Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated cyberattack campaign targeted the Russian IT industry and other entities globally in late 2024. The attackers used social media profiles and popular websites to deliver payload information, bypassing detection methods. They employed spear phishing emails with malicious RAR archives, exploiting DLL hijacking techniques to deploy Cobalt Strike Beacon. The campaign used profiles on GitHub, Microsoft Learn Challenge, Quora, and Russian social networks to conceal activities. The attacks primarily focused on Russian companies but also affected organizations in China, Japan, Malaysia, and Peru. The complexity of the methods used highlights the evolving tactics of threat actors in concealing well-known tools and emphasizes the need for robust cybersecurity measures.

This threat describes a sophisticated cyberattack campaign identified in late 2024 that primarily targeted the Russian IT industry but also affected organizations in China, Japan, Malaysia, and Peru. The attackers leveraged popular online platforms, including social media profiles and well-known websites such as GitHub, Microsoft Learn Challenge, Quora, and Russian social networks, to serve as command and control (C2) servers. This tactic allowed them to bypass traditional detection mechanisms by hiding C2 communications within legitimate platform traffic, complicating network monitoring and incident response efforts.

The initial infection vector involved spear phishing emails containing malicious RAR archives. Upon extraction, these archives exploited DLL hijacking vulnerabilities (technique T1574.001) to execute malicious payloads. DLL hijacking involves placing a malicious DLL in a location where a legitimate application loads it unknowingly, enabling code execution under the context of trusted processes. The payload deployed was the Cobalt Strike Beacon, a widely used post-exploitation tool that provides remote access, lateral movement capabilities, and payload delivery. The attackers further employed API obfuscation and shellcode techniques to evade detection and maintain persistence.

The use of legitimate online platforms as C2 infrastructure is a notable evolution in attacker tactics, as it leverages trusted domains and encrypted traffic to mask malicious communications. This approach complicates traditional signature-based detection and network filtering. The campaign's complexity and use of well-known tools in novel ways underscore the increasing sophistication of threat actors in targeted attacks. Although the campaign focused on Russian entities, the global footprint indicates a broader threat landscape.

Indicators of compromise include multiple file hashes associated with the malicious payloads and URLs linked to the delivery infrastructure. No CVE identifiers or known exploits in the wild are associated with this campaign, suggesting it relies on social engineering and exploitation of common DLL hijacking weaknesses rather than zero-day vulnerabilities.

Detailed information about Targeted attacks leverage accounts on popular online platforms as C2 servers. Get real-time updates, technical details, and mitigatio

Targeted attacks leverage accounts on popular online platforms as C2 servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Targeted attacks leverage accounts on popular online platforms as C2 servers

Threats Tagged 'api obfuscation'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'api obfuscation'

Lead Pen Test Professional