Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scale of its spearphishing campaigns, especially in the second half of the year. The group also made efforts to bypass network-based blocking, hiding most of its command and control infrastructure behind Cloudflare tunnels. Notable updates include enhancements to PteroLNK for weaponizing network drives, improvements in file exfiltration techniques, and the introduction of new downloaders. Despite these advancements, Gamaredon showed signs of operational limitations, occasionally abandoning or infrequently updating certain tools.

Gamaredon is a persistent advanced threat actor that throughout 2024 has concentrated its cyber operations against Ukrainian governmental institutions. The group employs spearphishing campaigns and weaponized USB drives as primary infection vectors. In 2024, Gamaredon significantly evolved its toolset by developing six new malware tools and enhancing existing ones to improve stealth and evasion capabilities. Key technical advancements include improvements to PteroLNK, a tool used to weaponize network drives, enabling more effective lateral movement and infection spread within targeted networks. The group also refined file exfiltration techniques, making data theft more efficient and harder to detect. Additionally, Gamaredon introduced new downloader malware variants to facilitate payload delivery. To evade network-based detection and blocking, the group increasingly leveraged Cloudflare tunnels to conceal its command and control (C2) infrastructure, complicating attribution and mitigation efforts. Despite these enhancements, Gamaredon exhibited some operational constraints, occasionally abandoning or infrequently updating certain tools, which may indicate resource limitations or shifting priorities. The threat actor’s focus on Ukrainian government entities, combined with its use of sophisticated evasion techniques and multi-vector infection methods, underscores its role as a state-aligned APT group engaged in espionage and disruption activities. No known public exploits have been reported, and the threat remains primarily targeted rather than opportunistic.

Detailed information about Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset. Get real-time updates, technical det

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset - Live Threat Intelligence - Threat Radar | OffSeq.com

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Source: https://thehackernews.com/2025/06/apt28-uses-signal-chat-to-deploy.html

The threat involves the advanced persistent threat group APT28, also known as Fancy Bear, leveraging the Signal messaging platform to deploy two distinct malware families: BEARDSHELL and COVENANT. APT28 is a well-known cyber espionage group linked to Russian state interests, historically targeting government, military, and critical infrastructure entities. The use of Signal chat as a command and control (C2) or delivery vector is notable because Signal is an encrypted, privacy-focused messaging application, which complicates detection and monitoring efforts by defenders. BEARDSHELL malware is likely a custom-developed implant designed for stealthy persistence, reconnaissance, and data exfiltration, while COVENANT is a known .NET-based post-exploitation framework used for lateral movement, privilege escalation, and command execution. The deployment in Ukraine suggests a targeted campaign aligned with geopolitical tensions in the region. The absence of affected versions or patch links indicates this is a malware distribution and operational tactic rather than an exploitation of a specific software vulnerability. No known exploits in the wild are reported, implying the infection vector relies on social engineering or covert delivery via Signal communications. The minimal discussion level and low Reddit score suggest limited public visibility, but the source is a trusted cybersecurity news outlet, The Hacker News, lending credibility. Overall, this threat represents a sophisticated, targeted espionage campaign leveraging encrypted communication channels to evade detection and deploy advanced malware tools.

Detailed information about APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine. Get real-time updates, technical details, and mitigation

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Reddit Discussion: APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Hackers Use Social Engineering to Target Expert on Russian Operations

Source: https://hackread.com/hackers-use-social-engineering-expert-russian-operations/

This threat involves hackers employing social engineering tactics, specifically phishing, to target an expert on Russian operations. The attack vector centers around manipulating the target through deceptive communication, likely via email or messaging platforms, to gain unauthorized access to sensitive information or systems. Social engineering attacks exploit human psychology rather than technical vulnerabilities, making them particularly challenging to defend against. The lack of specific affected software versions or technical exploit details indicates the attack focuses on the individual rather than a software vulnerability. The source of this information is a Reddit post from the InfoSecNews subreddit, linking to an article on hackread.com, which is considered a moderately newsworthy external source. The discussion around this threat is minimal, and there are no known exploits in the wild or associated CWEs. Given the nature of the target—an expert on Russian operations—the attackers may aim to gather intelligence, disrupt ongoing investigations, or gain strategic insights. The medium severity rating reflects the potential impact on confidentiality and integrity if the social engineering attempt succeeds, though the attack requires user interaction and is targeted rather than widespread.

Detailed information about Hackers Use Social Engineering to Target Expert on Russian Operations. Get real-time updates, technical details, and mitigation strat

Hackers Use Social Engineering to Target Expert on Russian Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

Hackers Use Social Engineering to Target Expert on Russian Operations

Reddit Discussion: Hackers Use Social Engineering to Target Expert on Russian Operations

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

The threat involves two newly discovered Android spyware families attributed to the Russian Gamaredon APT group, as identified through OSINT by Lookout. Gamaredon is a known Russian state-sponsored threat actor group historically targeting Ukrainian entities and related interests. The spyware families are designed to operate on Android devices, likely aiming to conduct espionage by collecting sensitive information from infected mobile devices. Although specific technical details about the spyware capabilities, infection vectors, or payloads are not provided, the association with Gamaredon suggests these spyware families could be used for targeted surveillance, data exfiltration, and persistent access on compromised devices. The discovery is based on open-source intelligence with a moderate certainty level (50%), and no known exploits or patches are currently available. The campaign is categorized under network activity and payload delivery, indicating that the spyware is likely distributed through network-based vectors or social engineering. The severity is currently assessed as low, reflecting limited available details and no confirmed widespread exploitation. However, the presence of such spyware families highlights ongoing mobile threats from nation-state actors targeting Android platforms, which are widely used across Europe.

Detailed information about OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT. Get real-time updates, technical details, and miti

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT - Live Threat Intelligence - Threat Radar | OffSeq.com

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.

CVE-2022-3999 is a high-severity vulnerability affecting the DPD Baltic Shipping WordPress plugin versions prior to 1.2.57. The vulnerability arises from missing authorization checks and a lack of Cross-Site Request Forgery (CSRF) protection in an AJAX action within the plugin. Specifically, any authenticated user, including those with minimal privileges such as subscribers, can exploit this flaw to delete arbitrary options from the WordPress blog's database. This unauthorized deletion can lead to significant integrity and availability issues, potentially rendering the blog unavailable or causing malfunction of critical plugin or site configurations. The vulnerability is categorized under CWE-862 (Missing Authorization) and CWE-352 (Cross-Site Request Forgery), indicating that the plugin fails to verify whether the user has permission to perform the action and does not protect against forged requests. The CVSS v3.1 base score is 8.1, reflecting a high severity due to network attack vector, low attack complexity, requiring only low privileges (authenticated user), no user interaction, and resulting in high impact on integrity and availability, though confidentiality is not affected. No known exploits have been reported in the wild as of the published date. The vulnerability affects the plugin's AJAX endpoint, which is accessible remotely over the network, making exploitation feasible for any authenticated user without additional user interaction. The lack of authorization checks means that even users with minimal roles can perform destructive actions, which is a critical security oversight in WordPress plugin design. This vulnerability can be leveraged to disrupt the availability of websites using this plugin, potentially causing service outages or requiring restoration from backups.

Detailed information about CVE-2022-3999: CWE-862 Missing Authorization in Unknown DPD Baltic Shipping affecting Unknown DPD Baltic Shipping. Get real-time upda

CVE-2022-3999: CWE-862 Missing Authorization in Unknown DPD Baltic Shipping - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-3999: CWE-862 Missing Authorization in Unknown DPD Baltic Shipping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Djo VK Poster Group allows Reflected XSS.This issue affects VK Poster Group: from n/a through 2.0.3.



CVE-2024-24932 is a reflected Cross-site Scripting (XSS) vulnerability identified in the Djo VK Poster Group software, affecting versions up to 2.0.3. This vulnerability arises due to improper neutralization of user-supplied input during web page generation, classified under CWE-79. Specifically, the application fails to adequately sanitize or encode input before reflecting it back in the HTTP response, allowing an attacker to inject malicious scripts. When a victim accesses a crafted URL containing malicious payloads, the injected script executes in the victim's browser context. This can lead to session hijacking, credential theft, unauthorized actions on behalf of the user, or redirection to malicious sites. The vulnerability is reflected, meaning the malicious input is not stored persistently but is immediately echoed back in the response. No authentication is required to exploit this issue, and exploitation does not require user interaction beyond visiting a maliciously crafted link. There are no known public exploits in the wild at the time of reporting, and no patches have been published yet. The vulnerability was reserved and published in early 2024, with technical details enriched by CISA and Patchstack. The affected product, VK Poster Group by Djo, is a tool likely used for managing or automating posts on VK, a popular social media platform, which suggests a web-facing application with user interaction capabilities.

Detailed information about CVE-2024-24932: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Djo VK Poster Group af

CVE-2024-24932: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Djo VK Poster Group - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-24932: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Djo VK Poster Group

In February 2025, TA406, a North Korean state-sponsored actor, began targeting Ukrainian government entities with phishing campaigns aimed at gathering intelligence on the Russian invasion. The group utilized freemail senders impersonating think tank members to deliver both credential harvesting attempts and malware. Their tactics included using HTML and CHM files with embedded PowerShell for malware deployment, as well as fake Microsoft security alerts for credential theft. The malware conducted extensive reconnaissance on target hosts, gathering system information and checking for anti-virus tools. TA406's focus appears to be on collecting strategic, political intelligence to assess the ongoing conflict and potential risks to North Korean forces in the region.

In February 2025, the North Korean state-sponsored threat actor TA406 initiated a targeted phishing campaign against Ukrainian government entities. The campaign's primary objective is intelligence gathering related to the ongoing Russian invasion of Ukraine, with a strategic focus on assessing risks to North Korean forces potentially involved in the region. TA406 employs sophisticated social engineering tactics, impersonating think tank members via freemail accounts to increase the credibility of their phishing emails. These emails deliver malicious payloads through HTML and CHM (Compiled HTML Help) files embedding PowerShell scripts, enabling stealthy malware deployment. Additionally, the group uses fake Microsoft security alerts as a lure to harvest credentials. Once deployed, the malware performs extensive reconnaissance on infected hosts, collecting detailed system information and scanning for antivirus or other security tools to evade detection and maintain persistence. Indicators of compromise include specific file hashes, URLs hosting malicious payloads, and email addresses used in the phishing campaigns. Although no known exploits are reported in the wild and the campaign is rated medium severity, the use of PowerShell-based malware and credential harvesting techniques highlights TA406's capability to conduct prolonged espionage operations. The campaign's focus on Ukrainian government targets underscores its geopolitical motivation and the potential for intelligence to influence regional security dynamics.

Detailed information about TA406 Pivots to the Front. Get real-time updates, technical details, and mitigation strategies.

TA406 Pivots to the Front - Live Threat Intelligence - Threat Radar | OffSeq.com

TA406 Pivots to the Front

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Latvia

Filter Threats

Threats Affecting Latvia

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility