Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is being used to maintain persistent access to victim organizations in the United States. Since March 2025, Mandiant Consulting has responded to intrusions across a range of industry verticals, most notably legal services, Software as a Service (SaaS) providers, Business Process Outsourcers (BPOs), and Technology. The value of these targets extends beyond typical espionage missions, potentially providing data to feed development of zero-days and establishing pivot points for broader access to downstream victims.

BRICKSTORM is a sophisticated backdoor malware campaign identified by the Google Threat Intelligence Group and Mandiant Consulting, active since March 2025. It targets organizations primarily in the United States but poses a risk globally, including Europe, especially in legal services, SaaS providers, BPOs, and technology sectors. The malware facilitates stealthy, persistent access to victim environments, enabling espionage activities that may support zero-day exploit development and provide pivot points for broader network compromise. BRICKSTORM affects both Windows and Linux systems and is associated with VMware vCenter components, indicating targeting of virtualized infrastructure. The malware employs multiple MITRE ATT&CK techniques such as T1071 (using application layer protocols for command and control), T1566 (phishing for initial access), T1546 (event-triggered execution for persistence), T1036 (masquerading), T1003 (credential dumping), and T1021 (remote services like SSH). It also uses SOCKS proxies and SSH tunneling to obfuscate network traffic and maintain covert communications. Indicators of compromise include specific MD5 and SHA1 hashes and YARA signatures. The adversary behind this campaign is UNC5221, a group linked to espionage operations. No known public exploits or CVEs are associated yet, and no patches are available. The campaign's medium severity rating reflects its espionage focus, persistence, and complexity, though it requires initial access and some level of user or system interaction to deploy. The malware's ability to maintain long-term access and target high-value sectors makes it a significant threat for organizations handling sensitive intellectual property and confidential data.

MD5 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df

MD5 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878

MD5 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035

SHA1 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df

SHA1 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035

SHA1 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878

Detailed information about Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog. Get real-time updates, tech

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog - Live Threat Intelligence - Threat Radar | OffSeq.com

Threats Tagged 'backup scan'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'backup scan'

Lead Pen Test Professional