Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A spear phishing campaign targeting a Colombian government agency under the Ministry of Commerce, Industry and Tourism was discovered in September 2025. The attack, attributed to BlindEagle, utilized a compromised email account within the organization to bypass security controls. The campaign employed a sophisticated multi-layer attack chain, including a fake web portal, nested JavaScript and PowerShell scripts, steganography, and the deployment of Caminho as a downloader for DCRAT. The attack leveraged legal-themed lures, in-memory execution, and abuse of legitimate services like Discord. BlindEagle's evolution in tactics and use of new tools like Caminho demonstrates their ongoing threat to Colombian institutions.

The BlindEagle threat actor launched a spear phishing campaign in September 2025 targeting a Colombian government agency under the Ministry of Commerce, Industry and Tourism. The attackers leveraged a compromised internal email account to bypass perimeter defenses and deliver a sophisticated multi-stage attack. The initial vector involved a fake web portal designed to lure victims with legal-themed content, exploiting user trust and social engineering. The payload delivery utilized nested JavaScript and PowerShell scripts, which executed in-memory to evade detection by traditional antivirus and endpoint security solutions. Steganography was employed to conceal malicious code within seemingly benign files, complicating forensic analysis. The downloader Caminho was used to fetch and deploy DCRAT, a remote access trojan capable of persistent control and data exfiltration. The campaign also abused legitimate services such as Discord for command and control communications, blending malicious traffic with normal network activity. The attack chain incorporated multiple MITRE ATT&CK techniques including T1053.005 (Scheduled Task), T1047 (Windows Management Instrumentation), T1059.007 (PowerShell), T1566.001 (Spear Phishing), and others related to defense evasion, persistence, and credential access. This evolution in tactics and tooling highlights BlindEagle’s continued focus on Colombian institutions and their ability to adapt to security improvements. No known exploits are publicly reported, and the attack requires initial user interaction through phishing. The overall campaign demonstrates a medium severity threat with significant impact on confidentiality and integrity of targeted systems.

Detailed information about BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Get real-time updates, technical details, and mitigation strat

BlindEagle Targets Colombian Government Agency with Caminho and DCRAT - Live Threat Intelligence - Threat Radar | OffSeq.com

BlindEagle Targets Colombian Government Agency with Caminho and DCRAT

Threats Tagged 'caminho'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'caminho'

Lead Pen Test Professional