{"count":17,"next":"https://api.systemassurancesolutions.com/api/intelligence/?page=2","previous":null,"results":[{"id":17,"title":"RustDuck: An In-Depth Analysis of a Two-Stage Botnet","source":"OTX","category":"THREAT","external_id":"6a4635e7998db450b0ccdee2","description":"Since February 2026, a new malware family utilizing a Loader plus Core two-stage architecture has been detected, primarily conducting large-scale DDoS attacks with strong cross-platform capabilities. The family is transitioning from C to Rust programming language, demonstrating rapid evolution in anti-defense and traffic encryption techniques. Propagation methods include weak password brute-forcing via Telnet and SSH, exploitation of IoT device vulnerabilities affecting Android ADB, TVT API, Ruijie, TP-Link, and ZTE devices, plus web component vulnerabilities in ThinkPHP, Jenkins, and YARN. The botnet employs sophisticated anti-debugging mechanisms including environment checks, honeypot detection, and timing verification. Communication protocols leverage Curve25519 key exchange, ChaCha20-Poly1305 and AES-GCM encryption, implementing strict handshake verification processes. Over 20 IPs have been observed spreading the botnet, with multiple variants showing increasingly complex encryption and obfuscation techn","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a4635e7998db450b0ccdee2","tlp":"white","tags":["two-stage loader","ddos botnet","cve-2025-29635","iot compromise","cve-2018-8007","weak password attacks","encrypted c2","cross-platform","cve-2017-17215","cve-2024-1781","anti-debugging","rustduck"],"references":["https://blog.xlab.qianxin.com/rustduck-en/"],"indicator_count":23,"created_at":"2026-07-02T09:56:55.843000Z","modified_at":"2026-07-02T09:57:58.879000Z","ingested_at":"2026-07-02T10:00:15.279165Z"},{"id":16,"title":"Inside an affiliate panel targeting Microsoft 365","source":"OTX","category":"THREAT","external_id":"6a4500fd1580f75d3cf32d5e","description":"Cisco Talos discovered ARToken, a sophisticated phishing-as-a-service panel sharing infrastructure and operational patterns with the EvilTokens platform. The panel exposes over 80 API endpoints enabling device code phishing, Primary Refresh Token persistence, email access, business email compromise operations, and SharePoint exfiltration through a React-based dashboard. The platform deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads. ARToken abuses Microsoft's OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication entirely. Analysis reveals post-compromise capabilities including token management across password resets, automated BEC operations, inbox rule manipulation for evidence suppression, cross-account keyword monitoring, and SharePoint file operations. The platform operates as multi-tenant infrastructure with subscription-based affiliate access, representing a complete operations environment rather than simple phish...","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a4500fd1580f75d3cf32d5e","tlp":"white","tags":["oauth abuse","phishing-as-a-service","eviltokens","business email compromise","microsoft 365","artoken","device code phishing","primary refresh token"],"references":["https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/"],"indicator_count":5,"created_at":"2026-07-01T11:58:53.526000Z","modified_at":"2026-07-02T07:03:17.390000Z","ingested_at":"2026-07-02T08:00:04.738809Z"},{"id":15,"title":"Iran-Nexus Disseminates MarkiRAT Surveillance Tool","source":"OTX","category":"THREAT","external_id":"6a45471afccee96152675f88","description":"TAG-182, an Iran-nexus threat cluster, is conducting surveillance operations targeting Iranian citizens both domestically and abroad using MarkiRAT malware. The group distributes fake Android applications masquerading as VPN services and media players through social media platforms, particularly Instagram. Following Iran's partial internet restoration in May 2026 after an 88-day shutdown, these surveillance activities have intensified as Iranian security apparatus seeks to monitor perceived dissidents and anti-government activists. MarkiRAT samples demonstrate tradecraft overlaps with previously documented Ferocious Kitten operations, including use of Background Intelligent Transfer Service (BITS). The group operates infrastructure across multiple autonomous systems, utilizing domains with naming conventions mimicking legitimate services like Microsoft, Google, and Facebook.","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a45471afccee96152675f88","tlp":"white","tags":["ferocious kitten","irgc","furball","surveillance","iran","fake vpn","bouldspy","markirat","tag-182","dchspy","farsi-speaking targets"],"references":["https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat","https://www.recordedfuture.com/research/media_11d60acbcd8901a8e5c5002f7f21ae6e799acee43.gif?width=1200&format=pjpg&optimize=medium"],"indicator_count":85,"created_at":"2026-07-01T16:58:02.320000Z","modified_at":"2026-07-02T06:59:28.882000Z","ingested_at":"2026-07-02T07:00:09.131633Z"},{"id":14,"title":"Sauron - Malware Domain Feed V2","source":"OTX","category":"THREAT","external_id":"628dff37032808c7c9e014dc","description":"Command and Control domains for Sauron. These domains are extracted from a number of sources, and are suspicious.","severity":"Critical","author_name":"otxrobottwo","pulse_url":"https://otx.alienvault.com/pulse/628dff37032808c7c9e014dc","tlp":"white","tags":[],"references":[],"indicator_count":133343,"created_at":"2022-05-25T10:04:39.623000Z","modified_at":"2026-07-01T19:49:11.706000Z","ingested_at":"2026-07-01T23:00:17.898010Z"},{"id":13,"title":"A stealthy RAT burrowing deep into Android devices","source":"OTX","category":"THREAT","external_id":"6a1cc51d7c8f832f819a0a43","description":"BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a1cc51d7c8f832f819a0a43","tlp":"white","tags":["android rat","latin america","phishing campaigns","spysolr evolution","apk builder","remote access","brazil","accessibility abuse","malware-as-a-service","spysolr","btmob"],"references":["https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/"],"indicator_count":99,"created_at":"2026-05-31T23:32:45.408000Z","modified_at":"2026-06-30T23:14:56.161000Z","ingested_at":"2026-07-01T00:00:05.451892Z"},{"id":12,"title":"India's government and energy sectors targeted with ZOHOMURK and MINIRECON","source":"OTX","category":"THREAT","external_id":"6a42d4a95543681c96ad0e57","description":"Mustang Panda orchestrated two concurrent espionage campaigns targeting Indian government entities and hydropower infrastructure between May and June 2026. The campaigns leveraged DLL sideloading via legitimate executables to deploy newly identified malware including SHARDLOADER, MINIRECON, and ZOHOMURK. MINIRECON represents an evolution of Toneshell with WebSocket-based command-and-control capabilities, while ZOHOMURK abuses Zoho WorkDrive cloud services for C2 communications and data exfiltration. Distribution occurred through spear-phishing with lures themed around India-Taiwan cooperation agreements and hydropower projects. The activity demonstrates code overlaps with previous tooling, infrastructure proximity to known operations, and targeting patterns aligned with Chinese strategic intelligence collection priorities. Multiple compromised government systems were identified, with coordination conducted through CERT-In for victim notification and remediation.","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a42d4a95543681c96ad0e57","tlp":"white","tags":["india","government targeting","websocket","minirecon","zohomurk","shadowpad","cloud c2","hydropower","espionage","pubload","shardloader","toneshell","zoho workdrive","dll sideloading"],"references":["https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/"],"indicator_count":17,"created_at":"2026-06-29T20:25:13.182000Z","modified_at":"2026-06-30T13:59:44.119000Z","ingested_at":"2026-06-30T21:00:08.339063Z"},{"id":11,"title":"Rapid growth and a new ransomware variant","source":"OTX","category":"THREAT","external_id":"6a42506c95cc259404196a5b","description":"The Gentlemen ransomware-as-a-service group emerged as a top-10 threat actor in the first half of 2026. The group exploits vulnerabilities in internet-facing devices like VPNs and firewalls, potentially collaborating with initial access brokers. They employ comprehensive reconnaissance using tools like SharpADWS, NetScan, and Advanced IP Scanner, capturing network traffic with netsh. The attackers disable security products through BYOVD techniques using vulnerable drivers, and deploy custom Go-based backdoors and ransomware variants. They spread laterally via GPO deployment and PsExec, encrypt files using Curve25519 and XChaCha20, and recently developed a C-based ransomware variant using AES256-GCM and RSA. The group targets multiple industries worldwide, particularly in Brazil, China, Indonesia, Taiwan, and Thailand, with attacks focusing on manufacturing, IT services, healthcare, and financial sectors.","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a42506c95cc259404196a5b","tlp":"white","tags":["vulnerable drivers","sharkloader","zichatbot","coolclient","gpo deployment","ransomware-as-a-service","powercloud","appleseed","mgbot","encryption tactics","byovd","reversesocks","cobalt strike","network reconnaissance","custom backdoor","lateral movement"],"references":["https://securelist.com/the-gentlemen-raas/120447/"],"indicator_count":48,"created_at":"2026-06-29T11:01:00.897000Z","modified_at":"2026-06-30T06:48:49.510000Z","ingested_at":"2026-06-30T07:00:04.075891Z"},{"id":10,"title":"New customs charges for online orders outside the EU","source":"OTX","category":"THREAT","external_id":"6a4292045a662553c3583b0a","description":"With the introduction of charges/taxes on certain items posted from outside the EU, threat actors appear to be leveraging the situation to send fraudulent SMS and email messages impersonating postal services in an attempt to harvest payment details and personal information. The campaign is already being observed targeting Irish users, and I'd like to highlight this activity publicly as part of a LinkedIn post around our Brand Protection, Threat Intelligence, and Domain Takedown capabilities.","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a4292045a662553c3583b0a","tlp":"white","tags":["customs","taxes","smishing","eu","email","phishing","impersonating","postal services","payment","scam","fraud"],"references":["https://www.ccpc.ie/consumer-advice/consumer-rights/buying-goods/buying-outside-the-eu/new-customs-charges-for-online-orders"],"indicator_count":3,"created_at":"2026-06-29T15:40:51.081000Z","modified_at":"2026-06-29T15:40:51.081000Z","ingested_at":"2026-06-29T16:00:04.200965Z"},{"id":9,"title":"Phishing Campaign PasasteSinTAG - New domain rotation identified associated with the campaign impersonating the PasasteSinTAG portal","source":"OTX","category":"THREAT","external_id":"6a42124a18e7d2cb639c06dd","description":"A phishing campaign targeting Chile continues to evolve with significant infrastructure expansion. Security researchers identified 99 new domains impersonating the legitimate PasasteSinTAG portal, with 22 domains confirmed active and 77 registered but not yet activated. The active domains utilize various top-level domains including .click, .cfd, .cyou, .mom, .best, .rest, .top, .help, .sbs, .icu, .life, .xyz, .buzz, .casa, and .pics. The infrastructure is hosted across seven IP addresses. This campaign represents an ongoing threat to Chilean users through brand impersonation tactics, with threat actors maintaining a large reserve of dormant domains for future rotation.","severity":"High","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a42124a18e7d2cb639c06dd","tlp":"white","tags":["brand impersonation","credential harvesting","pasastesintag","infrastructure","domain rotation","phishing","chile"],"references":["https://x.com/tial_cl/status/2071307374497861790"],"indicator_count":108,"created_at":"2026-06-29T06:35:54.082000Z","modified_at":"2026-06-29T10:20:27.740000Z","ingested_at":"2026-06-29T11:00:03.918881Z"},{"id":8,"title":"Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited","source":"OTX","category":"THREAT","external_id":"6a3eefb892e3d749bcf92233","description":"On June 25, 2026, the first active exploitation of CVE-2026-55255, a critical CVSS 9.9 Langflow vulnerability, was documented. Langflow is an open-source framework for building AI agents and RAG pipelines. A single operator exploited both CVE-2026-55255 (cross-tenant IDOR) and CVE-2026-33017 (unauthenticated RCE, CVSS 9.3) against the same instance. Despite its lower score, the RCE has been exploited thousands of times and is listed in CISA KEV, while the IDOR showed no prior in-the-wild exploitation. The operator focused primarily on the RCE for code execution and implant delivery, using the IDOR opportunistically for credential theft across tenants. The financially motivated threat actor deployed a scripted loader to harvest AWS keys, environment files, and API credentials. This demonstrates that CVSS scores don't always correlate with real-world exploitation rates, as unauthenticated vulnerabilities require less effort than those needing authorization and disclosed object IDs.","severity":"Critical","author_name":"AlienVault","pulse_url":"https://otx.alienvault.com/pulse/6a3eefb892e3d749bcf92233","tlp":"white","tags":["multi-tenant","cve-2026-33017","ai pipeline exploitation","cve-2026-55255","botnet deployment","langflow","rce","idor","credential theft","cvss paradox"],"references":["https://www.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited"],"indicator_count":4,"created_at":"2026-06-26T21:31:36.752000Z","modified_at":"2026-06-29T09:46:19.612000Z","ingested_at":"2026-06-29T10:00:06.532795Z"}]}