Threat landscape — Belgium

Search IOCs, vulnerabilities, APT…

216.73.216.133

← Back to attack reports

Threat landscape — Belgium

· Published 29/05/2026 11:51

Share: LinkedIn Facebook Mastodon X

Export JSON

Essential information

Published: 29/05/2026 11:51
Modified: —
Confidence: 100/100
Report type(s): threat-report
Related entities: 18 vulnerabilities (cve), 20 intrusion sets (apt), 200 techniques (mitre), 200 malware, 26 tools

Description

Landscape de menace exporté depuis opencti-cli pour le secteur « ». Périmètre pays : Belgium. Importer via Data → Import / Import from STIX, ou rattacher à un rapport existant.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

Vulnerabilities (CVE) (18)

CVE-2021-21551 KEV

Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.

Published: 31/03/2022
Modified: 29/05/2026

CVE-2019-0859 KEV

Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2024-9608

6.1 Medium

The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the …

Attack vector: Network
Published: 13/12/2024
Modified: 29/05/2026

Awaiting Analysis

CVE-2023-43261

7.5 High

An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.

Attack vector: Network
Published: 04/10/2023
Modified: 29/05/2026

CVE-2025-48279

7.1 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue …

Attack vector: Network
Complexity: Low
Published: 09/06/2025
Modified: 29/05/2026

CWE-79 Received

CVE-2017-7692

9.0 Critical

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen …

EPSS: 0.1555 (P94.7%)
Published: 20/04/2017
Modified: 29/05/2026

CWE-20

CVE-2019-0708 KEV

Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2023-42793 KEV

9.8 Critical

JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

Attack vector: Network
Published: 04/10/2023
Modified: 29/05/2026

CVE-2025-10035 KEV

10.0 Critical

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to …

Attack vector: Network
Published: 29/09/2025
Modified: 29/05/2026

Awaiting Analysis

CVE-2024-21893 KEV

8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) …

Attack vector: Network
Published: 31/01/2024
Modified: 27/05/2026

CVE-2021-44228 KEV

10.0 Critical

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Attack vector: Network
Published: 10/12/2021
Modified: 27/05/2026

CVE-2024-4947 KEV

9.6 Critical

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via …

Attack vector: Network
Published: 20/05/2024
Modified: 29/05/2026

Received

← Previous

Page / 2

1–12 of 18

Vssrtje

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Shenzhen Haimaiyunxiang Media Co., Ltd.

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
KageNoHitobito and DoNex

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Larva-24005

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GroozaV2

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Russia

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Webworm

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GALLIUM Granite Typhoon

The MITRE Corporation Confidence 100

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Hadoken Security Group

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Qilin

Ransomware.Live Confidence 100

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
UAC-0063

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 2

1–12 of 20

TA0002

MITRE
T1204.001

Malicious Link MITRE
T1586

Compromise Accounts MITRE
T1134.002

Create Process with Token MITRE
T1071.002

File Transfer Protocols MITRE
T1587

Develop Capabilities MITRE
T1009

MITRE
T1114.002

Remote Email Collection MITRE
T1213

Data from Information Repositories MITRE
T1047

Windows Management Instrumentation MITRE
T1074.001

Local Data Staging MITRE
T1037.004

RC Scripts MITRE

← Previous

Page / 17

13–24 of 200

PondRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SeaDuke - S0053

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Korplug

The MITRE Corporation Confidence 100

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
LPEClient

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
CollectionRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
QUIETEXIT

Family The MITRE Corporation Confidence 100

[QUIETEXIT](https://attack.mitre.org/software/S1084) is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021. [APT29](https://attack.mitre.org/groups/G0016) has deployed [QUIETEXIT](https://attack.mitre.org/software/S1084) on…

First seen 01/01/1970 · Last seen 16/11/5138 ·
JuicyPotato

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
TSVIPSrv.dll

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
RegDuke

Family The MITRE Corporation Confidence 100

[RegDuke](https://attack.mitre.org/software/S0511) is a first stage implant written in .NET and used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2017. [RegDuke](https://attack.mitre.org/software/S0511) has been used to control a compromised machine when control…

First seen 01/01/1970 · Last seen 16/11/5138 ·
ScoringMathTea

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
POSHSPY

Family The MITRE Corporation Confidence 100

[POSHSPY](https://attack.mitre.org/software/S0150) is a backdoor that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2015. It appears to be used as a secondary backdoor used if the actors lost…

First seen 01/01/1970 · Last seen 16/11/5138 ·
PyPlunderPlug

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 17

1–12 of 200

Windows Credential Editor

The MITRE Corporation Confidence 100

[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)
meek

The MITRE Corporation Confidence 100

[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.

← Previous

Page / 3

25–26 of 26

Contact About Legal notice Privacy policy Terms of use