Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers. Once opened, the malware automatically propagates via WhatsApp Web, causing infected accounts to be banned due to excessive spam activity.

SORVEPOTEL is a malware strain observed spreading on Windows systems through phishing emails containing malicious ZIP file attachments. The phishing lure is crafted to entice users to open the attachment on desktop environments, suggesting that attackers aim at enterprise users rather than casual consumers. Upon execution, the malware uses PowerShell scripts and loader components to establish persistence and execute payloads. It then propagates via WhatsApp Web by automatically sending spam messages to contacts, which results in infected WhatsApp accounts being banned due to spam detection. The malware's propagation via WhatsApp Web is notable because it leverages a widely used communication platform to spread laterally and potentially infect other users. The infection chain involves social engineering, script execution, and abuse of legitimate communication channels. Although initially reported in Brazil, the techniques used could be adapted to other regions where WhatsApp Web is prevalent. The malware employs various tactics such as code injection (T1055), command and scripting interpreter abuse (T1059), persistence mechanisms (T1547), and credential access techniques (T1550). No known exploits beyond phishing delivery are reported, and no CVSS score is assigned. The malware's impact includes potential disruption of business communications, account bans, and the risk of further spreading within enterprise environments.

MD5 of c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5

MD5 of bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328

MD5 of 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6

MD5 of 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b

MD5 of dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5

MD5 of 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500

SHA1 of 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6

SHA1 of 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500

SHA1 of 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b

SHA1 of c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5

SHA1 of bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328

SHA1 of dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5

Detailed information about Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US). Get real-time updates, technical details

Threats Tagged 'brazilian'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'brazilian'

Lead Pen Test Professional