Threat landscape — Belgium

Search IOCs, vulnerabilities, APT…

216.73.216.133

← Back to attack reports

Threat landscape — Belgium

· Published 29/05/2026 11:51

Share: LinkedIn Facebook Mastodon X

Export JSON

Essential information

Published: 29/05/2026 11:51
Modified: —
Confidence: 100/100
Report type(s): threat-report
Related entities: 18 vulnerabilities (cve), 20 intrusion sets (apt), 200 techniques (mitre), 200 malware, 26 tools

Description

Landscape de menace exporté depuis opencti-cli pour le secteur « ». Périmètre pays : Belgium. Importer via Data → Import / Import from STIX, ou rattacher à un rapport existant.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

Vulnerabilities (CVE) (18)

CVE-2023-46805 KEV

8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …

Attack vector: Network
Published: 10/01/2024
Modified: 27/05/2026

CVE-2021-34473 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.

Published: 03/11/2021
Modified: 29/05/2026

CVE-2019-0797 KEV

Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an …

Published: 03/11/2021
Modified: 29/05/2026

CVE-2017-11882 KEV

7.8 High

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.

Attack vector: Local
Complexity: Low
Published: 15/11/2017
Modified: 29/05/2026

CWE-119

CVE-2025-55182 KEV

10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector: Network
Published: 05/12/2025
Modified: 29/05/2026

Analyzed

CVE-2023-27532 KEV

7.5 High

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within …

Attack vector: Network
Published: 22/08/2023
Modified: 27/05/2026

← Previous

Page / 2

13–18 of 18

Vssrtje

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Shenzhen Haimaiyunxiang Media Co., Ltd.

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
KageNoHitobito and DoNex

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Larva-24005

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GroozaV2

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Russia

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Webworm

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
GALLIUM Granite Typhoon

The MITRE Corporation Confidence 100

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Hadoken Security Group

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Qilin

Ransomware.Live Confidence 100

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
UAC-0063

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 2

1–12 of 20

T1557

Adversary-in-the-Middle MITRE
T1562.006

Indicator Blocking MITRE
T1057

Process Discovery MITRE
T1003

OS Credential Dumping MITRE
T1019

MITRE
T1021.004

SSH MITRE
T1433

MITRE
T1585

Establish Accounts MITRE
T1110.001

Password Guessing MITRE
T1574.011

Services Registry Permissions Weakness MITRE
T1223

MITRE
T1063

MITRE

← Previous

Page / 17

1–12 of 200

PondRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SeaDuke - S0053

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Korplug

The MITRE Corporation Confidence 100

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
LPEClient

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
CollectionRAT

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
QUIETEXIT

Family The MITRE Corporation Confidence 100

[QUIETEXIT](https://attack.mitre.org/software/S1084) is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021. [APT29](https://attack.mitre.org/groups/G0016) has deployed [QUIETEXIT](https://attack.mitre.org/software/S1084) on…

First seen 01/01/1970 · Last seen 16/11/5138 ·
JuicyPotato

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
TSVIPSrv.dll

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
RegDuke

Family The MITRE Corporation Confidence 100

[RegDuke](https://attack.mitre.org/software/S0511) is a first stage implant written in .NET and used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2017. [RegDuke](https://attack.mitre.org/software/S0511) has been used to control a compromised machine when control…

First seen 01/01/1970 · Last seen 16/11/5138 ·
ScoringMathTea

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
POSHSPY

Family The MITRE Corporation Confidence 100

[POSHSPY](https://attack.mitre.org/software/S0150) is a backdoor that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2015. It appears to be used as a secondary backdoor used if the actors lost…

First seen 01/01/1970 · Last seen 16/11/5138 ·
PyPlunderPlug

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 17

1–12 of 200

cmd

The MITRE Corporation Confidence 100

[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd) Cmd.exe contains native functionality to…
FRP

The MITRE Corporation Confidence 100

[FRP](https://attack.mitre.org/software/S1144), which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT)…
AADInternals

The MITRE Corporation Confidence 100

[AADInternals](https://attack.mitre.org/software/S0677) is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.(Citation: AADInternals Github)(Citation: AADInternals Documentation)
Impacket

The MITRE Corporation Confidence 100

[Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation,…
ROADTools

The MITRE Corporation Confidence 100

[ROADTools](https://attack.mitre.org/software/S0684) is a framework for enumerating Azure Active Directory environments. The tool is written in Python and publicly available on GitHub.(Citation: ROADtools Github)
Systeminfo

The MITRE Corporation Confidence 100

[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)
HTRAN

The MITRE Corporation Confidence 100

[HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their…
SDelete

The MITRE Corporation Confidence 100

[SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete…
NBTscan

The MITRE Corporation Confidence 100

[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June…
Tor

The MITRE Corporation Confidence 100

[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the…
PsExec

The MITRE Corporation Confidence 100

[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS…
Wevtutil

The MITRE Corporation Confidence 100

[Wevtutil](https://attack.mitre.org/software/S0645) is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.(Citation: Wevtutil Microsoft Documentation)

← Previous

Page / 3

1–12 of 26

Contact About Legal notice Privacy policy Terms of use