Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Famous Chollima, a North Korean threat group, has deployed a new malware campaign targeting job seekers by impersonating hiring organizations. The attack involves a trojanized Node.js application named 'Chessfi' and uses evolving malware tools BeaverTail and OtterCookie, which now include keylogging and screenshot capabilities. A malicious Visual Studio Code extension embedding these tools was also discovered, indicating new infection vectors. The malware steals cryptocurrency credentials by targeting multiple browsers and wallet extensions, and it can upload files from compromised systems. This campaign leverages social engineering and developer tools to infiltrate victims, focusing on cryptocurrency theft and credential harvesting. The threat is medium severity due to its broad capabilities and stealth but requires user interaction for infection. European organizations involved in software development, cryptocurrency, and job recruitment are at particular risk.

This threat involves a sophisticated malware campaign attributed to the North Korean group Famous Chollima, known for targeting cryptocurrency assets and credentials. The attackers impersonate legitimate hiring organizations to lure job seekers into installing a trojanized Node.js application called 'Chessfi'. This application acts as a delivery mechanism for two advanced malware tools, BeaverTail and OtterCookie, which have recently been enhanced with a new JavaScript module enabling keylogging and screenshot capture. These capabilities allow the attackers to monitor user activity and exfiltrate sensitive data stealthily. Additionally, a malicious Visual Studio Code extension containing BeaverTail and OtterCookie code was discovered, suggesting that attackers are exploiting popular developer tools to expand their infection vectors. The malware's expanded functionality includes file uploading and stealing credentials from multiple browsers and cryptocurrency wallet extensions, increasing the scope and impact of the compromise. The attack chain relies heavily on social engineering, targeting job seekers who are likely to trust communications from purported employers. The use of Node.js and VS Code extensions indicates a focus on developer environments, making software engineers and related professionals prime targets. While no known exploits in the wild have been reported yet, the evolving nature of the malware and its delivery methods pose a significant risk. The campaign leverages multiple MITRE ATT&CK techniques such as keylogging (T1056.001), command and scripting interpreter usage (T1059.007, T1059.006), user execution (T1204.001), and credential access (T1555), highlighting its complexity and persistence.

Detailed information about Evolving with a new Javascript module. Get real-time updates, technical details, and mitigation strategies.

Evolving with a new Javascript module - Live Threat Intelligence - Threat Radar | OffSeq.com

Evolving with a new Javascript module

Threats Tagged 'chessfi'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'chessfi'

Lead Pen Test Professional