Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

Librarian Ghouls, an APT group targeting entities in Russia and the CIS, has been conducting a campaign involving targeted phishing emails with malicious archives. The attackers use legitimate third-party software and scripts to establish remote access, steal credentials, and deploy an XMRig crypto miner. Their tactics include disabling security measures, scheduling tasks to cover their tracks, and exfiltrating sensitive data. The campaign primarily affects industrial enterprises and engineering schools in Russia, with some victims in Belarus and Kazakhstan. The group continues to refine its methods, focusing on data exfiltration, remote access, and email account compromise through phishing sites.

The threat involves the APT group known as Librarian Ghouls, which targets entities primarily in Russia and the Commonwealth of Independent States (CIS) through a sophisticated campaign. The attack vector is primarily phishing emails containing malicious archives that exploit social engineering to trick victims into executing payloads. The group leverages legitimate third-party software and scripting tools to establish persistent remote access, enabling them to steal credentials and exfiltrate sensitive data. Additionally, they deploy the XMRig cryptocurrency miner to illicitly mine Monero, thereby monetizing compromised systems. Their tactics include disabling security tools to evade detection, scheduling tasks to maintain persistence and cover tracks, and compromising email accounts via phishing sites to facilitate further lateral movement and data theft. The campaign mainly targets industrial enterprises and engineering schools, indicating a focus on sectors with valuable intellectual property and operational technology. The group continuously refines its methods, employing a range of MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job), T1036.005 (Masquerading), T1566.001 (Spearphishing Attachment), and others related to credential access, defense evasion, and command execution. While the campaign is currently concentrated in Russia, Belarus, and Kazakhstan, the use of legitimate tools and phishing makes it a flexible threat that could potentially affect similar targets elsewhere. No known public exploits exist for this campaign, and no specific vulnerable software versions are identified, indicating the attack relies heavily on social engineering and post-compromise tool usage rather than zero-day vulnerabilities.

Detailed information about APT carries out attacks with data theft and crypto miner deployment. Get real-time updates, technical details, and mitigation strateg

APT carries out attacks with data theft and crypto miner deployment - Live Threat Intelligence - Threat Radar | OffSeq.com

APT carries out attacks with data theft and crypto miner deployment

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Source: https://hackread.com/pathwiper-malware-hit-ukraines-critical-infrastructure/

The PathWiper malware is a newly identified malicious software campaign targeting Ukraine's critical infrastructure. While detailed technical specifics of the malware's operation are limited, the designation as 'PathWiper' suggests destructive capabilities, likely involving the wiping or deletion of file system paths or critical data. The malware's targeting of critical infrastructure implies an intent to disrupt essential services such as energy, water, transportation, or communications networks. Given the critical infrastructure context, the malware may employ sophisticated techniques to evade detection, persist within operational technology (OT) environments, and cause significant operational disruption. The lack of detailed indicators or affected versions suggests this is an emerging threat with limited public technical disclosure, but the critical severity rating underscores the potential for severe impact. The source of information is a Reddit post linking to a cybersecurity news article, indicating early-stage reporting rather than comprehensive technical analysis. No known exploits in the wild have been confirmed, but the urgency and critical classification imply active or imminent threat activity. Overall, PathWiper represents a high-risk malware threat aimed at destabilizing vital infrastructure systems, likely leveraging destructive payloads to impair availability and operational continuity.

Detailed information about New PathWiper Malware Strikes Ukraine's Critical Infrastructure. Get real-time updates, technical details, and mitigation strategies.

New PathWiper Malware Strikes Ukraine's Critical Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

The threat involves two newly discovered Android spyware families attributed to the Russian Gamaredon APT group, as identified through OSINT by Lookout. Gamaredon is a known Russian state-sponsored threat actor group historically targeting Ukrainian entities and related interests. The spyware families are designed to operate on Android devices, likely aiming to conduct espionage by collecting sensitive information from infected mobile devices. Although specific technical details about the spyware capabilities, infection vectors, or payloads are not provided, the association with Gamaredon suggests these spyware families could be used for targeted surveillance, data exfiltration, and persistent access on compromised devices. The discovery is based on open-source intelligence with a moderate certainty level (50%), and no known exploits or patches are currently available. The campaign is categorized under network activity and payload delivery, indicating that the spyware is likely distributed through network-based vectors or social engineering. The severity is currently assessed as low, reflecting limited available details and no confirmed widespread exploitation. However, the presence of such spyware families highlights ongoing mobile threats from nation-state actors targeting Android platforms, which are widely used across Europe.

Detailed information about OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT. Get real-time updates, technical details, and miti

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT - Live Threat Intelligence - Threat Radar | OffSeq.com

In April 2019, we discovered new malware that compromises encrypted web communications in an impressive way. Analysis of the malware allowed us to confirm that the operators have some control over the target’s network channel and could replace legitimate installers with infected ones on the fly. That places the actor in a very exclusive club, with capabilities that few other actors in the world have.

We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers.

The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.

The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.

We registered two initial infection schemes: Reductor spreads by either infecting popular software distributions (Internet Downloader Manager, WinRAR, etc. and, for at least one victim, through a popular warez website over HTTP); or its decryptor/dropper is spread using COMpfun’s ability to download files on already infected hosts.

The Reductor malware, identified as a successor to the COMpfun Trojan, represents a sophisticated threat primarily targeting encrypted web communications by compromising TLS traffic. Discovered in April 2019, Reductor is notable for its advanced capabilities that allow operators to exert control over the target's network channel. This control enables the attackers to perform man-in-the-middle style manipulations, such as replacing legitimate software installers with infected versions in real time. The malware includes typical Remote Access Trojan (RAT) functionalities, such as uploading, downloading, and executing files on compromised systems. However, its distinguishing feature lies in its manipulation of digital certificates and the marking of outbound TLS traffic with unique host-related identifiers, which could facilitate persistent tracking and targeted interception of encrypted communications.

Technical analysis reveals strong code similarities between Reductor and the earlier COMpfun Trojan, which was first documented in 2014 and tentatively attributed to the Turla Advanced Persistent Threat (APT) group based on victimology. Reductor appears to be distributed through two primary infection vectors: first, by infecting popular software distributions such as Internet Downloader Manager and WinRAR, including distribution via a popular warez website over unencrypted HTTP; second, by leveraging COMpfun's downloader capabilities on already infected hosts to deploy Reductor's decryptor/dropper modules. This multi-stage infection approach indicates a well-resourced and persistent actor with the ability to compromise supply chains and exploit existing footholds.

The campaign using Reductor has been active since at least April 2019, with confirmed targets in Russia and Belarus. The malware's ability to compromise TLS traffic is particularly concerning because it undermines the confidentiality and integrity of encrypted communications, which are generally trusted as secure. The lack of available patches and absence of known exploits in the wild suggest that the threat relies on targeted infection methods rather than widespread exploitation of software vulnerabilities.

Overall, Reductor exemplifies a high level of operational sophistication, combining supply chain compromise, advanced network manipulation, and stealthy RAT capabilities to maintain persistence and exfiltrate sensitive information from high-value targets.

Detailed information about COMpfun successor Reductor: compromise TLS traffic. Get real-time updates, technical details, and mitigation strategies.

COMpfun successor Reductor: compromise TLS traffic - Live Threat Intelligence - Threat Radar | OffSeq.com

COMpfun successor Reductor: compromise TLS traffic

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Djo VK Poster Group allows Reflected XSS.This issue affects VK Poster Group: from n/a through 2.0.3.



CVE-2024-24932 is a reflected Cross-site Scripting (XSS) vulnerability identified in the Djo VK Poster Group software, affecting versions up to 2.0.3. This vulnerability arises due to improper neutralization of user-supplied input during web page generation, classified under CWE-79. Specifically, the application fails to adequately sanitize or encode input before reflecting it back in the HTTP response, allowing an attacker to inject malicious scripts. When a victim accesses a crafted URL containing malicious payloads, the injected script executes in the victim's browser context. This can lead to session hijacking, credential theft, unauthorized actions on behalf of the user, or redirection to malicious sites. The vulnerability is reflected, meaning the malicious input is not stored persistently but is immediately echoed back in the response. No authentication is required to exploit this issue, and exploitation does not require user interaction beyond visiting a maliciously crafted link. There are no known public exploits in the wild at the time of reporting, and no patches have been published yet. The vulnerability was reserved and published in early 2024, with technical details enriched by CISA and Patchstack. The affected product, VK Poster Group by Djo, is a tool likely used for managing or automating posts on VK, a popular social media platform, which suggests a web-facing application with user interaction capabilities.

Detailed information about CVE-2024-24932: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Djo VK Poster Group af

CVE-2024-24932: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Djo VK Poster Group - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-24932: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Djo VK Poster Group

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

CVE-2021-25262 is a vulnerability identified in Yandex Browser for Android versions prior to 21.3.0. It is classified under CWE-116, which pertains to improper encoding or escaping of output. Specifically, this vulnerability allows remote attackers to conduct an IDN (Internationalized Domain Name) homograph attack. In such attacks, visually similar characters from different scripts are used to create deceptive domain names that appear identical or very similar to legitimate ones. Due to improper encoding or escaping in the browser's handling of domain names, users can be tricked into visiting malicious websites that impersonate trusted domains. This can lead to phishing, credential theft, or malware delivery. The CVSS 4.0 base score is 6.9 (medium severity), with an attack vector of network (no physical access needed), low attack complexity, no privileges or user interaction required, but user interaction is marked as required (UI:A), and a high impact on confidentiality. No known exploits are reported in the wild as of the published date. The vulnerability affects the Android version of Yandex Browser, a product primarily used in Russia and some neighboring countries but also by users in Europe. The issue was reserved in January 2021 and published in May 2025, indicating a delayed disclosure or update. The lack of patch links suggests users should upgrade to version 21.3.0 or later where the issue is fixed. Overall, this vulnerability exploits the browser's failure to properly encode or escape domain names, enabling attackers to deceive users with spoofed URLs, potentially leading to sensitive data compromise.

Detailed information about CVE-2021-25262: CWE-116 Improper Encoding or Escaping of Output in Yandex Browser affecting Yandex Browser. Get real-time updates, te

CVE-2021-25262: CWE-116 Improper Encoding or Escaping of Output in Yandex Browser - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-25262: CWE-116 Improper Encoding or Escaping of Output in Yandex Browser

Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.

CVE-2021-25255 is a high-severity vulnerability identified in Yandex Browser Lite for Android versions prior to 21.1.0. The underlying issue is classified as CWE-20, which refers to improper input validation. This vulnerability allows remote attackers to cause a denial of service (DoS) condition in the affected browser. Specifically, the browser fails to properly validate certain inputs, which can be crafted by an attacker to trigger a crash or otherwise disrupt normal operation. The vulnerability does not require any privileges or authentication to exploit, and user interaction is necessary, such as visiting a maliciously crafted webpage or clicking a link. The CVSS v4.0 base score is 8.3, indicating a high severity level. The attack vector is network-based (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no user authentication needed (AT:N). However, user interaction is required (UI:P). The impact is primarily on availability, as the vulnerability leads to denial of service, potentially causing the browser to crash or become unresponsive. There is no indication of confidentiality or integrity compromise. No known exploits are currently reported in the wild, and no official patches or mitigation links are provided in the data, though the fixed version is 21.1.0. The vulnerability affects the Android platform specifically, targeting users of Yandex Browser Lite, a lightweight version of the Yandex browser designed for resource-constrained devices or users with limited bandwidth. The improper input validation could be triggered by maliciously crafted web content or URLs, making it a risk for users who browse untrusted or malicious websites.

Detailed information about CVE-2021-25255: CWE-20 Improper Input Validation in Yandex Browser Lite affecting Yandex Browser Lite. Get real-time updates, technic

CVE-2021-25255: CWE-20 Improper Input Validation in Yandex Browser Lite - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-25255: CWE-20 Improper Input Validation in Yandex Browser Lite

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

CVE-2021-25254 is a high-severity vulnerability identified in Yandex Browser Lite for Android versions prior to 21.1.0. The underlying issue is classified under CWE-116, which pertains to improper encoding or escaping of output. Specifically, this vulnerability allows remote attackers to spoof the address bar within the browser. Spoofing the address bar means an attacker can manipulate the displayed URL, potentially misleading users into believing they are visiting a legitimate website when they are not. This can facilitate phishing attacks, credential theft, or distribution of malware by exploiting user trust in the browser's URL display. The vulnerability does not require any privileges or authentication and can be triggered remotely without user interaction, although user interaction (such as visiting a malicious link) is necessary to exploit the spoofing. The CVSS 4.0 score of 8.2 reflects a high severity, with attack vector being network-based, low attack complexity, no privileges required, and no user authentication needed. The vulnerability impacts confidentiality primarily by enabling phishing and social engineering attacks that can lead to credential compromise. Integrity and availability impacts are minimal or not directly affected. No known exploits are reported in the wild, and no official patches are linked, but the vulnerability is publicly disclosed and should be addressed promptly by updating to version 21.1.0 or later.

Detailed information about CVE-2021-25254: CWE-116 Improper Encoding or Escaping of Output in Yandex Browser Lite affecting Yandex Browser Lite. Get real-time u

CVE-2021-25254: CWE-116 Improper Encoding or Escaping of Output in Yandex Browser Lite - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-25254: CWE-116 Improper Encoding or Escaping of Output in Yandex Browser Lite

The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE-2024-6462 is a medium severity vulnerability classified as CWE-79 (Cross-Site Scripting or XSS) affecting the DL Yandex Metrika WordPress plugin up to version 1.2. The vulnerability arises because the plugin fails to properly sanitize and escape certain settings inputs. This flaw allows users with high privileges, such as administrators, to inject and store malicious scripts within the plugin's settings. Notably, this attack vector remains exploitable even when the WordPress unfiltered_html capability is disabled, such as in multisite environments, which typically restricts the ability to post unfiltered HTML content. The vulnerability requires high privileges (admin level) and user interaction (an admin must save malicious content), but once exploited, it can lead to stored XSS attacks that execute arbitrary JavaScript in the context of other administrators or users viewing the affected settings pages. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed. The impact primarily affects confidentiality and integrity by enabling script execution that could steal session tokens, modify settings, or perform actions on behalf of administrators. Availability impact is not significant. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability was published on May 15, 2025, and was assigned by WPScan. The affected product is a WordPress plugin related to Yandex Metrika, a web analytics service popular in Russian-speaking and some European markets.

Detailed information about CVE-2024-6462: CWE-79 Cross-Site Scripting (XSS) in Unknown DL Yandex Metrika affecting Unknown DL Yandex Metrika. Get real-time upda

Title	Severity	Type	Source	Date

Threats Affecting Belarus

Filter Threats

Threats Affecting Belarus

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility