Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A North Korea-linked threat actor known as KONNI has been observed conducting a phishing campaign targeting software developers and engineering teams, particularly those with blockchain expertise. The campaign uses AI-generated PowerShell backdoors and targets a broader range of countries in the APAC region. The infection chain begins with a Discord-hosted link downloading a ZIP archive containing a PDF lure and a malicious LNK file. The LNK file deploys additional components, including the AI-generated PowerShell backdoor. The backdoor employs various anti-analysis techniques and establishes persistence through scheduled tasks. This campaign demonstrates KONNI's evolution in tactics and tooling, including the adoption of AI-assisted malware development.

KONNI, a North Korea-linked cyber espionage group, has adopted AI-assisted malware development to enhance its phishing campaigns targeting software developers and engineering teams with blockchain expertise. The infection chain initiates via a Discord-hosted URL that downloads a ZIP archive containing a PDF lure and a malicious Windows LNK shortcut file. When executed, the LNK file deploys multiple components, including a PowerShell backdoor generated with AI assistance. This backdoor incorporates various anti-analysis techniques such as obfuscation, anti-debugging, and environment checks to evade detection and analysis. Persistence is achieved through scheduled tasks, allowing the malware to maintain foothold on compromised systems. The campaign leverages social engineering tailored to blockchain developers, increasing the likelihood of successful compromise. The use of AI in malware generation represents a significant advancement in the threat actor's capabilities, enabling rapid development of evasive and customized payloads. Although the campaign is currently focused on the APAC region, the targeting of blockchain professionals suggests potential interest in intellectual property and sensitive development environments globally. The lack of known exploits in the wild indicates the campaign relies on social engineering and delivery mechanisms rather than software vulnerabilities. The campaign's tactics align with MITRE ATT&CK techniques such as T1033 (System Owner/User Discovery), T1132.001 (Data Encoding: Standard Encoding), T1573.001 (Encrypted Channel: Symmetric Cryptography), and T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder), among others.

Detailed information about KONNI Adopts AI to Generate PowerShell Backdoors. Get real-time updates, technical details, and mitigation strategies.

KONNI Adopts AI to Generate PowerShell Backdoors - Live Threat Intelligence - Threat Radar | OffSeq.com

KONNI Adopts AI to Generate PowerShell Backdoors

Threats Tagged 'apac'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'apac'

Lead Pen Test Professional