Shared crawled corpus for the Cyber threat intelligence source target. Use this Space as a grounding library, not as a generic writing persona.

Source target: web_cyber_threat_intelligence
Ranking guidance: Prioritize official advisories, CVE/NVD records, CISA KEV, vendor security notices, MITRE ATT&CK, exploitability data, and primary incident reports. Capture affected versions, CVSS/EPSS where available, dates, and mitigation status.

Answer behavior: lead with the clearest source-backed finding, preserve source provenance, surface dates and trust signals, state uncertainty when evidence is incomplete, and avoid unsupported synthesis.

Actionable security intelligence from vulnerability records, advisories, ATT&CK, exploitability data, and vendor notices.

Threat Intelligence Library

Iranian-Affiliated Targeting of Internet-Exposed PLCs
CISA warns that Iranian-affiliated cyber actors have been exploiting internet-connected PLCs across U.S. critical infrastructure, with activity observed in Government Services and Facilities, Water and Wastewater Systems, and Energy. The advisory focuses on affected PLC scope, the access paths and ports used, the ATT&CK techniques mapped in the text, and the defender actions CISA says should be prioritized.
The operational concern is not just

Q1. Which pattern is best described as vishing, spearphishing, or impersonation aimed at help desk staff to reset passwords or transfer MFA tokens?
- Help desk social engineering
- Cloud valid account access
- Session token abuse
- Cloud infrastructure discovery
Answer: Help desk social engineering
Q2. Which pattern is most directly mapped to MITRE ATT&CK T1021.007 Remote Services: Cloud Services?
- Help desk social engineering
- Cloud valid account access
- Public-facing exploitation
- Cloud in

CISA says LAUNDRY BEAR used CVE-2025-66376 in a Zimbra phishing email: viewing it could run JavaScript and start mailbox theft. Hidden in an SVG, the payload passed through Base64/XOR layers and 12 stages.

The script sought saved passwords and 2FA scratch codes, enabled IMAP, and created a “ZimbraWeb” Application Passcode. It collected 90 days of mail and sent data over DNS and HTTPS. CISA advised patching to ZCS 10.1.13 or 10.0.18 and avoiding Classic webmail until patched.

CISA reports exploitation of CVE-2024-36401 on public-facing GeoServer systems. Attackers used web shells, cron jobs and valid accounts, some later deleted, for persistence, and brute force for lateral movement and privilege escalation.

PowerShell and BITS jobs pulled payloads; Stowaway provided command and control through the web server. A second outbound connection likely served as backup. CISA recommends prompt patching, out-of-band logging and incident-response practice.