Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embedded payload, and injects a Cobalt Strike beacon. The beacon is configured to mimic Bilibili traffic and communicates with a specific C2 server. The loader also patches the entry point of the loading executable with an infinite loop. This activity shares similarities with previously reported SLOW#TEMPEST campaigns, including targeting, folder structures, and the use of DLL sideloading for Cobalt Strike beacons.

The SLOW#TEMPEST Cobalt Strike Loader is a sophisticated malware threat delivered via an ISO image targeting primarily Chinese-speaking users. The infection chain begins with a deceptive LNK (Windows shortcut) file that, when executed, runs a legitimate Alibaba executable. This legitimate executable is then exploited to sideload a malicious DLL, a technique that abuses the trust in signed or known binaries to load malicious code without raising immediate suspicion. The loader employs multiple anti-analysis techniques to evade detection and reverse engineering efforts. It decrypts an embedded payload in memory and injects a Cobalt Strike beacon, a well-known post-exploitation tool used by threat actors for command and control (C2) communications and lateral movement within compromised networks. Notably, the beacon is configured to mimic traffic patterns of Bilibili, a popular Chinese video streaming platform, likely to blend in with normal network traffic and evade network-based detection. Additionally, the loader patches the entry point of the loading executable with an infinite loop, effectively stalling the legitimate process to avoid raising suspicion or crashing. This campaign shares characteristics with previous SLOW#TEMPEST activities, including targeting profiles, folder structures, and the use of DLL sideloading to deploy Cobalt Strike beacons. The malware leverages multiple MITRE ATT&CK techniques such as T1218.011 (signed binary proxy execution), T1204.002 (user execution via LNK files), T1573.001 (encrypted channel), T1497.001 and T1497.003 (anti-debugging and anti-analysis), T1553.002 (DLL side-loading), T1140 (deobfuscate/decode files or information), T1055 (process injection), and others, indicating a highly evasive and persistent threat actor. Indicators of compromise include multiple file hashes and a suspicious domain used for C2 communications. While no known exploits in the wild have been reported, the complexity and stealth of this loader make it a significant threat to targeted environments.

Detailed information about SLOW#TEMPEST Cobalt Strike Loader. Get real-time updates, technical details, and mitigation strategies.

SLOW#TEMPEST Cobalt Strike Loader - Live Threat Intelligence - Threat Radar | OffSeq.com

SLOW#TEMPEST Cobalt Strike Loader

Threats Tagged 'beacon'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'beacon'

Lead Pen Test Professional