Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Bitdefender Labs has uncovered a new threat actor group named Curly COMrades, operating since mid-2024 to support Russian interests. The group targets critical organizations in countries experiencing geopolitical shifts, focusing on judicial and government bodies in Georgia and an energy distribution company in Moldova. Their primary objective is to maintain long-term network access and steal credentials. The attackers use proxy tools like Resocks, SSH, and Stunnel to establish multiple entry points, and deploy a new backdoor called MucorAgent. They also utilize compromised legitimate websites as traffic relays to complicate detection. The group's tactics include credential theft, lateral movement, and data exfiltration, employing both custom and open-source tools.

The Curly COMrades threat actor group, identified by Bitdefender Labs in mid-2024, is a state-aligned cyber espionage entity supporting Russian geopolitical interests. Their operations focus on critical infrastructure and government institutions in regions undergoing geopolitical tension, specifically targeting judicial and governmental bodies in Georgia and an energy distribution company in Moldova. The group’s primary goal is to maintain persistent, long-term access to victim networks to conduct credential theft, lateral movement, and data exfiltration. They employ a sophisticated toolkit combining custom malware and open-source tools. A notable component is their proprietary backdoor named MucorAgent, which facilitates stealthy remote access. To evade detection and complicate attribution, Curly COMrades leverage proxy tools such as Resocks, SSH tunnels, and Stunnel, establishing multiple redundant entry points. Additionally, they exploit compromised legitimate websites as traffic relays, masking command and control communications within legitimate network traffic. Their tactics include credential dumping (T1003), lateral movement (T1021), process injection (T1055), and hijacking CLSID entries (T1212), among others, reflecting a mature and multi-faceted attack methodology. The absence of known exploits in the wild suggests targeted, selective operations rather than broad campaigns. Overall, Curly COMrades represent a persistent threat actor with capabilities tailored for espionage and network persistence in geopolitically sensitive environments.

Detailed information about A New Threat Actor Targeting Geopolitical Hotbeds. Get real-time updates, technical details, and mitigation strategies.

A New Threat Actor Targeting Geopolitical Hotbeds - Live Threat Intelligence - Threat Radar | OffSeq.com

A New Threat Actor Targeting Geopolitical Hotbeds

APT28, a Russian threat group, has developed LAMEHUG, a Python-based malware that utilizes AI to generate and execute system commands. This malware, targeting Ukraine's security and defense sector, begins with a phishing email containing a malicious attachment. LAMEHUG employs the Qwen 2.5-Coder-32B-Instruct model via Hugging Face API to translate text instructions into system commands. It performs system reconnaissance, data theft, and exfiltration using AI-generated commands. The malware collects system information, searches for documents, and exfiltrates data via SFTP or HTTP POST requests. Multiple variants of LAMEHUG have been identified, each with different data exfiltration methods. This marks a significant evolution in malware capabilities, incorporating large language models to enhance attack flexibility and sophistication.

LAMEHUG is a novel Python-based malware developed by the Russian advanced persistent threat (APT) group APT28, notable for being the first known malware to integrate artificial intelligence (AI) capabilities directly into its operation. The malware leverages the Qwen 2.5-Coder-32B-Instruct large language model via the Hugging Face API to dynamically translate textual instructions into executable system commands. This AI integration allows LAMEHUG to adapt its behavior and generate sophisticated commands for system reconnaissance, data theft, and exfiltration, enhancing its flexibility and evasion capabilities compared to traditional malware. The infection vector begins with a phishing email targeting Ukraine’s security and defense sectors, containing a malicious attachment that deploys the malware. Once executed, LAMEHUG collects detailed system information, searches for sensitive documents, and exfiltrates data using multiple methods including SFTP and HTTP POST requests. Multiple variants of LAMEHUG have been identified, each employing different data exfiltration techniques, indicating ongoing development and customization by the threat actor. The malware’s use of AI to generate commands on the fly represents a significant evolution in malware sophistication, potentially complicating detection and response efforts. Indicators of compromise include multiple file hashes and a suspicious domain (stayathomeclasses.com) used in the campaign. While no known exploits are currently reported in the wild beyond the phishing vector, the campaign’s targeting of critical sectors and use of advanced AI techniques mark it as a significant threat.

Detailed information about New Arsenal: LAMEHUG, the First AI-Powered Malware. Get real-time updates, technical details, and mitigation strategies.

New Arsenal: LAMEHUG, the First AI-Powered Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

New Arsenal: LAMEHUG, the First AI-Powered Malware

A Malware-as-a-Service operation utilizing Amadey for payload delivery has been identified, with connections to a SmokeLoader phishing campaign targeting Ukrainian entities. The operation exploits fake GitHub accounts to host payloads and tools, bypassing web filtering. Emmenhtal, a multistage downloader, is used to download Amadey and other malware. The activity involves various malware families and GitHub repositories for staging custom payloads. Similarities in tactics and indicators between the SmokeLoader campaign and Amadey MaaS activity have been observed. The operation demonstrates adaptability in delivering diverse tooling, including legitimate software like PuTTY. The threat actors employ sophisticated obfuscation techniques and leverage public platforms for malware distribution.

This threat concerns a Malware-as-a-Service (MaaS) operation that leverages the Emmenhtal multistage downloader and the Amadey malware family to deliver payloads, primarily targeting Ukrainian entities. The operation is linked to a SmokeLoader phishing campaign, which uses social engineering to trick victims into executing malicious payloads. The attackers exploit fake GitHub accounts to host malware payloads and tools, enabling them to bypass traditional web filtering mechanisms by blending malicious content with legitimate public platforms. Emmenhtal acts as a downloader that retrieves Amadey and other malware variants, facilitating a modular and adaptable infection chain. The campaign employs multiple malware families, including RedLine, Lumma, AsyncRAT, and Rhadamanthys, indicating a broad and flexible toolkit. The use of legitimate software such as PuTTY as part of the delivery mechanism further complicates detection efforts. Sophisticated obfuscation techniques are employed to evade signature-based detection and analysis. The operation’s tactics, techniques, and procedures (TTPs) show overlaps with known SmokeLoader campaigns, suggesting either shared infrastructure or collaboration between threat actors. Indicators of compromise include IP addresses (185.215.113.16 and 185.215.113.43) and domains such as pivqmane.com and subprocess.run, which are used for command and control or payload hosting. Although no known exploits are reported in the wild for this specific campaign, the MaaS model allows for rapid customization and distribution of malware, increasing the threat’s persistence and reach. The medium severity rating reflects the campaign’s targeted nature and the complexity of its delivery mechanisms, which require user interaction (phishing) but can lead to significant compromise if successful.

Detailed information about MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities. Get real-time updates, technical details, and

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities - Live Threat Intelligence - Threat Radar | OffSeq.com

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities

Pro-Russian Cybercrime Network Demolished in Operation Eastwood

Source: https://www.infosecurity-magazine.com/news/prorussian-cybercrime-network/

Operation Eastwood refers to a coordinated law enforcement and cybersecurity effort that successfully dismantled a pro-Russian cybercrime network. This network was engaged in various malicious cyber activities, likely including financially motivated attacks such as ransomware, data theft, and fraud, as well as potentially politically motivated cyber operations aligned with pro-Russian interests. Although specific technical details about the malware, attack vectors, or exploited vulnerabilities are not provided, the campaign's high severity rating and the involvement of a state-affiliated cybercrime group indicate a sophisticated and well-resourced adversary. The operation's success in disrupting this network suggests that the threat actors had established infrastructure and capabilities that posed a significant risk to targeted organizations. The lack of known exploits in the wild and absence of affected software versions imply that the threat was more campaign-based rather than exploiting a specific software vulnerability. The network's activities likely included phishing, credential theft, and exploitation of common security weaknesses to infiltrate systems and exfiltrate data or deploy ransomware. The pro-Russian alignment of the group also suggests potential geopolitical motivations behind some attacks, possibly targeting entities perceived as adversaries or strategic interests of Russia.

Detailed information about Pro-Russian Cybercrime Network Demolished in Operation Eastwood. Get real-time updates, technical details, and mitigation strategies.

Pro-Russian Cybercrime Network Demolished in Operation Eastwood - Live Threat Intelligence - Threat Radar | OffSeq.com

Pro-Russian Cybercrime Network Demolished in Operation Eastwood

Reddit Discussion: Pro-Russian Cybercrime Network Demolished in Operation Eastwood

A malicious CHM file targeting Poland was discovered, containing an infection chain that drops and executes a C++ downloader. The CHM file displays a decoy image while executing obfuscated JavaScript to extract and run a DLL. The downloader retrieves a payload from a domain associated with previous Belarus-linked threat activities. The payload is encrypted and appended to an image file. The infection process involves multiple stages, including the use of LOLbins and the creation of a scheduled task for persistence. This campaign shows similarities to activities attributed to threat actors like FrostyNeighbor and UNC1151, known for targeting Eastern European countries.

This threat involves a multi-stage malware campaign attributed to a Belarus-linked threat actor, likely associated with groups such as FrostyNeighbor and UNC1151, known for targeting Eastern European countries. The initial infection vector is a malicious CHM (Compiled HTML Help) file specifically targeting Poland. Upon execution, the CHM file displays a decoy image to the user while running obfuscated JavaScript code that extracts and executes a DLL payload. This DLL is a C++ downloader that contacts a command and control (C2) server hosted on a domain previously linked to Belarus-nexus threat activities. The downloader retrieves an encrypted payload appended to an image file, employing steganography to conceal the malicious content. The infection chain leverages living-off-the-land binaries (LOLBins) to execute commands and evade detection, and establishes persistence by creating a scheduled task (technique T1053.005). Additional tactics include process injection (T1055), obfuscation (T1027), masquerading (T1036), and use of unsigned or uncommon DLLs (unt32.dll, net32.dll) to facilitate stealth and maintain foothold. The campaign's complexity and use of multiple evasion techniques indicate a well-resourced and capable adversary focused on espionage or disruption within Eastern Europe. Indicators of compromise include multiple file hashes and a suspicious URL hosting the steganographic payload. No known exploits are currently reported in the wild, but the infection chain’s sophistication suggests targeted attacks rather than opportunistic mass campaigns.

Detailed information about Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland. Get real-time updates, technical details, and mitigation strategies.

Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland - Live Threat Intelligence - Threat Radar | OffSeq.com

Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland

'Batavia' Windows spyware campaign targets dozens of Russian orgs

Source: https://www.bleepingcomputer.com/news/security/batavia-windows-spyware-campaign-targets-dozens-of-russian-orgs/

The 'Batavia' Windows spyware campaign is a targeted cyber espionage operation primarily aimed at dozens of organizations within Russia. This campaign involves the deployment of spyware specifically designed for Windows environments, enabling threat actors to covertly gather sensitive information from compromised systems. Although detailed technical specifics such as infection vectors, persistence mechanisms, or command and control infrastructure are not provided, the campaign's classification as spyware indicates capabilities for data exfiltration, keylogging, screen capturing, and potentially lateral movement within targeted networks. The campaign's targeting of Russian organizations suggests a geopolitical motivation, possibly linked to intelligence gathering or disruption efforts. The absence of known exploits in the wild and lack of affected software versions imply that this campaign may rely on social engineering, spear-phishing, or custom malware delivery rather than exploiting publicly disclosed vulnerabilities. The campaign's high severity rating underscores the significant risk posed by the spyware's ability to compromise confidentiality and integrity of sensitive data within targeted organizations.

Detailed information about 'Batavia' Windows spyware campaign targets dozens of Russian orgs. Get real-time updates, technical details, and mitigation strategie

'Batavia' Windows spyware campaign targets dozens of Russian orgs - Live Threat Intelligence - Threat Radar | OffSeq.com

'Batavia' Windows spyware campaign targets dozens of Russian orgs

Reddit Discussion: 'Batavia' Windows spyware campaign targets dozens of Russian orgs

Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scale of its spearphishing campaigns, especially in the second half of the year. The group also made efforts to bypass network-based blocking, hiding most of its command and control infrastructure behind Cloudflare tunnels. Notable updates include enhancements to PteroLNK for weaponizing network drives, improvements in file exfiltration techniques, and the introduction of new downloaders. Despite these advancements, Gamaredon showed signs of operational limitations, occasionally abandoning or infrequently updating certain tools.

Gamaredon is a persistent advanced threat actor that throughout 2024 has concentrated its cyber operations against Ukrainian governmental institutions. The group employs spearphishing campaigns and weaponized USB drives as primary infection vectors. In 2024, Gamaredon significantly evolved its toolset by developing six new malware tools and enhancing existing ones to improve stealth and evasion capabilities. Key technical advancements include improvements to PteroLNK, a tool used to weaponize network drives, enabling more effective lateral movement and infection spread within targeted networks. The group also refined file exfiltration techniques, making data theft more efficient and harder to detect. Additionally, Gamaredon introduced new downloader malware variants to facilitate payload delivery. To evade network-based detection and blocking, the group increasingly leveraged Cloudflare tunnels to conceal its command and control (C2) infrastructure, complicating attribution and mitigation efforts. Despite these enhancements, Gamaredon exhibited some operational constraints, occasionally abandoning or infrequently updating certain tools, which may indicate resource limitations or shifting priorities. The threat actor’s focus on Ukrainian government entities, combined with its use of sophisticated evasion techniques and multi-vector infection methods, underscores its role as a state-aligned APT group engaged in espionage and disruption activities. No known public exploits have been reported, and the threat remains primarily targeted rather than opportunistic.

Detailed information about Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset. Get real-time updates, technical det

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset - Live Threat Intelligence - Threat Radar | OffSeq.com

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Source: https://thehackernews.com/2025/06/apt28-uses-signal-chat-to-deploy.html

The threat involves the advanced persistent threat group APT28, also known as Fancy Bear, leveraging the Signal messaging platform to deploy two distinct malware families: BEARDSHELL and COVENANT. APT28 is a well-known cyber espionage group linked to Russian state interests, historically targeting government, military, and critical infrastructure entities. The use of Signal chat as a command and control (C2) or delivery vector is notable because Signal is an encrypted, privacy-focused messaging application, which complicates detection and monitoring efforts by defenders. BEARDSHELL malware is likely a custom-developed implant designed for stealthy persistence, reconnaissance, and data exfiltration, while COVENANT is a known .NET-based post-exploitation framework used for lateral movement, privilege escalation, and command execution. The deployment in Ukraine suggests a targeted campaign aligned with geopolitical tensions in the region. The absence of affected versions or patch links indicates this is a malware distribution and operational tactic rather than an exploitation of a specific software vulnerability. No known exploits in the wild are reported, implying the infection vector relies on social engineering or covert delivery via Signal communications. The minimal discussion level and low Reddit score suggest limited public visibility, but the source is a trusted cybersecurity news outlet, The Hacker News, lending credibility. Overall, this threat represents a sophisticated, targeted espionage campaign leveraging encrypted communication channels to evade detection and deploy advanced malware tools.

Detailed information about APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine. Get real-time updates, technical details, and mitigation

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Reddit Discussion: APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

Hackers Use Social Engineering to Target Expert on Russian Operations

Source: https://hackread.com/hackers-use-social-engineering-expert-russian-operations/

This threat involves hackers employing social engineering tactics, specifically phishing, to target an expert on Russian operations. The attack vector centers around manipulating the target through deceptive communication, likely via email or messaging platforms, to gain unauthorized access to sensitive information or systems. Social engineering attacks exploit human psychology rather than technical vulnerabilities, making them particularly challenging to defend against. The lack of specific affected software versions or technical exploit details indicates the attack focuses on the individual rather than a software vulnerability. The source of this information is a Reddit post from the InfoSecNews subreddit, linking to an article on hackread.com, which is considered a moderately newsworthy external source. The discussion around this threat is minimal, and there are no known exploits in the wild or associated CWEs. Given the nature of the target—an expert on Russian operations—the attackers may aim to gather intelligence, disrupt ongoing investigations, or gain strategic insights. The medium severity rating reflects the potential impact on confidentiality and integrity if the social engineering attempt succeeds, though the attack requires user interaction and is targeted rather than widespread.

Detailed information about Hackers Use Social Engineering to Target Expert on Russian Operations. Get real-time updates, technical details, and mitigation strat

Title	Severity	Type	Source	Date

Threats Affecting Lithuania

Filter Threats

Threats Affecting Lithuania

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility