Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TAG-140, a threat actor group overlapping with SideCopy, has deployed an updated version of their DRAT remote access trojan, dubbed DRAT V2. This new variant, developed in Delphi, introduces enhanced command and control capabilities, including arbitrary shell command execution and improved C2 obfuscation techniques. The malware was distributed through a ClickFix-style social engineering attack, using a cloned Indian Ministry of Defence press portal. DRAT V2 demonstrates TAG-140's ongoing refinement of their tooling and their continued focus on Indian government and defense targets.

DRAT V2 is an updated variant of the DRAT remote access trojan (RAT) deployed by the threat actor group TAG-140, which overlaps with the SideCopy group. This malware is developed in Delphi and represents a significant evolution in TAG-140's toolkit, featuring enhanced command and control (C2) capabilities. Notably, DRAT V2 supports arbitrary shell command execution, allowing attackers to execute a wide range of commands on compromised systems, thereby increasing the scope of potential malicious activities. The malware also incorporates advanced C2 obfuscation techniques, making detection and attribution more difficult for defenders. The distribution method for DRAT V2 involves a social engineering attack modeled after the ClickFix style, leveraging a cloned Indian Ministry of Defence press portal to lure victims into executing the malware. This indicates a targeted campaign focusing on Indian government and defense sectors. The malware's tactics align with several MITRE ATT&CK techniques, including T1033 (System Owner/User Discovery), T1204.002 (User Execution: Malicious File), T1566.002 (Phishing: Spearphishing Link), T1071 (Application Layer Protocol), T1059 (Command and Scripting Interpreter), and T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder), among others. Indicators of compromise include multiple file hashes, IP addresses, and domains associated with the campaign. While no known exploits in the wild have been reported, the sophistication and targeted nature of DRAT V2 suggest a persistent threat actor refining their capabilities to maintain access and evade detection within high-value environments.

Detailed information about DRAT V2: Updated DRAT Emerges in Arsenal. Get real-time updates, technical details, and mitigation strategies.

DRAT V2: Updated DRAT Emerges in Arsenal - Live Threat Intelligence - Threat Radar | OffSeq.com

DRAT V2: Updated DRAT Emerges in Arsenal

Threats Tagged 'broaderaspect'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'broaderaspect'

Lead Pen Test Professional