Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A newly emerged ransomware group called BERT has been targeting organizations across Asia and Europe since April. The group employs simple code with effective execution, impacting sectors such as healthcare, technology, and event services. BERT's ransomware operates on both Windows and Linux platforms, using PowerShell-based loaders, privilege escalation, and concurrent file encryption. On Linux systems, it can support up to 50 threads for fast encryption and forcibly shut down ESXi virtual machines. The group's tactics include disabling security features, terminating specific processes, and using standard encryption algorithms. BERT's variants have evolved, streamlining their encryption process and expanding their targeting activities. The Linux variant shows similarities to the REvil ransomware, suggesting possible code reuse.

The BERT ransomware group is a recently emerged threat actor active since April 2025, targeting organizations primarily in Asia and Europe. This group employs ransomware variants that affect both Windows and Linux platforms, demonstrating cross-platform capabilities that increase their attack surface. The ransomware uses PowerShell-based loaders on Windows to execute payloads, leveraging privilege escalation techniques to gain higher system rights. Concurrent file encryption is a notable feature, with the Linux variant capable of utilizing up to 50 threads to rapidly encrypt files, significantly reducing the window for detection and response. Additionally, the Linux variant forcibly shuts down ESXi virtual machines, indicating a focus on disrupting virtualized environments, which are common in enterprise data centers. The group disables security features and terminates specific processes to evade detection and hinder remediation efforts. The ransomware uses standard encryption algorithms, which, while effective, suggests a focus on operational efficiency rather than sophisticated cryptographic innovation. The Linux variant shows code similarities to the REvil ransomware, implying possible code reuse or shared development resources, which may provide insights into the group's capabilities and evolution. BERT's tactics include privilege escalation (MITRE ATT&CK T1548.002), disabling security tools (T1562.004, T1562.001), process termination (T1485), and data encryption (T1486), highlighting a multi-faceted approach to maximize impact. The group targets critical sectors such as healthcare, technology, and event services, which are vital to societal functioning and economic stability. The ransomware's evolution includes streamlining encryption processes and expanding targeting activities, indicating an adaptive threat actor capable of refining their tools and tactics over time. Indicators of compromise include multiple file hashes and an IP address (185.100.157.74) hosting payloads, useful for detection and blocking. No known exploits in the wild are reported, but the threat remains active and evolving.

Detailed information about BERT Ransomware Group Targets Asia and Europe on Multiple Platforms. Get real-time updates, technical details, and mitigation strateg

BERT Ransomware Group Targets Asia and Europe on Multiple Platforms - Live Threat Intelligence - Threat Radar | OffSeq.com

BERT Ransomware Group Targets Asia and Europe on Multiple Platforms

Threats Tagged 'bert'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'bert'

Lead Pen Test Professional