| MISP | Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling- | 4183TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Emotet coming in hot- | 2546TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike- | 1371TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Banco Estado Chile REvil attack- | 1289TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Mars, a red-hot information stealer- | 599TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs- | 382 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Update: Destructive Malware Targeting Organizations in Ukraine- | 351 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | The Unintentional Leak: A glimpse into the attack vectors of APT37APT37 - G0067 | 351TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | The BlueNoroff cryptocurrency hunt is still on- | 326TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Russian Military Cyber Actors Target US and Global Critical Infrastructure- | 293 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | The distinctive rattle of APT SideWinderSidewinder - G0121 | 287TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | AA24-249A: Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure- | 276TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Threat Actors Exploiting Ivanti EPMM Vulnerabilities- | 266 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years- | 242TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Blacksuit (Royal) RansomwareBlacksuit (Royal) | 238 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | #StopRansomware: Black BastaBlack Basta | 234 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber ActivitiesRansomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities | 229 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Increased Truebot Activity Infects U.S. and Canada Based Networks- | 221 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | PORTAL KOMBAT A structured and coordinated pro-Russian propaganda network- | 219TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Financially motivated, dangerously activated: OPERA1ER APT in Africa- | 202TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit VulnerabilityCL0P | 189 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency- | 189TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Mustang Panda deploys a new wave of malware targeting EuropeMustang Panda - G0129 | 185TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Targeted attack on industrial enterprises and public institutionsTA428 | 185TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | AA24-207A North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime\'s Military and Nuclear Programs- | 180TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Cuba RansomwareCuba | 178 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense SectorsTortoiseshell | 173TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Akira RansomwareAkira | 164 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Sweet QuaDreams A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers- | 164TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Rhysida RansomwareRhysida | 161 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | ModifiedElephant APT and a Decade of Fabricating Evidence- | 161TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Beyond the Surface: the evolution and expansion of the SideWinder APT groupSidewinder - G0121 | 145TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Zeppelin RansomwareZeppelin | 144 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | TA505 Group’s TeslaGun In-Depth AnalysisTA505 - G0092 | 138TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations- | 135 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Unwrapping Ursnifs Gifts - The DFIR Report- | 134TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Operation Crimson Palace: Sophos threat hunting unveils multiple clusters of Chinese state-sponsored activity targeting Southeast Asian government- | 127TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | 10 Things I Hate About Attribution: RomCom vs. TransferLoaderRomCom | 124TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Backdoor Activator Malware Running Rife Through Torrents of macOS Apps- | 122TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: RansomHub RansomwareRansomHub | 121 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | #StopRansomware: Phobos RansomwarePhobos | 119 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | IoT devices and Linux-based systems targeted by OpenSSH trojan campaign- | 95TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Cyberattack on fuel supplier causes supply chain disruption- | 95TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | MAR-10382580.r1.v1: Unidentified RAT- | 94TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Investigating APT36 or Earth Karkaddan’s Attack Chain and Malware Arsenal- | 92TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization- | 91 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Earth Preta Campaign Uses DOPLUGS to Target AsiaMUSTANG PANDA | 90TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals- | 87TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | CVE-2024-21412: Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day- | 86TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Prometei botnet improves modules and exhibits new capabilities in recent updates- | 83TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications- | 82 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks- | 81 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Scraper: Rising Tide: Chasing the Currents of Espionage in the South China Sea- | 81TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Russian GRU Targeting Western Logistics Entities and Technology Companies- | 78 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | AA24-290A Iranian Cyber Actors Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations- | 76TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations- | 76 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies- | 74 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover- | 74TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Snatch RansomwareSnatch | 71 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | In Pursuit of Optical Fibers and Troop Intel: Targeted Attack Distributes PlugX in Russia- | 71TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns- | 70TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Malicious activities linked to the Nobelium intrusion setAPT29 - G0016 | 67TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Scraper: Talos WebsiteLazarus Group - G0032 | 67TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | MOD Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT- | 66TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways- | 65 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | #StopRansomware: Ghost (Cring) RansomwareGhost (Cring) | 65 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices- | 60TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Disrupting SEABORGIUM’s ongoing phishing operationsCallisto | 57TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Secret Blizzard compromising Storm-0156 infrastructure for espionage / Snowblind: The Invisible Hand of Secret BlizzardTurla | 55TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Cloud Atlas targets entities in Russia and Belarus amid the ongoing war in UkraineCloud Atlas | 55TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | #StopRansomware: Play RansomwarePlay | 53 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally- | 53 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | #StopRansomware: Medusa RansomwareMedusa | 52 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus- | 51 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities- | 50TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Under the hood of a Doppelgänger- | 50TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Iranian backed group steps up phishing campaigns against Israel, U.S.APT42 | 49TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | AA23-347A Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally- | 49TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | UAC-0063: Cyber Espionage Operation Expanding from Central AsiaAPT28 - G0007 | 47TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Return of the Evilnum APT with updated TTPs and new targetsEvilnum - G0120 | 47TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Gaza Cybergang | Unified Front Targeting Hamas Opposition- | 46TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Chinese Threat Actors Targeting Europe in SmugX CampaignMustang Panda - G0129 | 46TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | CrowdStrike Falcon Platform Detects and Prevents Active Intrusion Campaign Targeting 3CXDesktopApp CustomersLazarus Group | 46TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG- | 45 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Known Indicators of Compromise Associated with Androxgh0st Malware- | 43 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems- | 43 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | New data wiper malware used in Ukraine- | 43TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Eight Arms to Hold You: The Cuttlefish Malware- | 42TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Campaigns abusing corporate trusted infrastructure hunt for corporate credentials on ICS networks- | 42TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | TA551 (Shathak) continues pushing BazarLoader, infections lead to Cobalt StrikeTA551 - G0127 | 42TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Identification and Disruption of QakBot Infrastructure- | 41 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | Gamaredon APT targets Ukrainian government agencies in new campaignGamaredon Group - G0047 | 41TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | FontOnLake: Previously unknown malware family targeting Linux- | 41TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host- | 41TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | ScrubCrypt Deploys VenomRAT with an Arsenal of Plugins- | 40TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities- | 40 | CISA Cybersecurity Advisories | Apri dettaglio |
| IOC | Iranian State Actors Conduct Cyber Operations Against the Government of Albania- | 39 | CISA Cybersecurity Advisories | Apri dettaglio |
| MISP | ICS Threat Analysis: New, Experimental Malware Can Kill Engineering Processes- | 39TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| MISP | Analysis of Storm-0558 techniques for unauthorized email accessZIRCONIUM - G0128 | 39TLP:CLEAR | MISP EudorIA | Apri dettaglio |
| IOC | Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475- | 38 | CISA Cybersecurity Advisories | Apri dettaglio |