Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.

UNC5142 is a financially motivated cyber threat group tracked since late 2023 that innovatively combines traditional web exploitation with blockchain technology to distribute infostealer malware. The group targets vulnerable WordPress websites, exploiting common web application weaknesses to inject malicious JavaScript code. Their infection chain begins with a multistage JavaScript downloader called CLEARSHORT, which is designed to fetch and execute payloads dynamically. A key innovation is their use of the 'EtherHiding' technique on the BNB Smart Chain, a blockchain platform, where malicious code is embedded within smart contracts to evade traditional detection mechanisms. UNC5142 employs a sophisticated three-level smart contract system that allows dynamic and flexible payload delivery, making it harder for defenders to predict or block the malware distribution. They also abuse legitimate cloud services, notably Cloudflare Pages, to host or proxy malicious content, further complicating detection and takedown efforts. The malware payloads distributed include several well-known infostealers such as ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF, which are capable of stealing sensitive information like credentials, cookies, and system data. The group’s operations have compromised approximately 14,000 web pages globally by mid-2025, affecting multiple industries including finance, e-commerce, and technology. The use of blockchain smart contracts for malware delivery represents an evolution in threat actor tactics, blending decentralized technologies with traditional cybercrime methods. This approach allows UNC5142 to maintain persistence, evade signature-based detection, and dynamically update payloads. The threat actor’s abuse of WordPress—a widely used content management system—combined with blockchain and cloud service exploitation, poses a multifaceted challenge for defenders.

Detailed information about New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware. Get real-time updates, technical details, and mitigation

New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware

Threats Tagged 'clearshort'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'clearshort'

Lead Pen Test Professional