Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A global malware infection of Windows computers has been uncovered, stemming from software users installed themselves. The malware, disguised as legitimate PDF editors and manual finders, turns infected systems into residential proxies for malicious actors. The infection chain starts with deceptive ads posing as PDF manuals. The campaign, which appears to have ceased, was widespread due to large-scale advertising. The malware creates scheduled tasks, executes JavaScript files, and communicates with various C2 domains. It's potentially linked to the OneStart Browser, known for spreading spyware and adware. Authorities advise blocking access to related domains, checking for specific applications, and removing software signed by certain certificate issuers.

A recent malware campaign targeting Windows systems has been uncovered, involving malicious software disguised as legitimate PDF editors and manual finder tools. The infection vector primarily involved deceptive online advertisements that tricked users into downloading and installing these fake applications under the guise of accessing PDF manuals. Once installed, the malware establishes persistence by creating scheduled tasks and executing JavaScript files to maintain control over the infected system. It communicates with multiple command and control (C2) domains to receive instructions and potentially exfiltrate data. A notable aspect of this campaign is that infected machines are repurposed as residential proxies, allowing threat actors to route malicious traffic through these compromised endpoints, thereby masking their activities and complicating attribution. The campaign is potentially linked to the OneStart Browser, a known distributor of spyware and adware, suggesting a broader ecosystem of unwanted software distribution. The malware employs various techniques consistent with MITRE ATT&CK tactics such as scheduled task creation (T1053.005), script execution (T1059.007), masquerading (T1036.005), user execution (T1204.002), code signing abuse (T1553.002), signed binary proxy execution (T1218.007), persistence mechanisms (T1547.001), data staging (T1102.002), obfuscated files or information (T1027.002), and command and control communication (T1071.001). Although the campaign appears to have ceased, its widespread nature was facilitated by large-scale advertising campaigns, increasing the infection footprint globally. Authorities recommend blocking access to associated domains, auditing systems for suspicious applications, and removing software signed by specific certificate issuers linked to the malware distribution chain.

Detailed information about New malware campaign discovered via ManualFinder. Get real-time updates, technical details, and mitigation strategies.

New malware campaign discovered via ManualFinder - Live Threat Intelligence - Threat Radar | OffSeq.com

New malware campaign discovered via ManualFinder

Threats Tagged 'certificate abuse'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'certificate abuse'

Lead Pen Test Professional