Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat identified as "Charting TA2541's Flight" is a malware campaign attributed to the threat actor TA2541, characterized primarily as a remote access tool (RAT) with spyware capabilities. This malware enables unauthorized remote access to compromised systems, allowing attackers to stealthily monitor, control, and exfiltrate sensitive information. The classification tags indicate that the malware is used for nefarious activities involving remote access abuse, specifically through phishing vectors, which suggests that initial infection vectors likely involve social engineering techniques to deceive users into executing malicious payloads. The malware is persistent, described as having a "perpetual" lifetime, implying that it maintains long-term access to infected systems without easy detection or removal. Although no specific affected software versions or products are listed, the nature of RATs typically targets widely used operating systems or enterprise environments where remote access capabilities are prevalent. The absence of known exploits in the wild suggests this malware is either custom-built or distributed through targeted phishing campaigns rather than exploiting public vulnerabilities. The threat level is marked as high, reflecting the significant risk posed by remote access malware in enabling espionage, data theft, and potential lateral movement within networks. The certainty of the intelligence is moderate (50%), indicating some confidence in the attribution and behavior but possibly limited visibility into the full scope of the campaign. Overall, this malware represents a sophisticated espionage tool used by TA2541 to gain persistent, covert access to victim systems primarily through phishing, enabling extensive surveillance and data compromise.

Detailed information about Charting TA2541's Flight. Get real-time updates, technical details, and mitigation strategies.

Charting TA2541's Flight - Live Threat Intelligence - Threat Radar | OffSeq.com

Charting TA2541's Flight

OSINT - Iranian PupyRAT Bites Middle Eastern Organizations

PupyRAT is a remote access Trojan (RAT) linked to Iranian threat actors such as APT35 (also known as OilRig or Cleaver) and the Magic Hound intrusion set. This malware is designed to provide attackers with persistent, stealthy remote access to compromised systems. PupyRAT is a modular, multi-platform RAT primarily written in Python, capable of running on Windows, Linux, and macOS environments. It supports a wide range of capabilities including keylogging, credential theft, file system manipulation, command execution, and network reconnaissance. The malware’s modular architecture allows attackers to load additional plugins dynamically, enhancing its functionality and adaptability to different operational needs. The threat is primarily observed targeting Middle Eastern organizations, often aligned with espionage objectives typical of state-sponsored actors. Despite no known public exploits or patches, PupyRAT’s use by sophisticated Iranian APT groups indicates a high level of operational maturity and targeted deployment. The malware is typically delivered via spear-phishing campaigns or exploiting weak remote access configurations, enabling attackers to establish footholds within victim networks. Once inside, PupyRAT facilitates lateral movement and data exfiltration, posing significant risks to confidentiality and integrity of sensitive information. The threat intelligence tags associate this malware with espionage-focused Iranian APTs, emphasizing its use in strategic intelligence gathering rather than indiscriminate cybercrime. The lack of publicly available indicators of compromise (IOCs) and absence of known exploits in the wild suggest that detection and mitigation rely heavily on behavioral analysis and network monitoring rather than signature-based methods.

Detailed information about OSINT - Iranian PupyRAT Bites Middle Eastern Organizations. Get real-time updates, technical details, and mitigation strategies.

OSINT - Iranian PupyRAT Bites Middle Eastern Organizations - Live Threat Intelligence - Threat Radar | OffSeq.com

The Turla Kazuar RAT (Remote Access Trojan) is a malware attributed to the Turla threat group, also known as G0010, a well-known advanced persistent threat (APT) actor. Kazuar is a remote access tool designed to provide attackers with persistent, stealthy access to compromised systems. It enables the threat actor to conduct espionage, data exfiltration, and maintain control over targeted networks. Kazuar is part of the Turla malware family and is known for its modular architecture, allowing it to load additional payloads and adapt to different environments. The RAT typically operates by establishing covert communication channels with command and control (C2) servers, often using encrypted protocols to evade detection. Although the provided information indicates a low severity rating and no known exploits in the wild, the threat level is marked as 3 (moderate), reflecting its potential use in targeted attacks. The malware is linked to remote access abuse, spyware capabilities, and is associated with espionage activities. The lack of specific affected versions or patch information suggests that Kazuar is a tool used in targeted intrusions rather than a vulnerability affecting a broad range of products. The Turla group has historically targeted government, military, diplomatic, and critical infrastructure organizations, leveraging sophisticated malware like Kazuar to maintain long-term access and gather intelligence.

Detailed information about 2019-01-28: Turla Kazuar RAT. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'cert-xlm:malicious-code="spyware-rat"'

Filter Threats

Threats Tagged 'cert-xlm:malicious-code="spyware-rat"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility