Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Earth Kasha, an APT group believed to be part of APT10, has launched a new campaign in March 2025 targeting government agencies and public institutions in Taiwan and Japan. The campaign uses spear-phishing to deliver an updated version of the ANEL backdoor, potentially for espionage purposes. Key updates include a new command to support BOF execution in memory and the use of SharpHide for persistence. The second-stage backdoor, NOOPDOOR, now supports DNS over HTTPS for C&C communications. The attack chain involves compromised email accounts, malicious Excel files, and various evasion techniques. This campaign demonstrates Earth Kasha's continued evolution and poses significant geopolitical implications.

Earth Kasha, an Advanced Persistent Threat (APT) group linked to APT10, has initiated a new cyber espionage campaign in March 2025 targeting government agencies and public institutions primarily in Taiwan and Japan. The campaign employs spear-phishing techniques to deliver a sophisticated and updated version of the ANEL backdoor malware. Notably, the updated ANEL backdoor incorporates a new command enabling the execution of Beacon Object Files (BOF) directly in memory, enhancing stealth and evasion capabilities by avoiding disk writes. Additionally, the malware uses SharpHide, a known tool for hiding malicious code within legitimate .NET assemblies, to maintain persistence on compromised systems. The second-stage payload, NOOPDOOR, has been enhanced to support Command and Control (C&C) communications over DNS over HTTPS (DoH), which allows the malware to blend its traffic with legitimate encrypted DNS queries, making detection and blocking more challenging for network defenders. The attack chain begins with compromised email accounts used to send spear-phishing emails containing malicious Excel files. These files exploit social engineering and evasion techniques to bypass security controls and deliver the payload. The campaign demonstrates Earth Kasha's continuous evolution in Tactics, Techniques, and Procedures (TTPs), leveraging advanced evasion, persistence, and covert communication methods to conduct espionage operations. The use of spear-phishing, memory-resident payloads, and encrypted DNS communications indicates a high level of sophistication aimed at long-term infiltration and data exfiltration from sensitive government and public sector targets.

MD5 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc

SHA1 of e123fa2abf1a2f12af9f1828b317d486d1df63aff801d591c5e939eb06eb4cfc

Detailed information about Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Get real-time updates, technical details, and mitigation stra

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan - Live Threat Intelligence - Threat Radar | OffSeq.com

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

Threats Tagged 'apt10'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'apt10'

Lead Pen Test Professional