Threat database

ThreatFox IOCs for 2026-03-19

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-18

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-17

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-16

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-15

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-14

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-13

Indicatortype#type:osint#tlp:whiteUnited States+9

KadNap botnet IOC (mainly Asus router)

ThreatFox IOCs for 2026-03-12

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-11

Indicatortype#type:osint#tlp:whiteUnited States+9

ThreatFox IOCs for 2026-03-09

Indicatortype#type:osint#tlp:whiteUnited States+9

Fake 7-Zip downloads are turning home PCs into proxy nodes

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

EPSS 0.3%VulnerabilitySonatype#cwe-918Germany+5

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

EPSS 0.4%VulnerabilitySonatype#cwe-79Germany+4

OSINT - ResidentBat: A new spyware family used by Belarusian KGB

Unknowntype#misp-galaxy:country="belarus"#type:osintBelarus+7

Telegram phishing and related activities

Phishingtype#misp-galaxy:mitre-attack-pattern="phishing - t1566"#type:osintGermany+6

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission.quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).

EPSS 0.2%Vulnerabilitymonkeytypegame#cwe-79Germany+8

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.

EPSS 0.3%VulnerabilitySonatype#cwe-79Germany+5

Sha1-Hulud is a newly identified cyber threat involving supply chain compromise and covert command and control (C2) communications using application layer protocols. Attackers exploit link-local IP addresses such as 169.254.169.254 and 169.254.170.2, commonly associated with cloud metadata services, to bypass perimeter defenses and blend malicious traffic with legitimate communications. A JavaScript component named bun_environment.js has been identified as part of the attack chain.

Unknowntype#shai-hulud#osintGermany+4

OSINT - PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

Campaigntype#misp-galaxy:country="ukraine"#misp-galaxy:mitre-attack-pattern="impersonation - t1656"Ukraine+6