Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Bitdefender Labs has uncovered a new threat actor group named Curly COMrades, operating since mid-2024 to support Russian interests. The group targets critical organizations in countries experiencing geopolitical shifts, focusing on judicial and government bodies in Georgia and an energy distribution company in Moldova. Their primary objective is to maintain long-term network access and steal credentials. The attackers use proxy tools like Resocks, SSH, and Stunnel to establish multiple entry points, and deploy a new backdoor called MucorAgent. They also utilize compromised legitimate websites as traffic relays to complicate detection. The group's tactics include credential theft, lateral movement, and data exfiltration, employing both custom and open-source tools.

The Curly COMrades threat actor group, identified by Bitdefender Labs in mid-2024, is a state-aligned cyber espionage entity supporting Russian geopolitical interests. Their operations focus on critical infrastructure and government institutions in regions undergoing geopolitical tension, specifically targeting judicial and governmental bodies in Georgia and an energy distribution company in Moldova. The group’s primary goal is to maintain persistent, long-term access to victim networks to conduct credential theft, lateral movement, and data exfiltration. They employ a sophisticated toolkit combining custom malware and open-source tools. A notable component is their proprietary backdoor named MucorAgent, which facilitates stealthy remote access. To evade detection and complicate attribution, Curly COMrades leverage proxy tools such as Resocks, SSH tunnels, and Stunnel, establishing multiple redundant entry points. Additionally, they exploit compromised legitimate websites as traffic relays, masking command and control communications within legitimate network traffic. Their tactics include credential dumping (T1003), lateral movement (T1021), process injection (T1055), and hijacking CLSID entries (T1212), among others, reflecting a mature and multi-faceted attack methodology. The absence of known exploits in the wild suggests targeted, selective operations rather than broad campaigns. Overall, Curly COMrades represent a persistent threat actor with capabilities tailored for espionage and network persistence in geopolitically sensitive environments.

Detailed information about A New Threat Actor Targeting Geopolitical Hotbeds. Get real-time updates, technical details, and mitigation strategies.

A New Threat Actor Targeting Geopolitical Hotbeds - Live Threat Intelligence - Threat Radar | OffSeq.com

A New Threat Actor Targeting Geopolitical Hotbeds

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Source: https://hackread.com/pathwiper-malware-hit-ukraines-critical-infrastructure/

The PathWiper malware is a newly identified malicious software campaign targeting Ukraine's critical infrastructure. While detailed technical specifics of the malware's operation are limited, the designation as 'PathWiper' suggests destructive capabilities, likely involving the wiping or deletion of file system paths or critical data. The malware's targeting of critical infrastructure implies an intent to disrupt essential services such as energy, water, transportation, or communications networks. Given the critical infrastructure context, the malware may employ sophisticated techniques to evade detection, persist within operational technology (OT) environments, and cause significant operational disruption. The lack of detailed indicators or affected versions suggests this is an emerging threat with limited public technical disclosure, but the critical severity rating underscores the potential for severe impact. The source of information is a Reddit post linking to a cybersecurity news article, indicating early-stage reporting rather than comprehensive technical analysis. No known exploits in the wild have been confirmed, but the urgency and critical classification imply active or imminent threat activity. Overall, PathWiper represents a high-risk malware threat aimed at destabilizing vital infrastructure systems, likely leveraging destructive payloads to impair availability and operational continuity.

Detailed information about New PathWiper Malware Strikes Ukraine's Critical Infrastructure. Get real-time updates, technical details, and mitigation strategies.

New PathWiper Malware Strikes Ukraine's Critical Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar allows Stored XSS. This issue affects Bg Orthodox Calendar: from n/a through 0.13.10.

CVE-2025-28958 is a high-severity vulnerability classified as CWE-352, indicating a Cross-Site Request Forgery (CSRF) issue in the Bg Orthodox Calendar software developed by Vadim Bogaiskov. The vulnerability affects versions up to 0.13.10. CSRF vulnerabilities allow an attacker to trick an authenticated user into submitting a forged request to a web application, potentially causing unintended actions. In this case, the CSRF vulnerability enables a Stored Cross-Site Scripting (XSS) attack, which means that malicious scripts can be permanently stored on the vulnerable application and executed in the context of users’ browsers when they access affected pages. The CVSS 3.1 base score of 7.1 reflects a high severity, with the vector indicating network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), scope changed (S:C), and impacts on confidentiality, integrity, and availability rated as low to low and low respectively (C:L/I:L/A:L). The scope change (S:C) suggests that the vulnerability affects components beyond the initially vulnerable component, increasing its impact. The vulnerability was published on June 6, 2025, with no known exploits in the wild yet and no available patches at the time of reporting. The Bg Orthodox Calendar is a specialized calendar application, likely used by communities or organizations that follow the Orthodox Christian calendar, which may include religious institutions or cultural organizations. The combination of CSRF and stored XSS can allow attackers to perform unauthorized actions on behalf of users and inject persistent malicious scripts, potentially leading to session hijacking, data theft, or further compromise of user accounts and systems.

Detailed information about CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar affecting Vadim Bogaiskov Bg Orthod

CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-28958: CWE-352 Cross-Site Request Forgery (CSRF) in Vadim Bogaiskov Bg Orthodox Calendar

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

The threat involves two newly discovered Android spyware families attributed to the Russian Gamaredon APT group, as identified through OSINT by Lookout. Gamaredon is a known Russian state-sponsored threat actor group historically targeting Ukrainian entities and related interests. The spyware families are designed to operate on Android devices, likely aiming to conduct espionage by collecting sensitive information from infected mobile devices. Although specific technical details about the spyware capabilities, infection vectors, or payloads are not provided, the association with Gamaredon suggests these spyware families could be used for targeted surveillance, data exfiltration, and persistent access on compromised devices. The discovery is based on open-source intelligence with a moderate certainty level (50%), and no known exploits or patches are currently available. The campaign is categorized under network activity and payload delivery, indicating that the spyware is likely distributed through network-based vectors or social engineering. The severity is currently assessed as low, reflecting limited available details and no confirmed widespread exploitation. However, the presence of such spyware families highlights ongoing mobile threats from nation-state actors targeting Android platforms, which are widely used across Europe.

Detailed information about OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT. Get real-time updates, technical details, and miti

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT - Live Threat Intelligence - Threat Radar | OffSeq.com

Silent Werewolf has launched two new campaigns targeting Russian and Moldovan organizations, utilizing sophisticated loaders to deliver malicious payloads. The attacks employ phishing emails with ZIP attachments containing obfuscated C# loaders. These loaders use legitimate tools and code obfuscation to evade detection. The first campaign exclusively targeted Russian energy, aircraft, and engineering sectors, while the second focused on both Moldovan and Russian entities. The adversaries hinder payload retrieval, making analysis challenging. They also utilize the Llama 2 large language model in some instances to bypass defenses. The campaigns demonstrate the threat actor's evolving tactics and their continued focus on espionage in the region.

The Silent Werewolf threat actor has initiated two distinct malware campaigns targeting organizations primarily in Russia and Moldova. These campaigns utilize sophisticated phishing techniques, delivering ZIP attachments that contain obfuscated C# loaders. These loaders are designed to evade detection by employing code obfuscation and leveraging legitimate tools, complicating traditional signature-based detection methods. The loaders facilitate the delivery of malicious payloads, although the adversaries have implemented mechanisms to hinder payload retrieval, making forensic and malware analysis more challenging. Notably, some instances of these attacks incorporate the Llama 2 large language model (LLM) to bypass security defenses, representing an evolution in attacker tactics by integrating AI-driven methods. The first campaign focuses exclusively on critical sectors within Russia, including energy, aircraft, and engineering, indicating a strategic espionage motive. The second campaign expands the target set to include both Moldovan and Russian entities. The use of multiple MITRE ATT&CK techniques such as T1132.001 (Data Encoding), T1059.007 (Command and Scripting Interpreter: PowerShell), T1036.005 (Masquerading), T1204.002 (User Execution: Malicious File), and others highlights the complexity and multi-faceted nature of these attacks. The campaigns underscore the threat actor’s capability to adapt and evolve, combining traditional malware delivery with AI-enhanced evasion tactics to maintain persistence and stealth within targeted networks.

Detailed information about Malware or LLM? Silent Werewolf employs new loaders to attack Russian and Moldovan organizations. Get real-time updates, technical de

Malware or LLM? Silent Werewolf employs new loaders to attack Russian and Moldovan organizations - Live Threat Intelligence - Threat Radar | OffSeq.com

Malware or LLM? Silent Werewolf employs new loaders to attack Russian and Moldovan organizations

The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2025-3870 is a vulnerability identified in the '1 Decembrie 1918' WordPress plugin developed by olarmarius. This plugin is affected in all versions up to and including version 1.dec.2012. The vulnerability is classified as Cross-Site Scripting (XSS) under CWE-79, specifically caused by improper neutralization of input during web page generation. The root cause is the absence or incorrect implementation of nonce validation on the plugin's main PHP page (1-decembrie-1918/1-decembrie-1918.php). Nonces are security tokens used in WordPress to verify that requests originate from legitimate sources and prevent Cross-Site Request Forgery (CSRF). Due to missing or faulty nonce checks, an unauthenticated attacker can craft a malicious request that, if an authenticated site administrator is tricked into clicking (e.g., via a phishing link), allows the attacker to update plugin settings and inject malicious scripts into the website. This injection can lead to the execution of arbitrary JavaScript in the context of the administrator's browser session, potentially compromising session tokens, redirecting users, or performing unauthorized actions. Although no known exploits are currently in the wild, the vulnerability's nature means it can be exploited remotely without authentication, relying on social engineering to induce administrator interaction. The plugin's widespread use in WordPress sites that focus on Romanian historical content or related themes increases the attack surface. The vulnerability was reserved and published in April 2025, with enrichment from CISA, but no official patch or CVSS score has been provided yet.

Detailed information about CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 

CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 1918 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-3870: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in olarmarius 1 Decembrie 1918

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.

The Interlock ransomware group, active since September 2024, represents a sophisticated and evolving threat actor specializing in targeted ransomware attacks, often referred to as Big Game Hunting. Despite maintaining a relatively low victim count, Interlock demonstrates significant adaptability and innovation in its attack methodologies. Initial access is typically gained through social engineering tactics such as fake browser updates and exploitation of the ClickFix technique, which is known for leveraging vulnerabilities in user interaction flows to deploy malicious payloads. Once inside a network, the group employs a multi-stage attack chain that includes deploying PowerShell backdoors, which allow stealthy and persistent command execution within compromised environments. Additionally, they utilize credential stealers, notably the Berserk Stealer, to harvest sensitive authentication data, facilitating lateral movement and privilege escalation. A custom Remote Access Trojan (RAT), referred to as the Interlock RAT, is also deployed to maintain long-term access and control over infected systems. The group’s operational tactics include double extortion, where data is not only encrypted but also exfiltrated, with threats to leak sensitive information if ransom demands are not met. This approach increases pressure on victims to comply. Interlock has been observed refining their tools continuously, including enhancements to their PowerShell backdoor capabilities and modifications to ransom notes to emphasize potential legal consequences, likely as a psychological tactic to coerce victims. Their strategic focus on avoiding large-scale visibility while maintaining operational effectiveness suggests a deliberate effort to evade detection and prolong their campaigns. The group targets multiple sectors across North America and Europe, indicating a broad geographic and vertical scope.

Detailed information about Interlock ransomware evolving under the radar. Get real-time updates, technical details, and mitigation strategies.

Interlock ransomware evolving under the radar - Live Threat Intelligence - Threat Radar | OffSeq.com

Interlock ransomware evolving under the radar

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

Operation RoundPress is a sophisticated espionage campaign attributed to the Russia-aligned threat actor group Sednit, targeting high-value webmail servers primarily used by governmental and defense sector entities. The operation exploits cross-site scripting (XSS) vulnerabilities in popular webmail platforms, including Roundcube, Horde, MDaemon, and Zimbra. Initially observed in 2023 focusing on Roundcube, the campaign expanded in 2024 to target additional webmail software, leveraging multiple vulnerabilities, notably including a zero-day in MDaemon (CVE-2023-23397) and other CVEs such as CVE-2023-43770 and CVE-2024-11182. The attackers inject malicious JavaScript code into the webmail interface, enabling the SpyPress malware to stealthily harvest sensitive information. This includes stealing webmail credentials, exfiltrating contacts and email messages, and in some cases bypassing two-factor authentication mechanisms, significantly increasing the risk of unauthorized access and data compromise. The operation's targeting of governmental and defense organizations in Eastern Europe, with additional victims in Africa, Europe, and South America, indicates a strategic focus on high-value intelligence collection. The exploitation method relies on injecting malicious scripts via XSS vulnerabilities, which do not require initial authentication but do require the victim to access the compromised webmail interface, making user interaction a factor. Despite the medium severity rating assigned, the presence of zero-day exploits and the ability to bypass two-factor authentication elevate the technical sophistication and potential impact of this threat. No known public exploits have been reported yet, but the active targeting and use of zero-days underscore the urgency for affected organizations to implement mitigations promptly.

Detailed information about Operation RoundPress targeting high-value webmail servers. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Moldova

Filter Threats

Threats Affecting Moldova

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility