ThreatFox MISP Feed

Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

CIRCL OSINT Feed

Reddit InfoSec News

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

An investigation into domains associated with the LummaC2 infostealing-malware campaign revealed a broader network of nearly 500 domains with highly malicious risk scores. These domains share similar registration patterns, including the use of Eastern European names and the inbox[.]eu email domain. The domains predominantly advertise technical education courses, but are likely lures for malware delivery. Four domains were identified as LummaC2 login panels. The campaign's infrastructure uses specific TLDs, naming conventions, and a Hong Kong address linked to OFAC-sanctioned entities. Security teams are advised to monitor for similar domain patterns, scrutinize suspicious training sites, and educate users about the risks.

The LummaC2 campaign represents a sophisticated infostealing malware operation that leverages an extensive and covert domain infrastructure to facilitate malware delivery and command-and-control (C2) activities. Investigations have uncovered nearly 500 domains linked to this campaign, characterized by highly malicious risk scores and consistent registration patterns. These domains predominantly use Eastern European personal names and the inbox[.]eu email domain for registration, suggesting a coordinated effort to mask the true operators. The domains primarily masquerade as providers of technical education courses, a tactic designed to lure victims into engaging with malicious content under the guise of legitimate training resources. Among these, four domains have been identified as actual LummaC2 login panels, serving as interfaces for threat actors to manage infected systems or distribute malware payloads. The infrastructure employs specific top-level domains (TLDs) and naming conventions, and intriguingly, includes a Hong Kong address linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), indicating potential geopolitical or regulatory evasion strategies. The campaign aligns with several MITRE ATT&CK techniques, including spearphishing via service (T1566.002), establishing and using infrastructure (T1583.001), domain generation algorithms or domain fronting (T1589.002), and leveraging compromised or malicious domains (T1585, T1584.001). Although no known exploits are currently active in the wild, the campaign’s infrastructure and tactics pose a significant risk for credential theft, data exfiltration, and further malware dissemination. Security teams are advised to monitor for domain registration patterns similar to those identified, scrutinize suspicious technical education websites, and implement user awareness programs to mitigate the risk of social engineering attacks associated with this campaign.

Detailed information about Part 2: Tracking LummaC2 Infrastructure. Get real-time updates, technical details, and mitigation strategies.

Part 2: Tracking LummaC2 Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Part 2: Tracking LummaC2 Infrastructure

Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar allows Stored XSS. This issue affects Bg Orthodox Calendar: from n/a through 0.13.10.

CVE-2025-28958 is a high-severity vulnerability classified as CWE-352, indicating a Cross-Site Request Forgery (CSRF) issue in the Bg Orthodox Calendar software developed by Vadim Bogaiskov. The vulnerability affects versions up to 0.13.10. CSRF vulnerabilities allow an attacker to trick an authenticated user into submitting a forged request to a web application, potentially causing unintended actions. In this case, the CSRF vulnerability enables a Stored Cross-Site Scripting (XSS) attack, which means that malicious scripts can be permanently stored on the vulnerable application and executed in the context of users’ browsers when they access affected pages. The CVSS 3.1 base score of 7.1 reflects a high severity, with the vector indicating network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), scope changed (S:C), and impacts on confidentiality, integrity, and availability rated as low to low and low respectively (C:L/I:L/A:L). The scope change (S:C) suggests that the vulnerability affects components beyond the initially vulnerable component, increasing its impact. The vulnerability was published on June 6, 2025, with no known exploits in the wild yet and no available patches at the time of reporting. The Bg Orthodox Calendar is a specialized calendar application, likely used by communities or organizations that follow the Orthodox Christian calendar, which may include religious institutions or cultural organizations. The combination of CSRF and stored XSS can allow attackers to perform unauthorized actions on behalf of users and inject persistent malicious scripts, potentially leading to session hijacking, data theft, or further compromise of user accounts and systems.

Detailed information about CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar affecting Vadim Bogaiskov Bg Orthod

CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Operation Endgame 2.0 represents a coordinated international law enforcement effort targeting cybercriminal groups operating the DanaBot malware family. DanaBot is a sophisticated modular malware platform developed in Delphi, notable for its extensive capabilities including keylogging, screenshot capture, desktop video recording, file exfiltration, web browser content injection, and deployment of secondary malware payloads. Functioning as Malware-as-a-Service (MaaS), DanaBot enables affiliates to conduct a variety of cyberattacks without requiring deep technical expertise. The malware communicates with its command and control (C2) infrastructure using a custom binary protocol secured with RSA and AES encryption, enhancing its resilience against interception and analysis. It relies on hardcoded C2 servers and employs Tor as a fallback communication channel, complicating efforts to disrupt its operations. Historically, DanaBot has been leveraged in targeted espionage campaigns against government officials in the Middle East and Eastern Europe, as well as in distributed denial-of-service (DDoS) attacks targeting Ukrainian servers. The presence of over 50 known affiliate nicknames indicates a broad and decentralized operator base. The malware’s use of advanced techniques such as credential dumping (T1003), persistence mechanisms (T1543, T1547), lateral movement (T1090), and execution through user interaction (T1204) underscores its versatility and threat level. Despite the absence of known exploits in the wild for specific software vulnerabilities, DanaBot’s modularity and MaaS model make it a persistent and adaptable threat vector.

Detailed information about Operation Endgame 2.0. Get real-time updates, technical details, and mitigation strategies.

Operation Endgame 2.0 - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Endgame 2.0

The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2025-3870 is a vulnerability identified in the '1 Decembrie 1918' WordPress plugin developed by olarmarius. This plugin is affected in all versions up to and including version 1.dec.2012. The vulnerability is classified as Cross-Site Scripting (XSS) under CWE-79, specifically caused by improper neutralization of input during web page generation. The root cause is the absence or incorrect implementation of nonce validation on the plugin's main PHP page (1-decembrie-1918/1-decembrie-1918.php). Nonces are security tokens used in WordPress to verify that requests originate from legitimate sources and prevent Cross-Site Request Forgery (CSRF). Due to missing or faulty nonce checks, an unauthenticated attacker can craft a malicious request that, if an authenticated site administrator is tricked into clicking (e.g., via a phishing link), allows the attacker to update plugin settings and inject malicious scripts into the website. This injection can lead to the execution of arbitrary JavaScript in the context of the administrator's browser session, potentially compromising session tokens, redirecting users, or performing unauthorized actions. Although no known exploits are currently in the wild, the vulnerability's nature means it can be exploited remotely without authentication, relying on social engineering to induce administrator interaction. The plugin's widespread use in WordPress sites that focus on Romanian historical content or related themes increases the attack surface. The vulnerability was reserved and published in April 2025, with enrichment from CISA, but no official patch or CVSS score has been provided yet.

Detailed information about CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 

CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 1918 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 1918

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Interlock ransomware evolving under the radar - Live Threat Intelligence - Threat Radar | OffSeq.com

Interlock ransomware evolving under the radar

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

Operation RoundPress is a sophisticated espionage campaign attributed to the Russia-aligned threat actor group Sednit, targeting high-value webmail servers primarily used by governmental and defense sector entities. The operation exploits cross-site scripting (XSS) vulnerabilities in popular webmail platforms, including Roundcube, Horde, MDaemon, and Zimbra. Initially observed in 2023 focusing on Roundcube, the campaign expanded in 2024 to target additional webmail software, leveraging multiple vulnerabilities, notably including a zero-day in MDaemon (CVE-2023-23397) and other CVEs such as CVE-2023-43770 and CVE-2024-11182. The attackers inject malicious JavaScript code into the webmail interface, enabling the SpyPress malware to stealthily harvest sensitive information. This includes stealing webmail credentials, exfiltrating contacts and email messages, and in some cases bypassing two-factor authentication mechanisms, significantly increasing the risk of unauthorized access and data compromise. The operation's targeting of governmental and defense organizations in Eastern Europe, with additional victims in Africa, Europe, and South America, indicates a strategic focus on high-value intelligence collection. The exploitation method relies on injecting malicious scripts via XSS vulnerabilities, which do not require initial authentication but do require the victim to access the compromised webmail interface, making user interaction a factor. Despite the medium severity rating assigned, the presence of zero-day exploits and the ability to bypass two-factor authentication elevate the technical sophistication and potential impact of this threat. No known public exploits have been reported yet, but the active targeting and use of zero-days underscore the urgency for affected organizations to implement mitigations promptly.

Detailed information about Operation RoundPress targeting high-value webmail servers. Get real-time updates, technical details, and mitigation strategies.

Operation RoundPress targeting high-value webmail servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation RoundPress targeting high-value webmail servers

Serverless InfoStealer delivered in Est European Countries

The threat identified as 'Serverless InfoStealer delivered in Est European Countries' is a malware campaign focused on information theft, specifically targeting entities within Eastern European countries. The term 'serverless' suggests that the malware operates without relying on traditional server infrastructure, potentially leveraging cloud functions or ephemeral execution environments to evade detection and persistence mechanisms. This approach complicates traditional network-based detection and mitigation strategies. The malware is categorized under OSINT (Open Source Intelligence), payload delivery, and network activity, indicating that it likely collects sensitive information and exfiltrates it over the network without requiring persistent installation on victim systems. The lack of affected versions and patch availability implies that this malware exploits either zero-day vulnerabilities or uses social engineering and other non-patchable attack vectors. The technical details are minimal, with a low threat level rating (1) and no known exploits in the wild, suggesting limited current exploitation or detection. However, the severity is marked as high, reflecting the potential impact of information theft. The campaign's delivery in Eastern European countries indicates a geographically targeted operation, possibly focusing on specific sectors or organizations. The absence of indicators and CWEs limits detailed technical attribution or signature-based detection. Overall, this malware represents a sophisticated, stealthy threat that leverages modern serverless computing paradigms to conduct information theft operations in a targeted regional context.

Detailed information about Serverless InfoStealer delivered in Est European Countries. Get real-time updates, technical details, and mitigation strategies.

Serverless InfoStealer delivered in Est European Countries - Live Threat Intelligence - Threat Radar | OffSeq.com

The reported threat, titled "Serverless InfoStealer delivered in Est European Countries," describes a high-severity information-stealing malware campaign targeting Eastern European countries. The term "serverless" in this context likely refers to the malware operating without relying on traditional command-and-control (C2) servers, potentially using decentralized or ephemeral infrastructure to avoid detection and takedown. This approach complicates attribution and mitigation efforts since the malware may exfiltrate data directly to cloud services or peer-to-peer networks, bypassing conventional network monitoring tools. The InfoStealer component indicates that the primary objective is to harvest sensitive information from infected systems, which may include credentials, personal identifiable information (PII), financial data, or intellectual property. The lack of specific affected versions or products suggests that the malware may target a broad range of systems or employ generic infection vectors such as phishing or drive-by downloads. The source of the information is CIRCL, a reputable cybersecurity research entity, lending credibility to the report despite the noted 50% certainty level. The absence of known exploits in the wild implies that the malware may rely on social engineering or existing vulnerabilities rather than zero-day exploits. The technical details indicate a low threat level score (1) and no detailed analysis, which may reflect limited data availability or early-stage detection. Overall, this threat represents a sophisticated and stealthy data exfiltration campaign leveraging serverless techniques to evade traditional defenses, primarily impacting organizations within Eastern Europe.

Title	Severity	Type	Source	Date

Threats Affecting Bulgaria

Filter Threats

Threats Affecting Bulgaria

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility