Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Check Point Research

CVE Database V5

AlienVault OTX General

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

JVN Japan

Between April and May 2026, a likely North Korean threat actor named UNK_DeadDrop conducted phishing campaigns targeting developers in finance, cryptocurrency, education, and technology sectors. The attacks used recruitment and code review themes to deliver emails containing links to malicious GitHub repositories. These repositories hosted malware that exploited Visual Studio Code workflows and deployed malicious VSIX extensions requiring minimal user interaction. The malware was cross-platform, affecting macOS, Linux, and Windows, and included the Overlord framework. The campaign aimed to steal developer assets such as API tokens, cryptocurrency wallets, and credentials by impersonating legitimate cryptocurrency and blockchain projects with fake company personas and professional repositories.

The UNK_DeadDrop phishing campaign targeted developers across nearly 100 organizations by sending emails themed around recruitment and code reviews. The emails contained links to GitHub repositories controlled by the threat actor, which hosted malicious scripts. The infection chain leveraged Visual Studio Code workflows and malicious VSIX extensions that required minimal user interaction to execute cross-platform malware on macOS, Linux, and Windows systems. The malware included the open-source Overlord framework and focused on exfiltrating developer assets like API tokens, cryptocurrency wallets, and credentials. The attackers used fake company personas and professional-looking repositories masquerading as legitimate cryptocurrency and blockchain projects to gain victim trust and facilitate credential theft and cryptocurrency theft.

Detailed information about Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency. Get real-time updates, technical deta

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency - Live Threat Intelligence - Threat Radar | OffSeq.com

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

From January through May 2026, a financially motivated data theft extortion campaign executed by threat cluster UNC3753 targeted dozens of organizations across professional, legal, and financial services in the United States. The threat actors leverage voice phishing and social engineering techniques, posing as IT support to convince targets to host screen-sharing sessions and download remote monitoring and management utilities. Once inside environments, they conduct searches to locate and exfiltrate highly sensitive data including proprietary legal agreements, personally identifiable information, and financial records for subsequent extortion demands. The entire attack sequence often occurs within a single business day, with recent incidents showing data theft initiated in under an hour. Notably, threat actors have also accessed victims' systems in person, with individuals posing as IT technicians entering corporate offices to attempt direct exfiltration using USB storage media.

The threat cluster UNC3753 executed a targeted data theft and extortion campaign against US-based professional, legal, and financial organizations from January through May 2026. Attackers employ voice phishing and social engineering to gain remote access by posing as IT support, facilitating screen-sharing sessions and installation of remote monitoring and management utilities. Once inside, they conduct rapid searches for sensitive data including proprietary legal agreements, personally identifiable information, and financial records, exfiltrating this data for extortion. The entire attack lifecycle can occur within a single business day, with data theft initiated in under an hour in recent cases. Additionally, attackers have physically infiltrated victim offices, impersonating IT technicians to directly exfiltrate data using USB storage devices. The campaign is linked to multiple malware families and threat tags such as SilentNight, BazarLoader, Ursnif, TrickBot, and LockBit.Black. No known exploits or patches are associated with this campaign as it relies on social engineering and physical intrusion rather than software vulnerabilities.

Detailed information about Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms. Get real-time updates, technical details, and mitigation strategies.

Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms - Live Threat Intelligence - Threat Radar | OffSeq.com

Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

Over 900 automatic tank gauge (ATG) systems across the United States, used to monitor fuel and chemical storage tanks across various critical infrastructure sectors, have been found exposed online and are vulnerable to ongoing attacks. [...]

Over 900 automatic tank gauge (ATG) systems across the United States, which monitor fuel and chemical storage tanks, have been found exposed to the internet and vulnerable to active cyberattacks. The US Cybersecurity and Infrastructure Security Agency (CISA), FBI, NSA, and other federal partners issued a joint advisory highlighting that attackers exploit multiple security weaknesses including hardcoded credentials, authentication bypasses, SQL injection, OS command execution vulnerabilities, and privilege escalation to compromise these devices. Once compromised, attackers can modify system settings, disable alerts, and potentially cause leaks or permanent damage to tank systems. Shadowserver reported over 1,000 exposed ATG systems globally, with 909 in the US. Iranian state-backed hackers have been linked to some attacks manipulating display readings without altering actual fuel levels. The advisory recommends restricting remote access, replacing default passwords, applying security updates, and implementing multi-factor authentication. No official patch or remediation status is provided in the advisory.

Detailed information about Over 900 US gas station tank gauge systems exposed to attacks. Get real-time updates, technical details, and mitigation strategies.

Over 900 US gas station tank gauge systems exposed to attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

Over 900 US gas station tank gauge systems exposed to attacks

A sophisticated multi-stage malware campaign targets victims through tax-themed phishing emails impersonating Indian and Japanese government authorities. The operation leverages social engineering, fraudulent tax notifications, and trusted third-party email delivery services to distribute ZIP archives containing three staged payloads. The malware implements advanced evasion techniques including DLL Search Order Hijacking, API hooking, token manipulation, Mersenne Twister-based execution logic, COM callback execution, mutated RC4 encryption, and reflective PE loading. Execution occurs primarily in memory, significantly reducing forensic artifacts. The malware establishes persistent WebSocket-based command-and-control communication through HTTP protocol upgrades, allowing malicious traffic to blend with legitimate activity. Chinese-language artifacts were observed throughout the infrastructure and code, though attribution remains at moderate confidence. The campaign demonstrates characteristics of a mature, ...

This campaign uses social engineering through fraudulent tax notifications and trusted third-party email delivery to distribute ZIP archives containing three staged payloads. The malware employs multiple advanced techniques including DLL Search Order Hijacking, API hooking, token manipulation, Mersenne Twister-based execution logic, COM callback execution, mutated RC4 encryption, and reflective PE loading. Execution occurs mainly in memory, minimizing forensic artifacts. Persistent WebSocket-based C2 communication is established via HTTP protocol upgrades, allowing malicious traffic to blend with legitimate network activity. The campaign is multi-regional, targeting India, Japan, and the British Indian Ocean Territory, with Chinese-language artifacts observed in the code and infrastructure. There is no CVE or patch information available, and no known exploits in the wild have been reported.

Detailed information about Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign. Get real-time updates, technical details, and mitigation

Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign

This analysis examines Gamaredon's (UAC-0010, Armagedon) advanced espionage operations targeting Ukrainian government, military, and critical infrastructure. The FSB-operated group deploys GammaSteel, a sophisticated stealer operating almost entirely from memory using Windows DPAPI encryption and storing 71 distinct payload functions in the HKCU\Printers registry key. The malware employs three concurrent data acquisition mechanisms: timed drive scans, USB monitoring for air-gapped systems, and real-time file surveillance. Exfiltration occurs via legitimate S3-compatible cloud storage (Tebi.io) with fallback to operator-controlled servers. The infection chain extensively uses VBScript for evasion, Dead Drop Resolvers on platforms like Telegram and Mastodon for C2 configuration, and includes bidirectional backdoor capabilities enabling arbitrary remote code execution. Infrastructure demonstrates high automation with servers rotated approximately every 24 hours.

GammaSteel is an advanced infostealer deployed by the FSB-operated Gamaredon group targeting Ukrainian government and critical infrastructure. It runs mostly from memory, using Windows DPAPI encryption and storing 71 payload functions in the HKCU\Printers registry key. The malware employs three concurrent data acquisition methods: scheduled drive scans, USB device monitoring to compromise air-gapped systems, and real-time file surveillance. Exfiltration occurs through legitimate S3-compatible cloud storage (Tebi.io) with fallback to operator-controlled servers. The infection chain heavily relies on VBScript for evasion and uses Dead Drop Resolvers on Telegram and Mastodon for C2 configuration. It also features a bidirectional backdoor enabling arbitrary remote code execution. The attacker infrastructure is highly automated, with server rotation approximately every 24 hours.

Detailed information about Matryoshka #3/3: Gamaredon's Gammasteel Infostealer. Get real-time updates, technical details, and mitigation strategies.

Geographic Threat Map

Global Threat Distribution

Recent Threats

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets ...

Seeking Counsel: Ongoing Targeted Campaign Against US Law Fi...

Over 900 US gas station tank gauge systems exposed to attack...

Operation TaxShadow: Multi-Region Tax Phishing & In-Memory M...

Matryoshka #3/3: Gamaredon's Gammasteel Infostealer

Country Risk Levels

Check if your credentials are on the dark web

Lead Pen Test Professional

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility