Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Exploit-DB RSS Feed

The Hacker News

ThreatFox MISP Feed

CIRCL OSINT Feed

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Silver Fox APT group is conducting a sophisticated phishing campaign targeting Indian entities using tax-themed lures. The attack employs a multi-stage infection chain beginning with malicious emails containing PDF decoys, followed by an NSIS installer that drops a legitimate Thunder. exe and a malicious libexpat. dll to exploit DLL hijacking. The final payload is the modular Valley RAT, which uses a complex configuration loading and a three-tier command and control communication loop to maintain persistence and extend capabilities dynamically. Although primarily targeting India, the advanced techniques and modular architecture pose risks to organizations globally. The campaign leverages social engineering, DLL hijacking, and registry-based persistence, making detection and mitigation challenging. No known exploits are currently in the wild, and the threat is rated medium severity. European organizations should be aware due to potential targeting expansion or collateral impact through shared infrastructure or partners.

This threat involves a targeted campaign by the Chinese APT group Silver Fox focusing on Indian organizations through tax-themed phishing emails. The attack chain starts with a malicious email containing a PDF decoy designed to lure victims into executing an NSIS installer. This installer drops two key files: a legitimate Thunder.exe binary and a malicious libexpat.dll, which exploits DLL hijacking (technique T1574.001) to load the malicious DLL instead of the legitimate one. This hijacking enables the attacker to execute arbitrary code stealthily. The final payload is the Valley RAT, a modular remote access trojan that supports dynamic plugin loading, allowing the attacker to extend functionality as needed. Valley RAT uses a two-stage configuration loading mechanism and a sophisticated three-tier command and control (C2) communication loop to evade detection and maintain persistence. Persistence is further ensured through registry-based storage of configuration and modules. The campaign employs multiple MITRE ATT&CK techniques including phishing (T1566.001), DLL hijacking (T1574.001), execution through NSIS installers (T1218), and obfuscation (T1027). While the campaign currently targets Indian entities, the modular and stealthy nature of the malware could enable expansion or collateral compromise. Indicators of compromise include multiple file hashes, IP addresses, and domains associated with the C2 infrastructure. No CVE or known public exploits are reported, and the campaign is rated medium severity due to its complexity and targeted nature.

Detailed information about Silver Fox Targeting India Using Tax Themed Phishing Lures. Get real-time updates, technical details, and mitigation strategies.

Silver Fox Targeting India Using Tax Themed Phishing Lures - Live Threat Intelligence - Threat Radar | OffSeq.com

Silver Fox Targeting India Using Tax Themed Phishing Lures

The UAT-9686 advanced persistent threat (APT) group, linked to Chinese actors, is actively targeting Cisco Secure Email Gateway and Secure Email and Web Manager running AsyncOS software. Since late November 2025, the attackers exploit non-standard configurations to execute system-level commands and deploy a persistent Python-based backdoor named AquaShell. They also use tools like AquaTunnel for reverse SSH tunneling, chisel for TCP/UDP tunneling, and AquaPurge for log clearing, enabling stealthy command execution and persistent access. This campaign threatens email security infrastructure by allowing attackers to create reverse connections to their servers and evade detection through log purging. The attack techniques align with known Chinese APT tactics, raising concerns about potential widespread impact on organizations relying on Cisco email security products. No CVE or patches are currently available, and exploitation does not require user interaction but depends on misconfigurations. The threat is assessed as medium severity but could escalate if left unmitigated.

UAT-9686 is a sophisticated Chinese-nexus APT group conducting an ongoing campaign targeting Cisco Secure Email Gateway and Secure Email and Web Manager devices running AsyncOS software. The attackers leverage non-standard or misconfigured deployments to execute arbitrary system-level commands, bypassing normal security controls. Central to their operation is the deployment of AquaShell, a Python-based backdoor that maintains persistence on compromised devices. AquaShell allows execution of encoded shell commands and facilitates communication with attacker-controlled infrastructure. Complementary tools include AquaTunnel, which establishes reverse SSH tunnels to enable remote access; chisel, a tool for TCP/UDP tunneling to bypass network restrictions; and AquaPurge, which clears logs to cover attacker activity and maintain stealth. The campaign uses techniques mapped to MITRE ATT&CK tactics such as T1190 (exploitation of remote services), T1133 (external remote services), T1562.002 (impair defenses: disabling or evading logs), T1572 (protocol tunneling), T1505.003 (server software component: web shell), T1090.002 (proxy: SSH proxy), T1059.006 (command and scripting interpreter: Python), and T1071.001 (application layer protocol: Web protocols). No specific vulnerable versions or CVEs have been disclosed, and no known exploits in the wild have been confirmed yet. The campaign's reliance on misconfigurations rather than zero-day vulnerabilities suggests that proper configuration and monitoring are critical defenses. The threat actor’s use of advanced tunneling and log clearing tools indicates a high level of operational security and intent to maintain long-term access to targeted email security infrastructure.

Detailed information about UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager. Get real-time updates, technical details, and 

UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager - Live Threat Intelligence - Threat Radar | OffSeq.com

UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager

Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.

The Ink Dragon threat actor has launched a new wave of cyber espionage attacks primarily targeting government entities across Europe, Southeast Asia, and South America. The group leverages misconfigurations in Microsoft Internet Information Services (IIS) to gain initial footholds within victim networks. Once inside, Ink Dragon deploys a custom ShadowPad IIS Listener module, which transforms compromised IIS servers into active nodes within a victim-based relay network. This relay network forms a distributed mesh that facilitates stealthy command and control (C2) communications, making detection and attribution more challenging. The actor has also introduced a new variant of the FinalDraft malware, enhancing their toolset for persistence and data exfiltration. Their operational methodology combines advanced software engineering with disciplined operational playbooks, utilizing platform-native tools and living-off-the-land techniques to evade detection by blending malicious activity into normal enterprise telemetry. The campaign’s stealth and sophistication indicate a well-resourced and patient adversary focused on long-term intelligence gathering. Although no public exploits are currently known, the exploitation of IIS misconfigurations remains a critical vector. The presence of numerous file hashes associated with the malware and tools provides indicators of compromise (IOCs) for detection. Overall, Ink Dragon’s approach exemplifies modern advanced persistent threat (APT) tactics, emphasizing stealth, resilience, and operational security.

Detailed information about Ink Dragon's Relay Network and Stealthy Offensive Operation. Get real-time updates, technical details, and mitigation strategies.

Ink Dragon's Relay Network and Stealthy Offensive Operation - Live Threat Intelligence - Threat Radar | OffSeq.com

Ink Dragon's Relay Network and Stealthy Offensive Operation

WEBJACK is a malware campaign targeting Microsoft IIS servers by deploying BadIIS malware modules to conduct SEO poisoning and fraud. The attackers hijack high-profile websites, including government and educational institutions, redirecting users to gambling sites. The campaign selectively serves malicious content to search engine crawlers while redirecting or blocking normal visitors, leveraging legitimate IIS modules for stealth. Originating from a Chinese-speaking threat actor, it primarily affects Southeast Asia and Latin America, with a focus on Vietnamese-language targets. Although no known exploits are publicly reported, the campaign uses advanced tools such as Cobalt Strike and XLANY Loader. The threat demonstrates evolving IIS hijacking techniques and abuse of legitimate security tools for monetization. European organizations could be at risk if targeted due to the use of IIS servers and the potential for reputational damage and fraud. Mitigation requires specific IIS module monitoring, integrity checks, and enhanced web server security. Countries with significant IIS usage and strategic government or educational targets, such as Germany, France, and the UK, are more likely to be affected. The threat severity is assessed as medium given the targeted nature, impact on availability and integrity, and moderate ease of exploitation without user interaction.

The WEBJACK campaign represents an advanced malware operation targeting Microsoft Internet Information Services (IIS) servers by deploying malicious modules known as BadIIS. These modules enable attackers to perform SEO poisoning by selectively serving malicious content to search engine crawlers, thereby manipulating search engine results to promote fraudulent gambling websites. The campaign hijacks high-profile targets, including government and educational institutions, which increases the credibility and reach of the malicious redirections. The attackers employ a variety of tools from the Chinese cybercriminal ecosystem, including XLANY Loader and Cobalt Strike, indicating a sophisticated and well-resourced threat actor. The malicious IIS modules operate stealthily by serving legitimate content to normal visitors or blocking them, while feeding manipulated content to search engines to maximize SEO impact. This selective content delivery complicates detection and mitigation efforts. The campaign spans multiple countries, primarily in Southeast Asia and Latin America, with a notable focus on Vietnamese-language content, suggesting targeted regional and linguistic preferences. The operation also abuses legitimate IIS security and management tools, demonstrating an evolution in IIS hijacking tactics. Despite the absence of publicly known exploits, the campaign leverages techniques such as credential dumping (T1003), exploitation of public-facing applications (T1190), process injection (T1055), and persistence mechanisms (T1505, T1574), highlighting a multi-faceted attack chain. The campaign's monetization strategy revolves around fraud via gambling site redirections, impacting both the integrity of affected websites and the availability of legitimate content to users.

Detailed information about WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization. Get real-time updates, technical details, and mitigat

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization - Live Threat Intelligence - Threat Radar | OffSeq.com

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A Chinese-speaking threat actor conducted a large-scale SEO poisoning campaign dubbed 'Operation Rewrite' using BadIIS malware to manipulate search results. The attackers compromised legitimate websites and used malicious IIS modules to intercept web traffic and serve altered content. The campaign targeted East and Southeast Asia, particularly Vietnam. Multiple variants of BadIIS were discovered, including ASP.NET handlers and PHP scripts. The threat actor is linked to previously known groups like Group 9 and possibly DragonRank. Their toolkit allowed them to inject malicious content, redirect users, and exploit compromised servers for various malicious purposes.

Operation Rewrite is a large-scale SEO poisoning campaign attributed to a Chinese-speaking threat actor group linked to previously known entities such as Group 9 and possibly DragonRank. The attackers leveraged BadIIS malware, which consists of malicious IIS modules, ASP.NET handlers, and PHP scripts, to compromise legitimate websites primarily in East and Southeast Asia, with a particular focus on Vietnam. By implanting these malicious modules into web servers running Microsoft IIS, the threat actors intercepted and manipulated web traffic to alter search engine results and redirect users to malicious or fraudulent content. This manipulation of search engine results (SEO poisoning) enables the attackers to increase the visibility of malicious sites or content, potentially leading to further exploitation such as malware distribution, credential theft, or other malicious activities. The campaign's toolkit allows injection of malicious content directly into web pages served by compromised servers, enabling stealthy and persistent manipulation without requiring user interaction beyond visiting affected sites. The use of web shells and various exploitation techniques (referenced by MITRE ATT&CK IDs T1133, T1190, T1112, T1505.003, T1078) indicates a sophisticated approach involving initial access, persistence, and credential access to maintain control over compromised infrastructure. Although no known exploits are currently reported in the wild for this specific malware, the campaign's scale and complexity demonstrate a significant threat to web infrastructure relying on IIS servers, especially those with weak patching or security controls.

Detailed information about Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign. Get real-time updates, techni

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'chinese threat actor'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'chinese threat actor'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility