Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Confucius group, a long-running cyber-espionage actor operating in South Asia, has evolved its tactics from document stealers to Python-based backdoors. Recent campaigns showcase the group's adaptability and growing sophistication, targeting government agencies, military organizations, and critical industries, particularly in Pakistan. The group has transitioned from using WooperStealer to deploying a Python variant of AnonDoor, demonstrating their ability to pivot between techniques, infrastructure, and malware families. Their attack chain includes weaponized Office documents, malicious LNK files, and multiple malware families, employing obfuscation techniques to evade detection. The group's persistence and rapid adaptation highlight the ongoing threat posed by state-aligned malware campaigns in the region.

The Confucius espionage group, a long-standing cyber-espionage actor primarily active in South Asia, has significantly evolved its operational tactics and malware arsenal. Historically known for deploying document-stealing malware such as WooperStealer, the group has transitioned to using more sophisticated Python-based backdoors, specifically a Python variant of AnonDoor. This evolution demonstrates the group's increasing technical sophistication and adaptability in response to defensive measures. Their attack methodology involves a multi-stage infection chain starting with weaponized Microsoft Office documents and malicious LNK (shortcut) files, which serve as initial infection vectors. These files are crafted to exploit user interaction and leverage obfuscation techniques to evade detection by traditional security solutions. Once executed, the malware establishes persistence and enables remote access and control over compromised systems. The group targets high-value entities including government agencies, military organizations, and critical infrastructure sectors, with a particular focus on Pakistan. The malware families used incorporate various tactics such as credential harvesting, reconnaissance, lateral movement, and data exfiltration. Indicators of compromise include multiple file hashes, suspicious URLs, and domains associated with the malware's command and control infrastructure. The use of Python backdoors allows for flexible and modular payloads, making detection and mitigation more challenging. The Confucius group's rapid pivot from stealer malware to backdoors underscores the persistent and evolving threat posed by state-aligned cyber-espionage campaigns in the region. The campaign also employs advanced obfuscation and anti-analysis techniques, complicating forensic investigations and incident response efforts.

Detailed information about Confucius Espionage: From Stealer to Backdoor. Get real-time updates, technical details, and mitigation strategies.

Confucius Espionage: From Stealer to Backdoor - Live Threat Intelligence - Threat Radar | OffSeq.com

Confucius Espionage: From Stealer to Backdoor

Threats Tagged 'anondoor'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'anondoor'

Lead Pen Test Professional