Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

The Tsundere botnet, identified in mid-2025, represents an advanced malware campaign targeting Windows systems. It uniquely leverages the Ethereum blockchain to store and retrieve its command and control (C2) server addresses via smart contracts, which significantly enhances its resilience and evasion capabilities by decentralizing its infrastructure. The botnet operates using Node.js, allowing it to execute dynamic JavaScript code received from its C2 servers, enabling flexible and adaptive malicious operations. Infection vectors include MSI installers and PowerShell scripts, often disguised as popular games to entice users into executing them. Communications between infected hosts and C2 servers are encrypted using AES-256 in CBC mode, complicating network detection efforts. The botnet is linked to a Russian-speaking threat actor known as 'koneko' and is associated with the 123 Stealer malware, indicating a lineage of credential and data theft capabilities. Additionally, Tsundere features a marketplace and control panel that facilitate the creation, customization, and sale of bot variants, suggesting a commoditized malware-as-a-service model. The use of Ethereum smart contracts for C2 infrastructure is a novel technique that complicates takedown attempts by law enforcement and security teams, as blockchain data is immutable and globally distributed. The botnet employs multiple tactics and techniques mapped to MITRE ATT&CK, including obfuscation, credential access, persistence, and command execution. While no known exploits are currently reported in the wild, the botnet's capabilities and infrastructure indicate a significant emerging threat to Windows environments worldwide.

Detailed information about The Tsundere botnet uses the Ethereum blockchain to infect its targets. Get real-time updates, technical details, and mitigation stra

The Tsundere botnet uses the Ethereum blockchain to infect its targets - Live Threat Intelligence - Threat Radar | OffSeq.com

The Tsundere botnet uses the Ethereum blockchain to infect its targets

Threats Tagged '123 stealer'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged '123 stealer'

Lead Pen Test Professional