Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Lazarus, an APT group with suspected East Asian origins, has recently employed the ClickFix social engineering technique in their phishing attacks. The group, known for targeting financial institutions and cryptocurrency exchanges, now uses fake job opportunities to lure victims to interview websites. These sites prompt users to 'fix' non-existent camera issues, tricking them into downloading malware disguised as Nvidia software updates. The malware deploys a Node.js environment and executes BeaverTail, a common Lazarus tool. On Windows 11 systems, an additional backdoor (drvUpdate.exe) is installed. The attack also affects macOS users. The malware establishes persistence and connects to command and control servers for further instructions and data exfiltration.

The threat described involves a sophisticated social engineering and malware campaign attributed to the Lazarus APT group, which is suspected to have East Asian origins. Lazarus is known for targeting financial institutions and cryptocurrency exchanges globally. In this recent campaign, the group employs a novel social engineering technique dubbed 'ClickFix'. This technique leverages fake job opportunity phishing lures that direct victims to fraudulent interview websites. These sites simulate a problem with the user's camera and prompt them to 'fix' this non-existent issue by downloading what appears to be an Nvidia software update. This update is actually malware designed to compromise the victim's system.

The malware payload uses a Node.js runtime environment to execute BeaverTail, a known Lazarus toolset used for post-exploitation activities. On Windows 11 systems, an additional backdoor component named drvUpdate.exe is installed, enhancing persistence and stealth. The attack also targets macOS users, indicating cross-platform capabilities. Once installed, the malware establishes persistence mechanisms to survive reboots and connects to command and control (C2) servers to receive further instructions and exfiltrate sensitive data.

The attack chain involves multiple MITRE ATT&CK techniques, including T1566 (phishing), T1204.002 (user execution of malicious content), T1547 (persistence), T1059 (command execution), and T1105 (remote file transfer), among others. The use of social engineering combined with sophisticated malware deployment and multi-platform targeting makes this a complex and dangerous threat. The campaign’s reliance on fake job interviews is particularly insidious, as it exploits current economic conditions and job-seeking behaviors to increase victim engagement.

Detailed information about Traps Beneath Fault Repair: Analysis of Recent Attacks Using ClickFix Technique. Get real-time updates, technical details, and mitiga

Traps Beneath Fault Repair: Analysis of Recent Attacks Using ClickFix Technique - Live Threat Intelligence - Threat Radar | OffSeq.com

Traps Beneath Fault Repair: Analysis of Recent Attacks Using ClickFix Technique

Threats Tagged 'apt-q-1'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'apt-q-1'

Lead Pen Test Professional