OTX Bot

Shuckworm Targets Foreign Military Mission Based in Ukraine

Russian-linked cyber-espionage group Shuckworm appears to be targeting a Western military mission based in Ukraine, according to research by Symantec and its partner, the UK-based security firm.

Pulse ID: 67f82020a26d2eb2bb6d4f1e
Pulse Link: otx.alienvault.com/pulse/67f82
Pulse Author: AlienVault
Created: 2025-04-10 19:46:39

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Espionage #InfoSec #Military #OTX #OpenThreatExchange #Russia #Symantec #UK #Ukr #Ukraine #Worm #bot #cyberespionage #AlienVault

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate,…

LevelBlue Open Threat Exchange
AAKL

Ulterior motives at play here. This is surveillance, no matter what you call it.

The Record: To tackle espionage, Dutch government plans to screen university students and researchers therecord.media/netherlands-pl @therecord_media #surveillance #espionage

OTX Bot

Deobfuscating APT28's HTA Trojan: A Deep Dive into VBE Techniques & Multi-Layer Obfuscation

This analysis delves into APT28's cyber espionage campaign targeting Central Asia and Kazakhstan diplomatic relations, focusing on their HTA Trojan. The malware employs advanced obfuscation techniques, including VBE (VBScript Encoded) and multi-layer obfuscation. The investigation uses x32dbg debugging to decode the obfuscated code, revealing a custom map algorithm for character deobfuscation. The process involves decoding strings using embedded characters from Windows vbscript.dll. The analysis identifies the use of Microsoft's Windows Script Encoder (screnc.exe) to create VBE files. By employing various deobfuscation techniques, including a Python script, the final malware sample is extracted and analyzed, showcasing APT28's evolving tactics in cyber espionage.

Pulse ID: 67efc6e712b49d46c1423ca9
Pulse Link: otx.alienvault.com/pulse/67efc
Pulse Author: AlienVault
Created: 2025-04-04 11:47:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT28 #Asia #CentralAsia #CyberSecurity #Espionage #ICS #InfoSec #Kazakhstan #Malware #Microsoft #OTX #OpenThreatExchange #Python #Trojan #VBS #Windows #bot #AlienVault

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate,…

LevelBlue Open Threat Exchange
Heretical_i

#Deloitte is gonna layoff? COOL! Everyone knows they're #spies @bloomberg

2016 M-fucking-SM, bitchez👇
"Accountants and spies: The secret history of Deloitte’s #espionage practice"

cnbc.com/2016/12/19/accountant

Global Threads

🇵🇱 POLAND | 🇺🇦 UKRAINE | 🇷🇺 RUSSIA
🔴 Ukraine-Born Man Charged as Russian Spy

🔸 47-year-old Ukrainian scouted military sites near Warsaw for Russia.
🔸 Admitted to having ideological ties to Moscow.
🔸 Faces 5–30 years under Polish espionage law.
🔸 Poland: 44 spies/saboteurs arrested since war began.

#Poland #Russia #Ukraine #Espionage #HybridWarfare #Security #NATO #SpyRing #Intelligence

MediaFaro Analysis

How a Bulgarian cleaning lady became a Russian spy.

Many people believed that Tsvetanka D., a Bulgarian national living in Vienna, was leading a very normal life.

Nothing could have been further from the truth: this former cleaning lady was in fact a Russian spy.

mediafaro.org/article/20250401

#Bulgaria #Austria #Espionage #Spying #Russia #Vienna #Marsalek #JanMarsalek