Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new PlugX variant. The campaign, active since 2022, shows overlaps with RainyDay and Turian backdoors, including the abuse of legitimate applications for DLL sideloading and shared encryption methods. The new PlugX variant's configuration format resembles that of RainyDay, suggesting attribution to Naikon. Analysis of victimology and technical implementation indicates a potential connection between Naikon and BackdoorDiplomacy, possibly sourcing tools from the same vendor. The malware families use similar infection chains, loaders, and shellcode structures, with shared RC4 keys for payload decryption. This campaign highlights the evolving tactics of Chinese-speaking threat actors and the potential convergence of previously distinct groups.

This threat involves a newly identified variant of the PlugX malware family, which is being deployed in a targeted campaign against telecommunications and manufacturing sectors primarily in Central and South Asian countries. The campaign has been active since 2022 and exhibits technical and operational overlaps with other malware families such as RainyDay and Turian. These overlaps include the abuse of legitimate applications for DLL search order hijacking (DLL sideloading), shared encryption methods (notably RC4 keys for payload decryption), and similar infection chains, loaders, and shellcode structures. The configuration format of this new PlugX variant closely resembles that of RainyDay, suggesting a common origin or shared development resources, attributed to the Chinese-speaking threat actor group Naikon. Furthermore, analysis indicates a potential connection between Naikon and another threat actor group known as BackdoorDiplomacy, possibly indicating that these groups source tools from the same vendor or collaborate. The malware leverages DLL search order hijacking, a technique where malicious DLLs are placed in locations that are loaded preferentially by legitimate applications, allowing stealthy execution of malicious code without raising immediate suspicion. The campaign’s use of sophisticated infection chains and shared cryptographic keys points to an evolution in tactics, techniques, and procedures (TTPs) among Chinese-speaking advanced persistent threat (APT) actors, demonstrating convergence and reuse of toolsets across previously distinct groups. The absence of known exploits in the wild suggests the infection vectors may rely on social engineering, spear-phishing, or exploitation of less-publicized vulnerabilities. The campaign’s focus on critical infrastructure sectors like telecommunications and manufacturing highlights its strategic intent, potentially for espionage or long-term access.

Detailed information about How a new PlugX variant abuses DLL search order hijacking. Get real-time updates, technical details, and mitigation strategies.

How a new PlugX variant abuses DLL search order hijacking - Live Threat Intelligence - Threat Radar | OffSeq.com

How a new PlugX variant abuses DLL search order hijacking

Threats Tagged 'backdoordiplomacy'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'backdoordiplomacy'

Lead Pen Test Professional