.be","08/08/2016 16:25:05","454","OSINT Orcus – Birth of an unusual plugin builder RAT by Palo Alto Unit 42"
"CIRCL","22/04/2016 20:40:43","455","OSINT - powershell used for spreading trojan.laziok through google docs"
"CIRCL","26/08/2017 20:39:39","456","OSINT - Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures"
"CIRCL","10/02/2018 04:02:22","457","OSINT - Dark Caracal Cyber-espionage at a Global Scale"
"CthulhuSPRL.be","22/12/2015 15:24:31","458","OSINT - Case Study of Malicious Actors: Going Postal by CERT.pl"
"CIRCL","02/06/2017 16:15:59","459","M2M - Malspam --> 62909008.pdf"
"CIRCL","22/11/2017 22:24:01","460","OSINT - OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society"
"CIRCL","16/09/2016 10:13:40","461","OSINT - ELF.Rex"
"CIRCL","02/03/2016 15:15:11","462","Malspam collection (2016-03-02) - Locky, TeslaCrypt"
"CthulhuSPRL.be","28/05/2015 08:24:48","463","OSINT The Teenage Mutant Malvertiser Network by FireEye"
"CIRCL","16/11/2016 10:11:18","464","OSINT - New Carbanak / Anunak Attack Methodology"
"CIRCL","08/06/2018 20:46:59","465","OSINT - InvisiMole: surprisingly equipped spyware, undercover since 2013"
"CIRCL","07/01/2020 15:30:16","466","OSINT - Spam via mobile phone"
"CIRCL","09/11/2017 21:57:57","467","M2M - Locky 2017-11-03 : Affid=3, offline, "".asasin"" : ""Scanned image from MX-2600N"" - ""20171103_123456.doc"""
"CIRCL","24/10/2016 09:23:50","468","Malspam week 44 (2016-10-24) - Locky ('Sebek')"
"CthulhuSPRL.be","13/11/2014 22:35:47","469","OSINT Korplug military targeted attacks: Afghanistan & Tajikistan blog post from ESET"
"CIRCL","24/06/2016 16:14:20","470","Malspam 2016-06-24 (Locky)"
"CIRCL","17/04/2018 06:16:30","471","OSINT - Cisco IOS CVE-2018-0171 attack"
"CIRCL","26/01/2018 15:23:00","472","Fake Job Application incl. Macro"
"CthulhuSPRL.be","30/09/2015 07:19:47","473","OSINT Recorded Future using shodan to find RAT controllers"
"CthulhuSPRL.be","05/02/2018 08:50:37","474","OSINT ShellShock scanning IPs from OpenDNS"
"CIRCL","11/09/2017 15:45:31","475","M2M - Malspam 2017-09-11 ""Email Invoice Requested"""
"CthulhuSPRL.be","22/12/2015 15:01:20","476","OSINT Fidelis Threat Advisory #1019 Ratcheting Down on JSocket: A PC and Android Threat by Fidelis Cybersecurity"
"CIRCL","20/04/2016 14:37:24","477","OSINT - New Crypto-Ransomware JIGSAW Plays Nasty Games"
"CIRCL","24/06/2018 07:03:37","478","OSINT - DBGer Ransomware Uses EternalBlue and Mimikatz to Spread Across Networks"
"CIRCL","29/06/2016 16:34:41","479","Malspam 2016-06-29 (campaign subject: 'Financial report')"
"CIRCL","25/01/2017 15:35:40","480","OSINT - Malicious SVG Files in the Wild"
"CIRCL","05/10/2017 21:02:13","481","M2M - Locky 2017-10-05 : Affid=3, offline, "".ykcol"" : ""Invoice"" - ""1234567.7z"""
"CthulhuSPRL.be","02/02/2016 11:21:31","482","OSINT Neutrino Exploit Kit – One Flash File to Rule Them All by SpiderLabs"
"CIRCL","02/01/2017 16:37:44","483","OSINT - GRIZZLY STEPPE – Additional expansion"
"CIRCL","19/02/2019 08:50:29","484","Financial - socgen-compliance.com fake website delivering malicious documents"
"CIRCL","16/09/2016 08:34:51","485","Malspam 2016-09-16 (.js in .zip) - campaign: ""Re: request"""
"CIRCL","10/03/2016 15:17:16","486","Malspam (2016-03-10) - Locky, TeslaCrypt"
"CIRCL","20/04/2016 12:52:14","487","New ransomware"
"CIRCL","14/04/2016 10:00:36","488","Malspam via Spambots (2016-04-14)"
"CIRCL","22/11/2017 22:20:18","489","OSINT - Bahamut Revisited, More Cyber Espionage in the Middle East and South Asia"
"CIRCL","05/07/2016 21:44:04","490","OSINT - From Humming Bad to Worse"
"CIRCL","16/03/2016 17:35:01","491","Locky (2016-03-16)"
"CIRCL","11/01/2016 16:41:51","492","OSINT - Clickjacking Campaign Plays on European Cookie Law"
"CIRCL","06/12/2016 15:37:08","493","OSINT - Another story of Unix Trojan: Tsunami/Kaiten.c (IRC/Bot) w/ Flooder, Backdoor at a hacked xBSD"
"CIRCL","08/03/2016 18:55:39","494","BadMirror: New Android Malware Family Spotted by SherlockDroid"
"CthulhuSPRL.be","15/12/2015 08:32:07","495","OSINT Passive DNS ponmocup malware - 109.74.195.149 in VirusTotal"
"CthulhuSPRL.be","02/06/2015 08:11:50","496","OSINT Beware of what you download. Recent purported CEIEC document dump booby-trapped by Shadow Server"
"CIRCL","29/08/2016 15:37:46","497","Malspam 2016-08-29 (.wsf in .zip) - campaign: ""Please find attached invoice no"""
"CthulhuSPRL.be","17/07/2017 08:51:29","498","HackShit phishing as a service"
"CIRCL","30/11/2017 04:00:40","499","OSINT - UBoatRAT Navigates East Asia"
"CIRCL","10/09/2016 13:42:06","500","OSINT - The Dukes R&D Finds a New Anti-Analysis Technique"
"CIRCL","11/04/2017 20:31:01","501","OSINT - CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler"
"Synovus Financial","24/07/2018 20:25:22","502","Hancitor Intel"
"CIRCL","15/11/2016 07:54:32","503","OSINT - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles"
"CthulhuSPRL.be","07/10/2015 11:01:22","504","OSINT Cisco Talos Thwarts Access to Massive International Exploit Kit Generating $60M Annually From Ransomware Alone by Cisco Talos"
"CIRCL","17/01/2017 21:12:54","505","OSINT - CARBANAK GROUP USES GOOGLE FOR MALWARE COMMAND-AND-CONTROL"
"CIRCL","30/11/2016 11:52:47","506","Cerber 5.0 through Google via onion gateway"
"CIRCL","24/04/2019 12:21:10","507","OSINT - DNSpionage brings out the Karkoff"
"Synovus Financial","29/06/2018 18:17:09","508","Malicious Emails Outlook Themed"
"CIRCL","21/05/2017 08:53:45","509","OSINT - New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two"
"CthulhuSPRL.be","09/08/2016 09:38:57","510","Expansion on [email protected]"
"CIRCL","24/09/2015 10:30:40","511","OSINT - Guaranteed Clicks: Mobile App Company Takes Control of Android Phones"
"CIRCL","21/04/2016 16:18:47","512","OSINT - Your Package Has Been Successfully Encrypted: TeslaCrypt 4.1A and the Malware Attack Chain"
"CIRCL","15/11/2016 07:49:04","513","OSINT - Hades Locker Ransomware Mimics Locky"
"CIRCL","25/08/2017 12:30:06","514","OSINT - New Version of “Trickbot” Adds Worm Propagation Module"
"CIRCL","06/07/2017 08:48:26","515","OSINT - Analysis of TeleBots’ cunning backdoor"
"CIRCL","08/04/2018 16:33:22","516","OSINT - Black Ruby Ransomware Skips Victims in Iran and Adds a Miner for Good Measure"
"CIRCL","22/08/2017 11:10:57","517","OSINT - Emotet, New high-volume spam campaign has links pointing to malicious documents that download banking Trojan"
"CIRCL","19/10/2017 16:45:30","518","M2M - Malspam 2017-10-19 ""Emailed Invoice - ******"""
"CIRCL","14/05/2017 15:50:42","519","OSINT - Alert (TA17-132A) Indicators Associated With WannaCry Ransomware"
"CIRCL","31/08/2016 11:02:35","520","Malspam 2016-08-31 (.hta in .zip) - campaign: ""FW: [Scan]"""
"CIRCL","16/05/2016 12:58:25","521","OSINT - Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck"
"CthulhuSPRL.be","11/07/2016 14:40:21","522","Pivot on What's in a server name (on APT28/Sofacy) by ThreatConnect"
"CIRCL","20/03/2017 18:41:57","523","OSINT - PetrWrap: the new Petya-based ransomware used in targeted attacks"
"CIRCL","20/02/2017 15:29:17","524","OSINT - LAZARUS’ FALSE FLAG MALWARE"
"CthulhuSPRL.be","26/02/2015 14:59:28","525","Fessleak before It Was Cool by OpenDNS"
"CIRCL","06/11/2016 11:07:33","526","Yara Rule Set - detection of Empire by Florian Roth (PowerShell and Python post-exploitation agent.)"
"CIRCL","27/05/2016 09:52:01","527","Malspam 2016-05-26 - Locky - samples reversed, xored (0x73 or 0x1c); samples reversed + long xor key"
"CthulhuSPRL.be","11/11/2015 07:36:47","528","OSINT Bookworm Trojan: A Model of Modular Architecture by Palo Alto Unit 42"
"CIRCL","24/08/2016 13:22:05","529","Malspam 2016-08-24 (.js in .zip) - campaign: ""Statement"""
"CthulhuSPRL.be","16/02/2015 10:17:22","530","OSINT Arid Viper: Gaza vs Israel Cyber Conflict by Trend Micro"
"CIRCL","10/12/2017 14:56:03","531","OSINT - HC7 GOTYA Ransomware Installed via Remote Desktop Services. Spread with PsExec"
"CIRCL","25/03/2016 14:39:04","532","OSINT - New self-protecting USB trojan able to avoid detection"
"CIRCL","25/05/2016 08:34:51","533","OSINT - New Wekby Attacks Use DNS Requests As Command and Control Mechanism"
"CthulhuSPRL.be","28/06/2016 13:17:01","534","Pivot on other email addresses found by using the same physical address as support-apple-id.com - potential sofacy"
"CIRCL","23/08/2016 15:26:16","535","Malspam 2016-08-23 (.wsf in .zip) - campaign: ""New voice mail message from [RANDOM]"""
"CIRCL","09/09/2016 13:47:12","536","Malspam 2016-09-09 (.hta in .dzip) - campaign: ""Order confirmation"""
"CIRCL","26/01/2018 04:00:57","537","OSINT - Masuta : Satori Creators’ Second Botnet Weaponizes A New Router Exploit."
"CIRCL","12/06/2016 14:54:07","538","OSINT - Communications of the Bolek Trojan"
"CthulhuSPRL.be","11/11/2015 07:37:37","539","OSINT CryptoWall v4 Emerges Days After Cyber Threat Alliance Report by Palo Alto Networks Unit 42"
"CthulhuSPRL.be","29/10/2015 08:15:57","540","OSINT Chinese Taomike Monetization Library Steals SMS Messages by AlienVault and Palo Alto networks"
"Synovus Financial","07/08/2018 14:51:22","541","RBC Themed Phish, Obfuscated Javascript in .htm attachment"
"CIRCL","14/05/2017 17:11:49","542","OSINT - Neo23x0 Yara Rule Set and Sigma Rule Set - WannaCry"
"CIRCL","17/03/2017 15:09:47","543","Tech Support Scam Synchs Alerts with App Crashes in Windows Event Logs"
"CIRCL","06/06/2016 13:00:13","544","OSINT - CryptXXX Ransomware Learns the Samba, Other New Tricks With Version 3.100"
"CIRCL","08/06/2017 22:16:40","545","OSINT - The Recorded Future Blog Malicious Android Applications Raise Concerns for Enterprises"
"CthulhuSPRL.be","09/04/2015 18:13:47","546","OSINT Analysis of KRIPTOVOR: Infostealer+Ransomware by FireEye"
"CIRCL","07/09/2016 10:46:14","547","SQLi vuln sites - 2015-08-12 - origin: pastebin.com/23fDLE1G"
"CIRCL","27/03/2017 13:28:37","548","OSINT - APT29 Domain Fronting With TOR"
"CthulhuSPRL.be","22/06/2017 21:13:45","549","Additional IPs for Turla/Uroburos from CIRCL Passive SSL"
"CthulhuSPRL.be","25/09/2015 07:21:15","550","OSINT Meet GreenDispenser: A New Breed of ATM Malware by ProofPoint"
"CIRCL","23/03/2017 17:13:41","551","OSINT - How Malformed RTF Defeats Security Engines"
"CIRCL","18/05/2017 19:48:24","552","OSINT - Uiwix Ransomware Using EternalBlue SMB Exploit To Infect Victims"
"CIRCL","21/12/2017 04:00:39","553","OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers"
"wilbursecurity.com","31/01/2020 08:36:44","554","XMRig and OPSEC Fail"
"CIRCL","05/08/2018 17:16:48","555","OSINT - Off-the-shelf RATs Targeting Pakistan"
"CIRCL","17/01/2019 12:00:37","556","OSINT - Threat Actor “Cold River”: Network Traffic Analysis and a Deep Dive on Agent Drable"
"CIRCL","23/11/2018 21:45:10","557","OSINT - Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery"
"CIRCL","27/01/2017 16:16:08","558","Malspam targeting github users"
"Synovus Financial","07/12/2018 20:02:43","559","Flash CVE-2018-15982 IOCs"
"CIRCL","24/04/2017 10:05:05","560","OSINT - Sofacy’s ‘Komplex’ OS X Trojan by Palo Alto networks"
"CthulhuSPRL.be","12/02/2015 14:03:02","561","OSINT SSH Scanning activity by Andrew Morris"
"CIRCL","26/04/2017 14:31:40","562","OSINT - Threat Spotlight: Mighty Morphin Malware Purveyors: Locky Returns Via Necurs"
"CIRCL","30/06/2016 13:16:14","563","OSINT - Apocalypse: Ransomware which targets companies through insecure RDP"
"CIRCL","19/08/2015 14:06:36","564","OSINT - PlugX goes to the registry (and India)"
"CIRCL","03/08/2017 08:15:39","565","OSINT - A Look at JS_POWMET, a Completely Fileless Malware"
"CIRCL","16/09/2016 08:14:30","566","Malspam 2016-09-16 (.hta in .zip) - campaign: ""(Attached|Emailing|Copy|File): (Scan|Receipt|Document)(integer)"""
"CthulhuSPRL.be","01/03/2016 23:18:53","567","OSINT APT Bestia used in APT attacks on Polish Government"
"CIRCL","05/06/2017 08:02:11","568","OSINT - Threat actors leverage EternalBlue exploit to deliver non-WannaCry payloads"
"CthulhuSPRL.be","12/08/2016 12:14:47","569","OSINT New C2 – Neutrino Exploit Kit via pseudoDarkleech HOPTO.ORG gate delivers CrypMic Ransomware by Broad Analysis"
"CthulhuSPRL.be","14/01/2015 09:07:26","570","OSINT Cridex, Feodo, Geodo, Dridex, whats next? by abuse.ch"
"CIRCL","14/03/2016 16:33:41","571","Malspam (2016-03-14) - Locky, TeslaCrypt"
"CIRCL","20/01/2017 15:46:57","572","OSINT - APT Case RUAG Technical Report"
"Synovus Financial","01/06/2018 15:18:19","573","Grand Soft EK domains"
"CIRCL","30/08/2016 08:10:11","574","Ransomware - Xorist"
"CIRCL","18/04/2016 10:41:11","575","OSINT - Retefe is back in town"
"CIRCL","24/05/2016 16:31:13","576","Malspam - Locky - 2016-05-24 (.zip with .js, downloading (partially reversed) XOR'ed data)"
"CthulhuSPRL.be","16/08/2016 15:52:31","577","OSINT Additional yara rules for detection Project Sauron by Florian Roth"
"CthulhuSPRL.be","19/06/2016 23:22:10","578","OSINT The Ghost Dragon by Cylance"
"CthulhuSPRL.be","20/04/2015 08:54:12","579","20150415D: Fareit Malware Targeting Steam Users from ThreatConnect"
"CIRCL","28/05/2016 20:42:51","580","Malspam 2016-05-27 - Locky (.js in .zip)"
"CthulhuSPRL.be","31/01/2016 21:54:46","581","OSINT An In-Depth Look at How Pawn Storm’s Java Zero-Day Was Used by Trend Micro"
"laskowski-tech.com","09/10/2020 14:27:44","582","Lokibot Equation Editor Sample"
"CIRCL","22/01/2020 08:41:10","583","Muhstik Botnet Attacks Tomato Routers"
"CIRCL","09/10/2017 12:32:01","584","M2M - Locky 2017-10-05 : Affid=3, offline, "".ykcol"" : ""Invoice INV000123"" - ""Invoice INV000123.7z"""
"CIRCL","17/02/2016 15:42:59","585","OSINT - Dridex Actors Get In the Ransomware Game With ""Locky"""
"CIRCL","10/03/2016 08:46:53","586","OSINT - The Cerber Ransomware not only Encrypts Your Data But Also Speaks to You"
"CthulhuSPRL.be","05/02/2015 17:12:38","587","OSINT In-Depth Look: APT Attack Tools of the Trade blog post by Trend Micro"
"CIRCL","19/08/2017 08:33:29","588","OSINT - EngineBox Malware Supports 10+ Brazilian Banks"
"CIRCL","11/09/2017 13:02:22","589","OSINT - Malware Group Uses Facebook CDN to Bypass Security Solutions"
"wilbursecurity.com","17/02/2020 00:05:49","590","Dever Ransomware"
"CIRCL","10/02/2018 04:01:48","591","OSINT - Mac Malware of 2017"
"CIRCL","30/05/2016 14:39:17","592","OSINT - Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents"
"CIRCL","11/09/2017 10:33:12","593","M2M - malspam Subject FreeFax From:\d{10}"
"CIRCL","20/07/2018 15:02:51","594","OVH Phishing"
"CIRCL","14/09/2016 10:52:53","595","Malspam 2016-09-14 (.wsf in .zip) - campaign: ""payment copy"""
"CIRCL","15/05/2018 15:37:46","596","OSINT - Hunting Libyan Scorpions"
"CIRCL","20/09/2016 05:54:45","597","Malspam 2016-09-20 (.hta in .zip) - campaign: ""<no subject>"""
"CIRCL","04/08/2016 15:02:12","598","OSINT - NANHAISHU RATing the South China Sea"
"CIRCL","06/12/2017 11:01:16","599","M2M - ""..doc"" 2017-12-05 : 'Message from ""G10PR0123456.MYCOMPANY.COM""' - ""20171205123.zip"""
"CthulhuSPRL.be","02/02/2016 09:38:56","600","OSINT Phishing sites and exploit kits december 2015 - part 2 by TechHelpList"
"CIRCL","02/08/2018 15:10:22","601","OSINT - Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions"
"CIRCL","08/09/2017 13:11:24","602","OSINT - Booters with Chinese Characteristics: The Rise of Chinese Online DDoS Platforms"
"INCIBE","01/05/2020 14:10:17","603","Ransomware spreading through SMB attacking multiple companies"
"CIRCL","31/08/2016 11:10:51","604","Malspam 2016-08-31 (.wsf in .zip) - campaign: ""Image|Picture|Photos|Photo|Document"""
"CIRCL","07/04/2017 11:13:39","605","OSINT - High-Volume Dridex Campaigns Return, First to Hit Millions Since June 2016"
"CIRCL","27/04/2016 14:37:11","606","Malspam 2016-04-27 - Locky"
"CIRCL","06/06/2019 13:16:16","607","OSINT - Gaining New Visibility into Financial Threats"
"CIRCL","08/03/2018 14:52:48","608","Malware “TSCookie”"
"ESET","10/05/2019 09:36:45","609","ESET Turla LightNeuron Research"
"CIRCL","26/05/2017 13:57:16","610","Jaff 2017-05-22 : ""Copy of Invoice 12345678"" / ""12345678.PDF"""
"CIRCL","13/01/2018 04:00:43","611","OSINT - MMD-0033-2015 - Linux/XorDDoS infection incident report (CNC: HOSTASA.ORG)"
"MalwareMustDie","26/05/2019 08:14:41","612","SMTP attackers honeypot logs for 2019-05-26"
"CthulhuSPRL.be","22/06/2017 21:16:54","613","OSINT Expansion on Snake"
"CthulhuSPRL.be","03/08/2020 07:39:01","614","A Slice of 2017 Sofacy Activity by Kaspersky"
"CIRCL","23/11/2018 16:34:40","615","OSINT - Turla PNG Dropper is back"
"CIRCL","12/10/2017 19:16:47","616","M2M - Locky 2017-10-09 : Affid=3, offline, "".ykcol"" : ""Invoice IP1234567"" - ""Invoice-IP1234567.7z"""
"CIRCL","06/12/2017 11:03:35","617","M2M - ""..doc"" 2017-11-30 : ""FL-123456 11.30.2017.7z"""
"CIRCL","17/05/2017 09:42:59","618","2017-05-16 Malspam Emailing:#####.pdf.pdf"
"CIRCL","21/12/2017 04:00:48","619","OSINT - The Emotet Banking Trojan: Analysis of Dropped Malware Morphing at Scale"
"CIRCL","22/08/2018 10:18:57","620","OSINT - Microsoft Disrupts APT28 Hacking Campaign Aimed at US Midterm Elections"
"CthulhuSPRL.be","22/06/2017 21:33:24","621","Turla digging using TotalHash"
"laskowski-tech.com","18/08/2020 05:20:39","622","IRS Doc Malware"
"CIRCL","06/12/2017 11:03:09","623","OSINT - Halloware Ransomware on Sale on the Dark Web for Only $40"
"CIRCL","16/07/2016 09:41:10","624","OSINT - In the Shadows: Vawtrak Aims to Get Stealthier by adding New Data Cloaking"
"CIRCL","08/02/2017 23:19:41","625","OSINT - Trojan.Mirai.1 for Microsoft Windows"
"CIRCL","22/12/2017 04:00:33","626","OSINT - Rise of One More Mirai Worm Variant"
"CIRCL","20/12/2017 04:00:31","627","OSINT - RIG exploit kit distributes Princess ransomware"
"CthulhuSPRL.be","05/03/2015 15:29:51","628","OSINT Analysis of malcious CHM file by OpenDNS"
"CIRCL","25/03/2016 20:07:51","629","OSINT - SURGE IN SPAM CAMPAIGN DELIVERING LOCKY RANSOMWARE DOWNLOADERS"
"CIRCL","08/04/2017 16:38:48","630","OSINT - Analysis of Malware in Brazilian Bank Attack Reveals Prolonged Campaign"
"CIRCL","02/05/2017 14:26:55","631","Malspam 2016-07-13 (Locky campaign 'Profile')"
"CthulhuSPRL.be","16/01/2018 13:49:06","632","OSINT Fancy Bear Pens the Worst Blog Posts Ever by ThreatConnect"
"CIRCL","29/08/2016 13:05:17","633","Malspam 2016-08-29 (.js in .zip) - campaign: ""Commission"""
"CIRCL","13/07/2016 14:47:58","634","Malspam 2016-07-13 .wsf campaign"
"CIRCL","12/06/2016 16:04:51","635","OSINT - Reverse-engineering DUBNIUM"
"CIRCL","13/08/2018 12:40:21","636","OSINT - SamSam Ransomware Crew Made Nearly $6 Million From Ransom Payments"
"CIRCL","13/12/2016 19:38:38","637","OSINT - The rise of TeleBots: Analyzing disruptive KillDisk attacks"
"CIRCL","15/07/2019 18:07:56","638","OSINT - SWEED: Exposing years of Agent Tesla campaigns"
"CIRCL","03/10/2018 12:23:20","639","OSINT - CIG Circular 66 – FASTCash ATM Cash Out Campaign"
"CthulhuSPRL.be","15/04/2016 20:27:59","640","Expansion on OSINT Korplug military targeted attacks: Afghanistan & Tajikistan blog post from ESET by using whois registrant"
"CIRCL","12/04/2019 10:38:19","641","Malware Analysis Report (AR19-100A) MAR-10135536-8 – North Korean Trojan: HOPLIGHT MAR-10135536.r8.v1"
"CthulhuSPRL.be","29/09/2015 08:30:56","642","OSINT Infected Korean Website Installs Banking Malware by Cyphort"
"CIRCL","09/11/2017 21:30:37","643","M2M - Locky Affid=3, "".asasin"" 2017-11-01 : ""Emailing: AZ123 - 01.11.2017"" - ""AZ123 - 01.11.2017.doc"""
"CIRCL","26/11/2018 23:13:14","644","OSINT - `event-stream` dependency attack steals wallets from users of copay"
"CthulhuSPRL.be","27/11/2015 09:16:15","645","OSINT Expansion on APT-28 - Evolving Threats: dissection of a Cyber-Espionage attack"
"CthulhuSPRL.be","05/10/2015 16:42:47","646","OSINT Black Energy 2 malware analysis blog post by Joseph Mlodzianowski"
"CIRCL","16/06/2017 22:13:55","647","OSINT - Dridex Returns To Action For Smaller, More Targeted Attacks"
"CthulhuSPRL.be","18/12/2014 20:20:21","648","OSINT 20141107B: Operation Poisoned Handover by ThreatConnect"
"CIRCL","10/12/2019 10:26:08","649","OSINT - Turla/Venomous Bear Implants"
"CIRCL","02/08/2017 09:48:16","650","OSINT - Real News, Fake Flash: Mac OS X Users Targeted"
"CthulhuSPRL.be","12/03/2015 09:04:34","651","OSINT Tibetan Uprising Day Malware Attacks by Citizen Labs"
"CthulhuSPRL.be","01/02/2016 16:04:13","652","OSINT Threat Actors Use Sketchy Dating Website to Launch New Home Router Attacks by Damballa"
"CERT.be","09/10/2020 14:28:15","653","zloader: VBA, R1C1 References, and Other Tomfoolery"
"CIRCL","28/06/2016 13:03:48","654","Malspam 2016-06-28 (Locky campaign subject: 'report')"
"CIRCL","19/01/2019 23:03:33","655","OSINT - LoJax Command and Control Domains Still Active"
"CIRCL","05/08/2017 20:37:21","656","OSINT - TwoFace Webshell: Persistent Access Point for Lateral Movement"
"CIRCL","11/03/2016 14:14:15","657","OSINT - Death Comes Calling: Thanatos/Alphabot Trojan Hits the Market"
"CIRCL","30/09/2016 14:50:41","658","Malspam 2016-09-30 (.wsf in .zip) - campaign: ""Parcel details"""
"CIRCL","24/06/2019 11:07:53","659","Related malware samples"
"CIRCL","01/09/2017 16:40:51","660","Malspam 2017-09-01 - 'New voice message'"
"CIRCL","21/09/2017 13:49:59","661","M2M - Locky 2017-09-19 : Affid=3, offline, "".ykcol"" : ""HERBALIFE Order Number: 6N01001234"" - ""6N01001234_1.7z"""
"Synovus Financial","23/08/2018 15:53:05","662","Emotet - 5/21/2018"
"CthulhuSPRL.be","22/06/2017 21:32:13","663","OSINT APT28: A Window into Russia’s Cyber Espionage Operations? blog post by FireEye"
"CIRCL","11/03/2016 15:55:05","664","'Surprise' Ransomware (2016-03-11)"
"CIRCL","24/06/2018 07:02:50","665","OSINT - Malware That Hit Pyeongchang Olympics Deployed in New Attacks"
"CIRCL","06/09/2017 15:17:31","666","OSINT - SynAck Ransomware Sees Huge Spike in Activity"
"CIRCL","28/10/2016 21:02:04","667","OSINT - Octopus-Rex. Evolution of a multi task Botnet"
"CIRCL","26/04/2016 22:10:11","668","OSINT - Macro Malware Employs Advanced Obfuscation to Avoid Detection"
"ESET","27/08/2020 11:59:37","669","Operation Ghost - White Paper"
"CthulhuSPRL.be","19/02/2015 09:53:32","670","OSINT Babar: espionage software finally found and put under the microscope by gdata"
"CIRCL","13/08/2019 16:49:50","671","OSINT - Recent Cloud Atlas activity"
"CIRCL","08/12/2016 16:27:59","672","OSINT - Astrum Drops"
"CIRCL","02/12/2016 10:13:09","673","OSINT - A PBot (PHP + Perl Backdoor IRC Bot + Network Attack Tool) Infection on hegeman.com"
"CIRCL","13/09/2016 05:47:12","674","Malspam 2016-09-12 (.wsf in .zip) - campaign: ""Photo|Image"""
"CIRCL","05/09/2016 16:58:57","675","Malspam 2016-09-05 (.wsf in .zip)"
"CIRCL","21/06/2019 16:53:14","676","OSINT - Hide ‘N Seek Botnet Updates Arsenal with Exploits Against Nexus Repository Manager & ThinkPHP"
"CIRCL","20/09/2016 09:46:03","677","OSINT - Tofsee – modular spambot"
"CIRCL","03/02/2017 22:10:19","678","OSINT - Windows SMBv3 Denial of Service Proof of Concept (0 Day Exploit)"
"CIRCL","21/04/2016 16:04:40","679","CryptXXX: New Ransomware From the Actors Behind Reveton, Dropping Via Angler"
"wilbursecurity.com","28/02/2020 03:34:40","680","Trickbot and AdFind Recon"
"CIRCL","07/04/2016 10:44:00","681","OSINT - Most prevalent Android ransomware in the West arrives in Japan"
"CthulhuSPRL.be","11/08/2015 08:25:02","682","OSINT The Italian Connection: An analysis of exploit supply chains and digital quartermasters by Shadowserver"
"CthulhuSPRL.be","01/10/2015 07:43:42","683","OSINT When ELF.BillGates met Windows by Arkoon+Netasq"
"CIRCL","16/04/2018 08:53:56","684","OSINT - Forgot About Default Accounts? No Worries, GoScanSSH Didn’t"
"CthulhuSPRL.be","22/06/2017 21:11:00","685","OSINT Snakes in the Satellites: On-going Turla Infrastructure by PassiveTotal"
"Synovus Financial","22/06/2018 08:02:49","686","Sofacy Group’s Parallel Attacks"
"CIRCL","06/10/2017 20:23:27","687","OSINT - Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea"
"CIRCL","26/10/2018 14:55:42","688","OSINT - Locky Ransomware Pushed Alongside FakeGlobe in Upgraded Spam Campaigns"
"CIRCL","12/01/2018 04:00:34","689","OSINT - First Kotlin-Developed Malicious App Signs Users Up for Premium SMS Services"
"CIRCL","21/10/2016 12:34:43","690","OSINT - Malspam delivers NanoCore RAT"
"CIRCL","26/10/2018 13:57:39","691","OSINT - New Donut Ransomware"
"CthulhuSPRL.be","10/10/2014 10:16:02","692","OSINT Evolution of the Nuclear Exploit Kit by Cisco Talos group"
"CIRCL","23/03/2016 14:17:26","693","OSINT - Operation C-Major: Information Theft Campaign Targets Military Personnel in India"
"CIRCL","16/03/2016 20:28:33","694","OSINT - AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect Any iOS Device"
"CIRCL","09/04/2016 23:36:17","695","OSINT - ModPOS: A Framework Lurking in Point-of-Sale System Kernels"
"Synovus Financial","05/06/2018 14:20:49","696","#TrickBot banker updates to group_tag """"tt0002"" version ""1000206"""
"CIRCL","21/04/2016 16:07:29","697","OSINT - “Operation C-Major” Actors Also Used Android, BlackBerry Mobile Spyware Against Targets"
"CthulhuSPRL.be","09/04/2015 18:05:28","698","OSINT Angler Exploit Kit Utilizing 302 Cushioning and Domain Shadowing by Zscaler"
"CIRCL","16/02/2016 11:36:34","699","OSINT - Turla - Harnessing SSL Certificates Using Infrastructure Chaining"
"Synovus Financial","26/02/2019 05:40:19","700","TALOS Blog: Picking Apart Remcos Botnet-In-A-Box"
"CIRCL","28/03/2016 15:29:32","701","Locky of the day (20160328) - affid=3"
"VK_INTEL_EVIL","01/06/2020 19:45:58","702","2019-12-10: TrickBot Project “Anchor:” Window Into Sophisticated Operation"
"CIRCL","17/05/2017 09:41:58","703","2017-05-15 Malspam 00_Invoice_###.PDF"
"CIRCL","08/03/2016 10:11:38","704","TeslaCrypt (2016-03-08)"
"CthulhuSPRL.be","25/10/2014 00:41:08","705","Expansion on OSINT Operation Pawn Storm: The Red in SEDNIT from Trend Micro"
"CIRCL","09/01/2017 08:25:11","706","OSINT - Fancy Bear Source Code"
"wilbursecurity.com","31/01/2020 08:38:46","707","Ako Ransomware"
"CIRCL","09/11/2017 22:07:15","708","M2M - Locky 2017-11-06 : Affid=3, "".asasin"" : ""E3S1234567890123 Payment advice"" - ""advice_123456_20171106.doc"""
"CIRCL","20/04/2018 10:24:28","709","OSINT - Minecraft & CS:GO Ransomware Strive For Media Attention"
"CIRCL","04/10/2017 09:49:29","710","M2M - Locky 2017-10-03 : Affid=3, offline, "".ykcol"" : ""INVOICE"" - ""A_1234567890.7z"""
"CIRCL","19/08/2016 15:38:54","711","OSINT - Operation Ghoul: targeted attacks on industrial and engineering organizations"
"CIRCL","29/08/2017 06:46:24","712","Malspam 2017-08-28 'IMG-'"
"CIRCL","19/07/2017 16:41:25","713","OSINT - Unravelling .NET with the Help of WinDBG"
"CIRCL","14/09/2016 10:40:38","714","Malspam 2016-09-14 (.wsf in .zip) - campaign: ""Account report"""
"CthulhuSPRL.be","13/11/2015 22:19:39","715","OSINT Enterprises Hit by BARTALEX Macro Malware in Recent Spam Outbreak by Trend Micro"
"CIRCL","10/03/2016 14:58:30","716","OSINT - Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans"
"CIRCL","04/03/2018 20:30:17","717","OSINT - McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups"
"CIRCL","25/09/2017 13:58:00","718","M2M - Locky 2017-09-25 : Affid=3, offline, "".ykcol"" : ""Message from 02087654321"" - ""Voice Message.7z"""
"CIRCL","08/04/2018 16:31:47","719","OSINT - The DiskWriter or UselessDisk BootLocker May Be A Wiper"
"CIRCL","06/06/2017 13:34:34","720","OSINT - “Zusy” PowerPoint Malware Spreads Without Needing Macros"
"CIRCL","07/09/2016 10:14:04","721","Malspam 2016-09-07 (.js in .zip) - campaign: ""Agreement form"""
"CthulhuSPRL.be","01/10/2015 07:18:28","722","OSINT Dyreza Campaigners Set Sights on the Fulfillment and Warehousing Industry by ProofPoint"
"Crimeware","29/12/2017 13:15:11","723","Threat Analysis: Malicious Microsoft Word Documents Being Used in Targeted Attack Campaigns"
"CIRCL","01/05/2017 15:06:20","724","OSINT - OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic"
"CIRCL","30/03/2017 14:17:01","725","OSINT - Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations"
"CIRCL","14/09/2016 08:33:19","726","Malspam 2016-09-13 (.hta in .zip) - campaign: ""Accounts Documentation - Invoices"""
"CIRCL","26/05/2017 14:46:35","727","Jaff 2017-05-25 : ""Payment Receipt 1234"" - ""1234.pdf"""
"wilbursecurity.com","26/03/2020 16:46:37","728","Trickbot to Ryuk in Two Hours"
"CIRCL","06/09/2017 15:15:59","729","OSINT - Dragonfly: Western energy sector targeted by sophisticated attack group"
"CIRCL","29/08/2017 14:33:18","730","OSINT - New Nuclear BTCWare Ransomware Released"
"CIRCL","24/04/2018 19:57:53","731","OSINT - Sednit update: Analysis of Zebrocy"
"CIRCL","25/08/2017 14:05:45","732","Malspam 2017-08-25 'New voice message'"
"CIRCL","06/10/2016 14:31:55","733","Malspam 2016-10-06 (.js in .zip) - campaign: ""Your Order"""
"Synovus Financial","23/05/2018 20:35:59","734","Talos Blog: VPNFilter"
"CIRCL","20/08/2019 15:03:04","735","OSINT - Ruby/Gem Warning! is rest-client 1.6.13 hijacked? #713"
"CIRCL","12/12/2018 09:45:03","736","OSINT - Sextortion with a side of ransomware"
"CthulhuSPRL.be","14/10/2014 10:53:20","737","OSINT Shellshock exploitation from Red Sky Weekly blog post"
"CIRCL","19/03/2019 18:16:29","738","LockerGoga - yara rules"
"CIRCL","15/08/2017 20:29:14","739","OSINT - The Curious Case of Notepad and Chthonic: Exposing a Malicious Infrastructure"
"CthulhuSPRL.be","30/09/2015 09:58:50","740","OSINT Fidelis Threat Advisory #1018 Looking at the Sky for a DarkComet from the Fidelis Cybersecurity"
"CIRCL","26/07/2016 21:21:44","741","Guccifer 2.0: All Roads Lead to Russia - Threatconnect report"
"CIRCL","12/01/2017 09:16:03","742","OSINT - New Variant of Ploutus ATM Malware Observed in the Wild in Latin America"
"CIRCL","26/08/2016 17:18:54","743","Malspam 2016-08-26 (.js in .zip) - campaign: ""office equipment"""
"CIRCL","08/04/2017 09:57:40","744","OSINT - The Blockbuster Sequel"
"CIRCL","06/02/2020 10:51:44","745","Warzone RAT"
"CthulhuSPRL.be","22/06/2017 21:24:39","746","OSINT The Sofacy plot thickens by PwC"
"CIRCL","18/07/2016 13:25:04","747","Malspam 2016-07-18 .wsf (campaign: ""bank account report"")"
"CIRCL","26/05/2016 10:54:43","748","Malspam - Locky - 2016-05-26 (.docm)"
"CIRCL","27/04/2016 08:25:21","749","OSINT - New Poison Ivy Activity Targeting Myanmar, Asian Countries"
"CIRCL","27/06/2017 21:03:01","750","OSINT - Déjà vu: Petya ransomware appears with SMB propagation capabilities"
"CIRCL","13/02/2016 14:20:26","751","OSINT - A Look Into Fysbis: Sofacy’s Linux Backdoor"
"CthulhuSPRL.be","16/08/2016 15:47:42","752","Rule to detect KirBi ticket for Mimikatz by Benjamin Delpy with Contribution of Didier Stevens"
"CthulhuSPRL.be","13/11/2014 11:29:44","753","OSINT Adobe Zero-day Used in LadyBoyle Attack blog post by Symantec"
"CthulhuSPRL.be","18/08/2016 13:46:44","754","Pivot on Shakti domains via PassiveTotal"
"CIRCL","16/03/2020 10:48:32","755","OSINT - new sample of operation lagtime TA428"
"CIRCL","07/03/2016 09:35:30","756","OSINT - New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer"
"Synovus Financial","29/05/2018 13:19:16","757","Talos Blog: Threat Roundup for May 18-25"
"CIRCL","25/08/2017 07:42:12","758","Malspam 2017-08-25 'Your Sage subscription invoice is ready'"
"CthulhuSPRL.be","15/06/2016 15:28:27","759","OSINT New Sofacy Attacks Against US Government Agency by Palo Alto Unit 42"
"CIRCL","18/07/2016 15:40:50","760","Malspam 2016-07-18 .wsf (campaign: ""company database"")"
"CthulhuSPRL.be","02/11/2015 22:26:45","761","OSINT Digging for Groundhogs: Holes in Your Linux Server by Checkpoint"
"CIRCL","13/12/2018 21:48:05","762","OSINT - ‘Operation Sharpshooter’ Targets Global Defense, Critical Infrastructure"
"CthulhuSPRL.be","13/04/2015 09:41:59","763","FBI Flash Message: MC-000055-BT EC3/IC4 takedown of the AAEH botnet"
"CthulhuSPRL.be","11/11/2015 07:39:01","764","OSINT Macro documents with XOR Encoded Payloads by PhishMe"
"CIRCL","20/04/2018 10:11:57","765","OSINT - Talos/Cisco Threat Roundup for April 6 - 13"
"CIRCL","24/08/2017 15:01:35","766","OSINT - Threat Spotlight: Is Fireball Adware or Malware?"
"clearskysec.com","26/07/2016 13:08:10","767","YellowAlbatross/Sphinx malware by 360-Qihoo and some OSINT"
"CthulhuSPRL.be","08/08/2016 16:36:54","768","OSINT Group5: Syria and the Iranian Connection by Citizen Lab"
"CIRCL","12/10/2016 09:17:28","769","OSINT - Odinaff: New Trojan used in high level financial attacks"
"CthulhuSPRL.be","16/01/2018 13:25:07","770","Finding Nemo(hosts) from Sofacy by ThreatConnect"
"CIRCL","20/12/2017 04:00:26","771","OSINT - Active ransomware attack uses impersonation and embedded advanced threats"
"CIRCL","21/07/2017 16:42:35","772","OSINT - Linux.Bew: un backdoor para el minado de Bitcoin"
"CIRCL","09/04/2019 20:21:59","773","OSINT - STUXSHOP The Oldest Stuxnet Component Dials Up"
"CIRCL","22/04/2016 15:13:47","774","OSINT - Teaching an old RAT new tricks"
"CIRCL","04/12/2017 04:00:24","775","OSINT - Fake Windows Troubleshooting Support Scam Uploads Screenshots & Uses Paypal"
"CIRCL","08/06/2020 11:59:18","776","OSINT - New Cyber Operation Targets Italy: Digging Into the Netwire Attack Chai"
"CthulhuSPRL.be","31/07/2015 09:31:18","777","OSINT Exploring .XYZ (Another Shady TLD Report) by Blue Coat"
"CIRCL","05/04/2016 14:07:32","778","Malspam (2016-04-05) - TeslaCrypt"
"CthulhuSPRL.be","26/06/2017 13:36:09","779","OSINT Following the Trail of BlackTech’s Cyber Espionage Campaigns by TrendMicro"
"CIRCL","07/03/2019 15:54:20","780","OSINT - New SLUB Backdoor Uses GitHub, Communicates via Slack"
"CIRCL","15/07/2016 11:58:13","781","Malspam 2016-07-15 .zip/.jse"
"CIRCL","28/08/2019 13:29:12","782","OSINT - Gamaredon group"
"CIRCL","08/09/2017 16:10:54","783","Malspam 2017-09-08 - 'Microsoft Store E-invoice for your order #'"
"CIRCL","03/12/2017 07:37:22","784","OSINT - Google Discovers New Tizi Android Spyware"
"CIRCL","15/03/2019 15:15:24","785","Fake invoice (per postal mail)"
"CIRCL","28/04/2017 15:03:57","786","OSINT - Use of DNS Tunneling for C&C Communications"
"CIRCL","29/08/2016 14:58:18","787","Malspam 2016-08-26 (.js in .zip) - campaign: ""monthly report"""
"CIRCL","10/04/2018 21:14:51","788","OSINT - New Matrix Ransomware Variants Installed Via Hacked Remote Desktop Services"
"laskowski-tech.com","01/09/2020 04:40:33","789","Racoon Stealer"
"CIRCL","20/12/2017 04:00:57","790","OSINT - Still stealing"
"CIRCL","09/11/2017 22:05:54","791","M2M - Locky 2017-11-07 : Affid=3, offline, "".asasin"" : ""Emailing: AZ123 - 07.11.2017"" - ""AZ123 - 07.11.2017.doc"""
"CthulhuSPRL.be","18/08/2016 15:08:20","792","OSINT Domains and IPs involved in JS ransomware delivered through email by burberry on AlienVault OTX"
"CIRCL","10/02/2018 04:02:04","793","M2M - GlobeImposter ""..doc"" 2018-01-12 : ""Unpaid invoice "" - ""1234567.7z"""
"CIRCL","12/06/2017 10:13:25","794","OSINT - MacRansom: Offered as Ransomware as a Service"
"CthulhuSPRL.be","30/01/2015 08:44:01","795","OSINT New 'f0xy' malware is intelligent - employs cunning stealth & trickery from Websense"
"CIRCL","28/03/2016 14:20:02","796","OSINT - TREASUREHUNT: A CUSTOM POS MALWARE TOOL"
"CIRCL","27/06/2016 10:40:58","797","OSINT - Doh! New ""Bart"" Ransomware from Threat Actors Spreading Dridex and Locky"
"CthulhuSPRL.be","28/09/2015 16:06:12","798","Expansion on MWI by security researcher"
"CIRCL","30/03/2016 13:31:01","799","OSINT - GongDa vs. Korean News"
"CIRCL","31/01/2017 10:44:36","800","OSINT - Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments"
"CIRCL","24/08/2017 07:54:00","801","OSINT - Malware uncovered by ESET researchers aimed at gamers"
"CthulhuSPRL.be","31/07/2015 09:40:41","802","OSINT Angler's best friends by SANS ISC Diary"
"CIRCL","27/04/2020 07:10:41","803","OSINT - Pulling Back the Curtains on EncodedCommand PowerShell Attacks"
"CIRCL","24/10/2016 07:40:39","804","OSINT - TeamXRat: Brazilian cybercrime meets ransomware"
"CIRCL","30/06/2016 08:27:36","805","Malspam 2016-06-30 (campaign subject: 'Documents copies')"
"CIRCL","11/09/2019 10:15:00","806","OSINT - ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group"
"CthulhuSPRL.be","24/05/2016 18:04:34","807","OSINT - Looking Into a Cyber-Attack Facilitator in the Netherlands by Trend Micro"
"CIRCL","15/03/2016 13:25:36","808","Potential SpamBots (2016-03-15)"
"CIRCL","10/07/2017 14:36:41","809","OSINT - SpyDealer: Android Trojan Spying on More Than 40 Apps"
"CIRCL","09/06/2017 14:08:32","810","OSINT - FIREBALL – The Chinese Malware of 250 Million Computers Infected"
"Synovus Financial","02/09/2020 05:29:35","811","Email Credential Phish, Dropbox Theme"
"CIRCL","01/10/2016 09:12:49","812","OSINT - Investigation of Linux.Mirai Trojan family"
"CIRCL","19/04/2017 07:28:14","813","OSINT - Callisto Group"
"CthulhuSPRL.be","18/08/2016 10:19:41","814","OSINT Potential CNC base on CCNE activities described in NSA document leak"
"CIRCL","05/09/2016 12:49:59","815","Malspam 2016-09-05 (.js in .zip) - campaign: ""Credit card receipt"""
"MalwareMustDie","23/05/2020 19:16:15","816","Linux/KAITEN AK47(a Mod-Telnet-Scanner) & Echo-loader hexstrings spread"
"CIRCL","12/04/2016 15:17:41","817","Dridex (2016-04-12)"
"CIRCL","07/04/2016 15:53:43","818","Information stealer: Fareit"
"CIRCL","21/06/2017 15:41:51","819","M2M - Locky 2017-06-21 : Affid=3 : ""Copy of Invoice 87654321"" - ""87654321.zip"""
"CIRCL","16/06/2017 13:41:38","820","M2M - Trickbot 2017-06-14 : mac1 : ""Emailing: 123456789"" - ""123456789.PDF"""
"CthulhuSPRL.be","22/06/2017 21:20:29","821","OSINT Darkhotel’s attacks in 2015 by Kaspersky"
"CIRCL","21/10/2016 15:14:18","822","Spam week 43 (mule acquisition) - probably related to Locky resources"
"CIRCL","26/06/2017 10:53:14","823","OSINT - El Machete's Malware Attacks Cut Through LATAM"
"CIRCL","05/02/2017 18:23:47","824","OSINT - From RTF to Cobalt Strike passing via Flash"
"CIRCL","24/05/2016 07:29:19","825","OSINT - Targeted Attacks against Banks in the Middle East"
"CIRCL","18/05/2017 20:21:00","826","OSINT - New Loki Variant Being Spread via PDF File"
"CIRCL","13/10/2018 15:31:59","827","OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan"
"MalwareMustDie","16/09/2019 15:13:08","828","On-memory post exploit payloads from encoded binary"
"CIRCL","04/12/2019 14:43:04","829","Malicious PyPI packages"
"CIRCL","13/09/2018 14:48:18","830","OSINT - Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall"
"Synovus Financial","10/07/2018 08:45:45","831","Talos Blog - Smoking Guns - Smoke Loader learned new tricks"
"CthulhuSPRL.be","22/06/2017 21:23:29","832","OSINT Tracking MiniDionis: CozyCar’s New Ride Is Related to Seaduke by Unit 42 Palo Alto Networks"
"CIRCL","28/10/2016 21:17:16","833","OSINT - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List"
"CIRCL","08/01/2017 11:57:46","834","OSINT - MM Core In-Memory Backdoor Returns as ""BigBoss"" and ""SillyGoose"""
"CIRCL","26/12/2019 18:05:58","835","OSINT - Let’s play (again) with Predator the thief – Fumik0_'s box"
"ESET","21/07/2017 13:57:09","836","Stantinko investigation"
"CthulhuSPRL.be","21/09/2015 13:21:42","837","OSINT Password Hygiene: Hiding Your Identity is Difficult for Attackers and Adulterers by Threat Geek"
"CthulhuSPRL.be","03/12/2015 17:06:05","838","OSINT Yara rules for GlassRAT in Loki IOC Scanner by Florian Roth"
"CIRCL","10/03/2016 08:14:00","839","Malspam (2016-03-09) - Locky, TeslaCrypt"
"CIRCL","28/06/2016 09:12:39","840","OSINT - Linux/GafGyt - DVR devices compromised/infected"
"CIRCL","08/11/2016 08:00:54","841","OSINT - Exaspy – Commodity Android Spyware Targeting High-level Executives"
"CIRCL","10/02/2018 04:01:13","842","OSINT - DownAndExec: Banking malware utilizes CDNs in Brazil"
"CIRCL","28/08/2017 15:23:14","843","OSINT - The ZAYKA and NOOB CryptoMix Ransomware Variants Released in Quick Succession"
"CIRCL","30/12/2019 18:42:20","844","OSINT - Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin"
"CIRCL","05/07/2019 20:26:41","845","OSINT - Threat Spotlight: Ratsnif - New Network Vermin from OceanLotus"
"CIRCL","19/09/2018 06:21:36","846","OSINT (expanded) - Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows"
"CIRCL","26/01/2017 17:30:29","847","Malware 2017-01-26 (.js in .zip) - Cerber"
"CthulhuSPRL.be","24/11/2014 12:22:35","848","OSINT Roaming tiger by Anton Cherepanov from ESET"
"CIRCL","03/10/2018 12:20:28","849","OSINT - Skygofree: Following in the footsteps of HackingTeam"
"CIRCL","02/03/2017 21:24:53","850","OSINT - Covert Channels and Poor Decisions: The Tale of DNSMessenger"
"CIRCL","15/03/2016 09:37:14","851","OSINT - Locky Ransomware Arrives via Email Attachment"
"CIRCL","02/06/2017 16:58:31","852","M2M - Jaff 2017-06-02 : ""Invoice INV-1234"" - ""Invoice INV-1234.pdf"""
"CIRCL","29/09/2017 13:43:31","853","M2M - Locky 2017-09-28 : Affid=3, offline, "".ykcol"" : ""Scan Data"" - ""Scan_54321.7z"""
"CIRCL","08/04/2018 16:30:50","854","OSINT - The WhiteRose Ransomware Is Decryptable & Tells A Strange Story"
"CIRCL","26/06/2019 21:04:13","855","An Analysis of Linux.Ngioweb Botnet"
"CIRCL","22/06/2017 10:20:01","856","M2M - phishing URLs"
"CIRCL","25/05/2016 07:57:34","857","OSINT - Dogspectus Ransomware Analysis"
"CIRCL","28/08/2017 15:24:16","858","OSINT - Reyptson Ransomware Spams Your Friends by Stealing Thunderbird Contacts"
"MalwareMustDie","30/09/2019 18:59:46","859","New IoT multiplatform Linux malware: Linux/AirDropBot"
"CIRCL","14/10/2016 21:03:42","860","ELF Linux/NyaDrop"
"CIRCL","15/02/2017 20:53:28","861","OSINT - Who Ran Leakedsource.com?"
"CthulhuSPRL.be","20/11/2017 16:03:55","862","OSINT The Path to Mass-Producing Cyber Attacks by FireEye"
"Synovus Financial","05/05/2020 18:18:18","863","Talos: Threat Roundup for August 3-10"
"CIRCL","13/01/2017 08:32:25","864","OSINT - shadow-brokers-windows"
"CIRCL","19/10/2017 16:47:00","865","M2M - Locky 2017-10-18 : Affid=3, offline, "".asasin"" : ""Message from 02087654321"" - ""Voice Message.7z"""
"CIRCL","12/05/2016 20:42:44","866","OSINT - Chinese-language Ransomware Makes An Appearance"
"CIRCL","13/03/2017 13:39:55","867","OSINT - New Linux Malware Exploits CGI Vulnerability"
"CIRCL","26/07/2018 14:13:44","868","OSINT - Kronos Reborn"
"CIRCL","12/12/2018 14:53:11","869","OSINT - Locky: the encryptor taking the world by storm"
"CIRCL","17/12/2016 09:59:32","870","OSINT - PROMETHIUM and NEODYMIUM: Parallel zeroday attacks targeting individuals in Europe"
"CIRCL","28/02/2018 19:53:36","871","OSINT - Sofacy Attacks Multiple Government Entities"
"CIRCL","19/01/2017 14:38:11","872","OSINT - FINDING THE RAT’S NEST"
"CIRCL","25/05/2019 09:14:21","873","OSINT - Sorpresa! JasperLoader targets Italy with a new bag of tricks"
"CIRCL","09/11/2017 21:20:34","874","M2M - Locky 2017-11-08 : Affid=3, offline, "".asasin"" : ""Invoice AX1234567"" - ""Invoice-AX1234567.doc"""
"CthulhuSPRL.be","22/06/2017 21:11:19","875","OSINT Vawtrak C2 – Pin it by Threat Geek"
"CIRCL","26/07/2016 13:29:00","876","OSINT - Patchwork cyberespionage group expands targets from governments to wide range of industries"
"CIRCL","29/02/2016 22:25:02","877","OSINT - New Hacking team samples (OSX)"
"CIRCL","27/04/2019 08:43:18","878","OSINT - BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat"
"CthulhuSPRL.be","15/06/2016 15:29:39","879","OSINT Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team report by iSight"
"CIRCL","26/01/2017 22:54:25","880","OSINT - EITest Nabbing Chrome Users with a “Chrome Font” Social Engineering Scheme"
"CIRCL","12/10/2017 18:42:26","881","M2M - Locky Affid=3, "".asasin""/Trickbot ""mac1"" 2017-10-11 : ""Supplement payment 1234567890"" - ""F1234567890_11102017.7z"""
"CthulhuSPRL.be","05/10/2015 09:37:32","882","OSINT YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs by Palo Alto Networks Unit 42"
"Synovus Financial","03/08/2018 15:36:32","883","Phishing Domains, MALWAREMESSIAGH"
"CIRCL","04/04/2019 11:59:49","884","OSINT- WinRAR Zero-day (CVE-2018-20250) Abused in Multiple Campaigns"
"The DFIR Report","03/08/2020 21:04:33","885","Dridex to Empire"
"CIRCL","07/01/2017 15:10:14","886","OSINT - 2016 Updates to Shifu Banking Trojan"
"CthulhuSPRL.be","06/10/2014 08:12:57","887","OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks"
"CIRCL","28/06/2016 07:02:52","888","Malspam 2016-06-28 (Locky campaign subject: 'Updated')"
"CIRCL","12/09/2018 13:36:30","889","OSINT - Sigma Ransomware Being Distributed Using Fake Craigslist Malspam"
"CIRCL","25/09/2017 12:39:00","890","M2M - Locky 2017-09-21/22 : Affid=3, offline, "".ykcol"" : ""PIC_1234"" - ""PIC_1234.7z"""
"CIRCL","04/12/2017 04:00:40","891","OSINT - Tizi: Detecting and blocking socially engineered spyware on Android"
"CIRCL","25/04/2019 20:32:04","892","OSINT - Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware"
"CIRCL","26/05/2017 14:14:36","893","OSINT - Analysis of Emotet v4"
"CIRCL","26/06/2019 19:50:47","894","Soft Cell case - guessed indicators (via Twitter discussion)"
"CthulhuSPRL.be","22/02/2017 11:06:41","895","OSINT DTL-12012015-01: Hong Kong SWC attack from Dragon Threat Labs"
"CIRCL","04/04/2016 16:22:13","896","OSINT - Meet Remaiten – a Linux bot on steroids targeting routers and potentially other IoT devices"
"Hestat","01/05/2020 14:14:19","897","Tracking Powershell Empire C2 via Urlscan"
"CIRCL","17/01/2017 16:23:13","898","OSINT - Switcher: Android joins the ‘attack-the-router’ club"
"CIRCL","15/08/2018 19:37:14","899","OSINT - 肚脑虫组织（APT-C-35）移动端攻击活动揭露"
"CIRCL","30/08/2016 07:56:19","900","OSINT - German Speakers Targeted by SPAM Leading to Ozone RAT"
"CIRCL","29/03/2017 10:23:30","901","OSINT - Dimnie: Hiding in Plain Sight"
"CIRCL","16/09/2016 18:14:57","902","Malspam 2016-09-16 (.wsf in .zip) - campaign: ""(SCAN|FAX|DOC|IMG)_{integer}"""
"Synovus Financial","01/08/2018 13:32:18","903","Talos Blog: Multiple Cobalt Personality Disorder"
"CthulhuSPRL.be","11/09/2015 13:39:40","904","OSINT Musical Chairs: Multi-Year Campaign Involving New Variant of Gh0st Malware by Palo Alto Networks Unit 42"
"CIRCL","19/11/2018 15:25:46","905","OSINT - CozyBear – In from the Cold?"
"CthulhuSPRL.be","25/08/2015 14:41:18","906","OSINT Technical Analysis Tracks the Sakula Malware Family by SecureWorks"
"wilbursecurity.com","15/02/2020 00:06:54","907","XMRig & Masscan"
"CIRCL","12/07/2016 15:16:31","908","OSINT - NetTraveler APT Targets Russian, European Interests"
"CIRCL","08/02/2019 12:49:18","909","OSINT - DanaBot updated with new C&C communication"
"CthulhuSPRL.be","28/06/2016 10:28:37","910","OSINT Threat Group-4127 Targets Google Accounts by Secureworks"
"CIRCL","02/09/2016 15:19:09","911","Malspam 2016-09-02 (.wsf in .zip) - campaign: ""icloud.com"""
"CthulhuSPRL.be","18/12/2014 20:09:14","912","OSINT 20141029B: Possible RedOctober APT Resurgence from ThreatConnect"
"CIRCL","10/03/2017 20:29:28","913","OSINT - Wikileaks Vault7 JQJSNICKER code leak"
"VK-Intel","05/05/2020 17:30:31","914","2019-03-08: TerraLoader Signed -> JS RAT"
"CIRCL","18/12/2018 15:22:20","915","OSINT - New Bomb Threat Email Scam Campaign Demanding $20K in Bitcoin"
"CIRCL","23/07/2016 08:47:22","916","OSINT - Kovter becomes almost file-less, creates a new file type, and gets some new certificates"
"CIRCL","30/09/2016 08:29:54","917","Malspam 2016-09-30 (.wsf in .zip) - campaign: ""Emailing"""
"CIRCL","11/10/2016 08:07:08","918","OSINT - How Stampado Ransomware Analysis Led To Yara Improvements"
"CIRCL","23/12/2019 15:43:48","919","OSINT - Reversing a real-world 249 bytes backdoor!"
"CIRCL","25/09/2017 14:03:16","920","M2M - Locky: ""Invoice RE-2017-09-21-00xxx"" from ""Amazon Marketplace"""
"CthulhuSPRL.be","21/05/2015 14:01:12","921","OSINT Trend Micro Exposes LURID APT"
"CIRCL","18/06/2016 09:18:07","922","OSINT - Setting Sights On Retail: AbaddonPOS Now Targeting Specific POS Software"
"CthulhuSPRL.be","18/11/2014 23:12:22","923","OSINT Additional indicators relating to Sofacy (APT28) phishing blog post by PWC"
"CthulhuSPRL.be","07/06/2015 20:31:12","924","OSINT Angler EK: More Obfuscation, Fake Extensions, and Other Nonsense by Talos"
"Synovus Financial","15/05/2018 16:49:53","925","Emotet - 5/8/2018"
"CthulhuSPRL.be","08/08/2016 15:12:25","926","OSINT Lost your iPhone? Be on guard for a perfectly-timed Apple ID phishing attack by Hot For Security"
"CIRCL","13/07/2017 09:17:31","927","OSINT - LockPoS Joins the Flock"
"CIRCL","23/01/2017 23:20:06","928","OSINT - A Whale of a Tale: HummingBad Returns"
"CIRCL","02/05/2019 14:21:30","929","OSINT - Goblin Panda continues to target Vietnam"
"CIRCL","22/12/2017 04:01:01","930","OSINT - North Korea Bitten by Bitcoin Bug: Financially motivated campaigns reveal new dimension of the Lazarus Group"
"CIRCL","24/03/2017 08:19:58","931","OSINT - New targeted attack against Saudi Arabia Government"
"CIRCL","24/01/2019 13:23:06","932","Incident - pear.php.net - compromised and delivering malicious package"
"CIRCL","28/04/2017 07:14:50","933","OSINT - Similarities Between Carbanak and FIN7 Malware Suggest Actors Are Closely Related"
"VK-Intel","31/01/2019 21:35:34","934","2019-01-31: ISFB v2 Installs Dridex ""3101"""
"CIRCL","01/07/2016 08:57:35","935","OSINT - Pacifier APT"
"CIRCL","08/05/2019 10:38:46","936","OSINT - CARBANAK Week - Fire Eye"
"CIRCL","25/08/2017 07:56:50","937","Malspam 2017-08-24 'Bill-'"
"CIRCL","03/11/2019 09:01:04","938","OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium"
"CthulhuSPRL.be","11/06/2016 23:49:59","939","OSINT - Rotten Apples: Apple-Like Malicious Phishing Domains by FireEye"
"CIRCL","27/03/2017 07:45:43","940","OSINT - Nasty adware hiding in apps on Google Play Store"
"Synovus Financial","05/05/2020 18:10:22","941","Registrant Tracking for ""[email protected]"""
"MalwareMustDie","18/05/2020 08:37:33","942","KuGou trojan backdoor campaign aim RDP on HFS panels"
"CIRCL","27/08/2019 09:27:26","943","OSINT - FlawedAmmy RAT"
"CthulhuSPRL.be","04/05/2015 10:46:08","944","OSINT Dalexis/CTB-Locker malspam campaign by SANS Internet Storm Center"
"CIRCL","19/02/2018 16:19:23","945","OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers"
"CthulhuSPRL.be","22/02/2017 10:48:32","946","Sinkholes servers with http header Server: malware-sinkhole"
"CIRCL","12/09/2016 15:24:23","947","Malspam 2016-09-12 (.js in .zip) - campaign: ""Budget report"""
"Synovus Financial","02/07/2020 08:16:20","948","Blog Post: EMOTET INFECTION WITH ICEDID"
"CIRCL","05/12/2018 11:21:07","949","MAR-10166283.r1.v1 (SamSam ransomware)"
"CIRCL","05/10/2017 21:02:53","950","M2M - Locky 2017-10-04 : Affid=3, offline, "".ykcol"" : ""Message from 02087654321"" - ""Voice Message.7z"""
"CERT-RLP","23/09/2019 14:15:30","951","Evasive Sage 2.2 Ransomware"
"CthulhuSPRL.be","03/08/2020 07:31:12","952","OSINT Morpho: Profiting from high-level corporate attacks by Symantec"
"CthulhuSPRL.be","29/09/2015 08:06:20","953","OSINT Microsoft Word Intruder gets down to business: Operation Pony Express by Sophos"
"CIRCL","10/12/2019 10:30:17","954","OSINT - #EmissaryPanda #APT older sample (2018)"
"CIRCL","12/10/2017 18:23:26","955","M2M - Locky Affid=3, "".asasin""/Trickbot ""mac1"" 2017-10-11 : ""Emailing: 12345678"" - ""12345678.7z"""
"CIRCL","30/06/2016 12:40:05","956","OSINT - Satana ransomware – threat coming soon?"
"CthulhuSPRL.be","07/09/2015 14:53:52","957","OSINT Defending the White Elephant by Arbor Networks"
"CthulhuSPRL.be","24/02/2016 16:44:32","958","OSINT Dust Storm Campaign Targeting Japanese Critical Infrastructure"
"CIRCL","16/12/2017 04:00:22","959","OSINT - File Spider Ransomware Targeting the Balkans With Malspam"
"CIRCL","18/02/2017 18:33:12","960","OSINT - Demystifying targeted malware used against Polish banks"
"CIRCL","08/07/2016 10:44:58","961","OSINT - ASERT Threat Intelligence Report 2016-03 The Four-Element Sword Engagement"
"CIRCL","10/02/2018 04:01:02","962","OSINT - GratefulPOS credit card stealing malware - just in time for the shopping season"
"CIRCL","25/09/2017 12:40:06","963","M2M - Locky 2017-09-18 : Affid=3, offline, "".ykcol"" : ""Message from KM_C224e"" - ""20171809_12345678901.7z"""
"CIRCL","01/09/2017 20:54:26","964","OSINT - Gazing at Gazer"
"CIRCL","07/04/2017 11:20:28","965","OSINT - Off-the-shelf Ransomware Used to Target the Healthcare Sector"
"CIRCL","22/04/2016 21:25:49","966","OSINT - New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists"
"CIRCL","20/06/2017 07:44:06","967","OSINT - McAfee Discovers Pinkslipbot Exploiting Infected Machines as Control Servers; Releases Free Tool to Detect, Disable Trojan"
"CIRCL","15/06/2017 09:44:01","968","M2M - Jaff 2017-06-13 : ""Invoice PIS1234567.zip"""
"CIRCL","13/02/2019 16:29:23","969","OSINT - ChessMaster Makes its Move: A Look into the Campaign’s Cyberespionage Arsenal"
"CIRCL","20/01/2017 08:55:03","970","OSINT - Spora - the Shortcut Worm that is also a Ransomware"
"CIRCL","21/04/2019 14:33:54","971","OSINT - 97 domains phishing spread over 10 IP's"
"CIRCL","15/03/2016 22:35:08","972","Dridex botnet 222 (20160315)"
"CIRCL","13/01/2018 04:01:07","973","OSINT - Suspicious binary delivered as fake jpeg"
"CthulhuSPRL.be","03/11/2017 14:54:36","974","OSINT Leviathan: Espionage actor spearphishes maritime and defense targets"
"CIRCL","10/07/2016 11:12:41","975","OSINT - The Dropping Elephant – aggressive cyber-espionage in the Asian region"
"CthulhuSPRL.be","16/01/2018 13:23:08","976","OSINT Duping Doping Domains - Possible Fancy Bear Domains Spoofing Anti-Doping and Olympic Organizations by ThreatConnect"
"CIRCL","05/07/2017 10:11:00","977","M2M - Trickbot 2017-06-27 : mac1 : ""facture 654321"" - ""abonneau_654321.docm"""
"CIRCL","08/09/2017 12:42:05","978","OSINT - New multi platform malware/adware spreading via Facebook Messenger"
"CIRCL","09/08/2016 14:57:10","979","OSINT - Strider: Cyberespionage group turns eye of Sauron on targets"
"CthulhuSPRL.be","13/09/2015 21:49:26","980","OSINT A Peek Inside an Affiliate’s Malspam Operation: Kovter and Miuref/Boaxxe Infections by PhishMe"
"MalwareMustDie","14/05/2020 21:14:31","981","Linux/Mirai-Hilix (w/New TABLE encoder) aims Realtek & Huawei routers"
"CIRCL","24/03/2020 15:10:06","982","OSINT - revengeRAT targeting France"
"CIRCL","16/10/2016 06:09:34","983","Spam 2016-10-16 (mule acquisition) - probably related to Locky resources"
"CIRCL","13/12/2016 09:08:32","984","OSINT - Windows 10: protection, detection, and response against recent Depriz malware attacks"
"CIRCL","29/03/2018 15:52:37","985","OSINT - March 28, 2018: Malware Analysis Report (MAR-10135536.11) – North Korean Trojan: SHARPKNOT"
"CIRCL","17/08/2016 15:22:22","986","Malspam 2016-08-17 (.docm) - campaign: ""Order Confirmation-"""
"CIRCL","12/10/2017 18:36:56","987","M2M - Locky 2017-10-10 : Affid=3, offline, "".asasin"" : ""Voicemail From 845-551-1234"" - ""VMSG12345678_20171010.7z"""
"wilbursecurity.com","31/01/2020 08:35:51","988","Emotet/Trickbot"
"Synovus Financial","23/05/2018 06:20:41","989","Panda Malware Broadens - F5 Blog"
"CIRCL","01/02/2018 04:00:34","990","OSINT - Analyzing CrossRAT"
"CIRCL","28/03/2016 09:02:33","991","OSINT - McAfee Labs Threat Advisory Ransomware-Locky"
"CIRCL","10/03/2018 21:34:44","992","OSINT - New traces of Hacking Team in the wild"
"CIRCL","09/06/2017 07:54:12","993","M2M - Password-protected docs 2017-06-07 : ""John C Doe"" - ""ab1_c23def4lg56hi#78j.docx"""
"CthulhuSPRL.be","19/06/2015 12:54:58","994","OSINT Poseidon And Backoff Pos – The Links And Similarities by Team Cymru"
"CthulhuSPRL.be","03/08/2020 07:34:15","995","OSINT Expansion on Additional indicators relating to Sofacy (APT28) phishing blog post by PWC"
"CIRCL","08/04/2018 16:09:39","996","OSINT - Mole66 Cryptomix Ransomware Variant Released"
"CIRCL","14/07/2017 20:00:20","997","M2M - #trickbot Lloyds Bank"
"wilbursecurity.com","31/01/2020 08:18:33","998","VBS Downloader and Defender Control"
"CIRCL","28/04/2017 08:27:45","999","OSINT - Alert (TA17-117A) Intrusions Affecting Multiple Victims Across Multiple Sectors"