Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

Reddit InfoSec News

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

An investigation into domains associated with the LummaC2 infostealing-malware campaign revealed a broader network of nearly 500 domains with highly malicious risk scores. These domains share similar registration patterns, including the use of Eastern European names and the inbox[.]eu email domain. The domains predominantly advertise technical education courses, but are likely lures for malware delivery. Four domains were identified as LummaC2 login panels. The campaign's infrastructure uses specific TLDs, naming conventions, and a Hong Kong address linked to OFAC-sanctioned entities. Security teams are advised to monitor for similar domain patterns, scrutinize suspicious training sites, and educate users about the risks.

The LummaC2 campaign represents a sophisticated infostealing malware operation that leverages an extensive and covert domain infrastructure to facilitate malware delivery and command-and-control (C2) activities. Investigations have uncovered nearly 500 domains linked to this campaign, characterized by highly malicious risk scores and consistent registration patterns. These domains predominantly use Eastern European personal names and the inbox[.]eu email domain for registration, suggesting a coordinated effort to mask the true operators. The domains primarily masquerade as providers of technical education courses, a tactic designed to lure victims into engaging with malicious content under the guise of legitimate training resources. Among these, four domains have been identified as actual LummaC2 login panels, serving as interfaces for threat actors to manage infected systems or distribute malware payloads. The infrastructure employs specific top-level domains (TLDs) and naming conventions, and intriguingly, includes a Hong Kong address linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), indicating potential geopolitical or regulatory evasion strategies. The campaign aligns with several MITRE ATT&CK techniques, including spearphishing via service (T1566.002), establishing and using infrastructure (T1583.001), domain generation algorithms or domain fronting (T1589.002), and leveraging compromised or malicious domains (T1585, T1584.001). Although no known exploits are currently active in the wild, the campaign’s infrastructure and tactics pose a significant risk for credential theft, data exfiltration, and further malware dissemination. Security teams are advised to monitor for domain registration patterns similar to those identified, scrutinize suspicious technical education websites, and implement user awareness programs to mitigate the risk of social engineering attacks associated with this campaign.

Detailed information about Part 2: Tracking LummaC2 Infrastructure. Get real-time updates, technical details, and mitigation strategies.

Part 2: Tracking LummaC2 Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Part 2: Tracking LummaC2 Infrastructure

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Source: https://hackread.com/pathwiper-malware-hit-ukraines-critical-infrastructure/

The PathWiper malware is a newly identified malicious software campaign targeting Ukraine's critical infrastructure. While detailed technical specifics of the malware's operation are limited, the designation as 'PathWiper' suggests destructive capabilities, likely involving the wiping or deletion of file system paths or critical data. The malware's targeting of critical infrastructure implies an intent to disrupt essential services such as energy, water, transportation, or communications networks. Given the critical infrastructure context, the malware may employ sophisticated techniques to evade detection, persist within operational technology (OT) environments, and cause significant operational disruption. The lack of detailed indicators or affected versions suggests this is an emerging threat with limited public technical disclosure, but the critical severity rating underscores the potential for severe impact. The source of information is a Reddit post linking to a cybersecurity news article, indicating early-stage reporting rather than comprehensive technical analysis. No known exploits in the wild have been confirmed, but the urgency and critical classification imply active or imminent threat activity. Overall, PathWiper represents a high-risk malware threat aimed at destabilizing vital infrastructure systems, likely leveraging destructive payloads to impair availability and operational continuity.

Detailed information about New PathWiper Malware Strikes Ukraine's Critical Infrastructure. Get real-time updates, technical details, and mitigation strategies.

New PathWiper Malware Strikes Ukraine's Critical Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack

The PathWiper malware is a newly identified data wiper malware that reportedly disrupted Ukrainian critical infrastructure in an attack occurring in 2025. Data wiper malware is designed to irreversibly delete or corrupt data on infected systems, rendering them unusable and causing significant operational disruption. Although specific technical details such as infection vectors, propagation methods, or targeted systems are not provided, the critical severity classification and the targeting of critical infrastructure suggest a sophisticated attack aimed at causing maximum damage to essential services. Data wipers typically overwrite or erase data at the file system or disk level, often bypassing recovery mechanisms, which can lead to prolonged outages and require extensive recovery efforts. The attack on Ukrainian critical infrastructure aligns with a pattern of cyberattacks targeting national infrastructure to cause disruption and potentially influence geopolitical situations. The lack of known exploits in the wild and minimal discussion on Reddit indicates this is a newly emerging threat with limited public technical analysis available. However, the critical impact on infrastructure highlights the urgency for organizations to understand and prepare for such threats.

Detailed information about New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack. Get real-time updates, technical details,

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

A spear phishing campaign targeting Polish entities has been observed, exploiting the CVE-2024-42009 vulnerability in Roundcube to steal user credentials. The campaign, attributed to UNC1151, involves sending emails with malicious JavaScript that installs a Service Worker in the victim's browser. This worker intercepts login attempts and sends credentials to the attackers. The exploit allows code execution when an email is opened. A new vulnerability, CVE-2025-49113, has also been discovered in Roundcube, potentially creating a more effective attack chain. The attackers use harvested credentials to analyze mailboxes, download address books, and spread further phishing messages. Organizations using Roundcube are advised to update their installations and review logs for indicators of compromise.

This threat involves a spearphishing campaign attributed to the threat actor UNC1151 targeting Polish entities by exploiting a critical vulnerability in the Roundcube webmail client, specifically CVE-2024-42009. Roundcube is a widely used open-source webmail solution deployed by many organizations for email access. The attack vector leverages malicious JavaScript embedded in spearphishing emails that, when opened, execute code allowing the installation of a Service Worker in the victim's browser. This Service Worker operates stealthily to intercept login attempts to Roundcube, capturing user credentials and transmitting them to attacker-controlled infrastructure. The exploit allows code execution simply upon opening the email, bypassing traditional security controls that rely on user interaction beyond opening the message. Additionally, a newly discovered vulnerability, CVE-2025-49113, in Roundcube may be chained with CVE-2024-42009 to create a more effective and persistent attack vector, potentially increasing the scope and impact of the campaign. After credential theft, UNC1151 uses the compromised accounts to analyze mailboxes, extract address books, and propagate further phishing emails internally, facilitating lateral movement and expanding their foothold within targeted organizations. The campaign employs advanced tactics such as service worker abuse (T1059.007), credential access (T1078), and spearphishing (T1566.001). Indicators of compromise include specific IP addresses, domains, URLs, and file hashes linked to the campaign. Organizations running Roundcube installations are urged to update their software promptly and conduct thorough log reviews for signs of compromise, such as unusual service worker registrations or unexpected login patterns.

Detailed information about UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign. Get real-time updates, technical details, and mit

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites file system artifacts with random data, targeting physical drives, volumes, and network shared drives. Its capabilities are similar to HermeticWiper, previously used against Ukrainian entities. The malware's sophisticated approach to identifying and corrupting connected drives and volumes distinguishes it from earlier wipers. This attack underscores the ongoing threat to Ukrainian infrastructure despite the prolonged conflict with Russia.

PathWiper is a newly identified destructive wiper malware targeting critical infrastructure in Ukraine, attributed to a Russia-nexus advanced persistent threat (APT) group. The malware is deployed using a legitimate endpoint administration framework, allowing it to propagate stealthily across connected endpoints within a network. Unlike ransomware or data theft malware, PathWiper's primary objective is data destruction. It overwrites file system artifacts with random data, targeting physical drives, logical volumes, and network shared drives, rendering affected systems unusable and data irrecoverable. This destructive behavior is similar to the previously observed HermeticWiper but PathWiper distinguishes itself with a more sophisticated mechanism for identifying and corrupting connected drives and volumes. The use of legitimate administrative tools for deployment indicates a high level of operational security and sophistication, complicating detection and response efforts. The malware's tactics align with multiple MITRE ATT&CK techniques, including persistence (T1543), credential access (T1078), discovery (T1082, T1083), defense evasion (T1070), lateral movement (T1135), command and control (T1059.003, T1059.005), and impact (T1490). No public exploits or patches currently exist, and detection relies on indicators such as the provided malware hash. This attack highlights the ongoing cyber threat to Ukrainian critical infrastructure amid geopolitical conflict, emphasizing the use of destructive malware as a strategic weapon to disrupt essential services.

Detailed information about Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine. Get real-time updates, technical details, and 

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

The provided information pertains to a set of Indicators of Compromise (IOCs) published on 2025-04-13 by the ThreatFox MISP Feed, categorized under malware with a focus on OSINT (Open Source Intelligence), payload delivery, and network activity. The data appears to be a collection of threat intelligence indicators rather than a description of a specific exploit or vulnerability. No affected product versions are listed, no patches are available, and there are no known exploits in the wild associated with these IOCs. The threat level is indicated as medium (threatLevel: 2), with moderate distribution (distribution: 3) and minimal detailed technical analysis (analysis: 1). The absence of concrete technical details such as malware behavior, attack vectors, or exploitation techniques limits the ability to provide a deep technical explanation. Essentially, this entry serves as an OSINT feed update providing threat indicators that can be used to detect or monitor potential malicious activity related to payload delivery and network behavior. The lack of CWE identifiers and patch information further suggests this is intelligence for detection rather than a vulnerability requiring remediation.

ClearFake payload delivery domain (confidence level: 100%)

Unknown Stealer payload delivery domain (confidence level: 100%)

Unknown RAT botnet C2 server (confidence level: 100%)

Unknown RAT botnet C2 domain (confidence level: 100%)

Cobalt Strike botnet C2 server (confidence level: 100%)

Unknown malware botnet C2 server (confidence level: 100%)

Hook botnet C2 server (confidence level: 100%)

Havoc botnet C2 domain (confidence level: 100%)

DCRat botnet C2 server (confidence level: 100%)

NetSupportManager RAT botnet C2 server (confidence level: 100%)

Bashlite botnet C2 domain (confidence level: 100%)

Cobalt Strike botnet C2 server (confidence level: 75%)

Cobalt Strike botnet C2 domain (confidence level: 100%)

AsyncRAT botnet C2 server (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-04-13. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-04-13 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-04-13

The provided information pertains to a set of Indicators of Compromise (IOCs) from the ThreatFox MISP feed dated May 6, 2025, categorized under malware with a focus on OSINT (Open Source Intelligence), network activity, and payload delivery. The data appears to represent a collection of threat intelligence artifacts rather than a specific vulnerability or active exploit. The threat level is indicated as medium with a threatLevel value of 2, suggesting moderate concern. No affected software versions or patches are listed, and there are no known exploits in the wild associated with these IOCs. The technical details imply some distribution activity (distribution score of 3) but limited analysis (analysis score of 1) and a low threat level overall. The absence of concrete technical indicators such as specific malware names, attack vectors, or exploit mechanisms limits the ability to provide a detailed technical breakdown of a particular threat. Instead, this entry serves as an OSINT resource for network activity and payload delivery patterns that may be used by security teams to enhance detection capabilities.

Sliver botnet C2 server (confidence level: 50%)

Bashlite botnet C2 server (confidence level: 75%)

FAKEUPDATES payload delivery domain (confidence level: 100%)

Sliver payload delivery URL (confidence level: 50%)

XWorm payload delivery URL (confidence level: 50%)

Lumma Stealer botnet C2 domain (confidence level: 100%)

Remcos botnet C2 server (confidence level: 100%)

MimiKatz botnet C2 server (confidence level: 100%)

XWorm botnet C2 server (confidence level: 100%)

BlankGrabber botnet C2 (confidence level: 100%)

AsyncRAT botnet C2 domain (confidence level: 100%)

Unknown malware botnet C2 (confidence level: 100%)

Cobalt Strike botnet C2 domain (confidence level: 75%)

Tofsee botnet C2 server (confidence level: 100%)

Hook botnet C2 domain (confidence level: 50%)

Detailed information about ThreatFox IOCs for 2025-05-06. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-05-06 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-05-06

VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature.

FluBot is a well-known Android banking Trojan that primarily spreads via SMS phishing campaigns. It tricks users into installing a malicious app that masquerades as legitimate software, often delivered through deceptive SMS messages containing links. Once installed, FluBot gains extensive control over the infected device, including the ability to intercept SMS messages, manipulate data, control call functions, and remotely wipe data without authorization. The malware leverages these capabilities to steal sensitive information such as banking credentials, intercept two-factor authentication codes sent via SMS, and potentially disrupt device availability by wiping data. The provided information references a VT collection of FluBot threat intelligence encoded in a STIX 2.1 bundle, imported via MISP-STIX. The tags and MITRE ATT&CK patterns associated with this threat highlight its multifaceted attack techniques: delivering malicious apps through alternative means (T1476), unauthorized remote data wiping (T1469), call control (T1616), data manipulation (T1641), SMS control (T1582), and SMS message capture (T1412). The threat is categorized under data and SMS interception, payload delivery, and network activity. Although no specific affected versions or patches are noted, FluBot’s modus operandi relies on social engineering and exploitation of user trust rather than software vulnerabilities. The threat is marked with low severity and 50% certainty, indicating moderate confidence in the intelligence. No known exploits in the wild are reported in this specific collection, but FluBot remains a persistent threat in mobile malware landscapes.

Detailed information about VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import fea

VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature. - Live Threat Intelligence - Threat Radar | OffSeq.com

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Operation Endgame 2.0 represents a coordinated international law enforcement effort targeting cybercriminal groups operating the DanaBot malware family. DanaBot is a sophisticated modular malware platform developed in Delphi, notable for its extensive capabilities including keylogging, screenshot capture, desktop video recording, file exfiltration, web browser content injection, and deployment of secondary malware payloads. Functioning as Malware-as-a-Service (MaaS), DanaBot enables affiliates to conduct a variety of cyberattacks without requiring deep technical expertise. The malware communicates with its command and control (C2) infrastructure using a custom binary protocol secured with RSA and AES encryption, enhancing its resilience against interception and analysis. It relies on hardcoded C2 servers and employs Tor as a fallback communication channel, complicating efforts to disrupt its operations. Historically, DanaBot has been leveraged in targeted espionage campaigns against government officials in the Middle East and Eastern Europe, as well as in distributed denial-of-service (DDoS) attacks targeting Ukrainian servers. The presence of over 50 known affiliate nicknames indicates a broad and decentralized operator base. The malware’s use of advanced techniques such as credential dumping (T1003), persistence mechanisms (T1543, T1547), lateral movement (T1090), and execution through user interaction (T1204) underscores its versatility and threat level. Despite the absence of known exploits in the wild for specific software vulnerabilities, DanaBot’s modularity and MaaS model make it a persistent and adaptable threat vector.

Detailed information about Operation Endgame 2.0. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Hungary

Filter Threats

Threats Affecting Hungary

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility