Threat Intelligence

We're seeing unusual patterns of login attempts against our customers netscalers with the only thing in common the user-agent: CitrixReceiver/23.11.1.41 Windows/10.0 AuthManager/23.11.0.9 (Release) X1Class CWACapable CWA/23.11.1.41 Some are brute force…

We have recently identified another new persistent citrix netscaler credential stuffing attack against one of our customers using recently compromised credentials from users who had fallen victim to infostealers.  This…

User names used by actor seen using VPNs with Canadian source IP addresses  10/05/2024. Replace targetDomain below with the domain of the VPN service (i.e. victim Domain) monitor paservice@targetDomain admin@targetDomain…

If you receive a "An internal error has occured" error message when clicking on various menu functions in the MISP UI.  This is potentially due to model cache issues.  This…

A threat activity cluster is a grouping of security alerts which are related to a unique or similar activity taking place in an environment.  It leverages less of the standard IOCs in…

1. Initial Incident Late 2023, we observed several of our users , working in different locations with different email domains but all either executive assistants or members of the different…