Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, cyber security experts and computer science professors. The attackers posed as fictitious assistants to technology executives or researchers, directing victims to fake Gmail login pages or Google Meet invitations. This allowed them to intercept passwords and 2FA codes, gaining unauthorized access to victims' accounts. The group used a custom phishing kit implemented as a Single Page Application built with React, supporting various Google authentication flows and enabling 2FA relay attacks. The infrastructure relied on over 130 unique domains resolving to multiple IP addresses. Despite increased exposure, Educated Manticore continues to pose a persistent threat, particularly to individuals in Israel during the Iran-Israel conflict escalation.

Educated Manticore is an Iranian state-sponsored threat group linked to the Islamic Revolutionary Guard Corps (IRGC). This group has been conducting targeted spear-phishing campaigns aimed at Israeli journalists, cybersecurity professionals, and computer science academics. The attackers impersonate fictitious assistants to technology executives or researchers, leveraging social engineering to lure victims into interacting with malicious content. The core attack vector involves directing victims to counterfeit Gmail login pages or fraudulent Google Meet invitations. These phishing pages are crafted as Single Page Applications (SPAs) using React, enabling sophisticated mimicry of legitimate Google authentication flows. This design supports the interception of both passwords and two-factor authentication (2FA) codes through relay attacks, effectively bypassing standard 2FA protections. The infrastructure supporting these campaigns is extensive, utilizing over 130 unique domains that resolve to multiple IP addresses, indicating a robust and resilient command and control setup. Despite increased visibility and exposure of their tactics, Educated Manticore remains an active and persistent threat, particularly in the context of heightened tensions between Iran and Israel. The group’s use of advanced phishing kits and multi-domain infrastructure demonstrates a high level of operational capability and adaptability, targeting high-value individuals in the technology and academic sectors to gain unauthorized access to sensitive accounts and information.

CC=RU ASN=AS210512 internet technologies llc

Detailed information about Iranian Educated Manticore Targets Leading Tech Academics. Get real-time updates, technical details, and mitigation strategies.

Iranian Educated Manticore Targets Leading Tech Academics - Live Threat Intelligence - Threat Radar | OffSeq.com

Iranian Educated Manticore Targets Leading Tech Academics

Threats Tagged 'apt42'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'apt42'

Lead Pen Test Professional