Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines a phishing campaign targeting Italian and US users, focusing on credential harvesting for Microsoft services and Italy's PEC system. The attackers use Notion workspaces and other cloud platforms to host phishing pages, exfiltrating stolen data via Telegram bots. The campaign, active since 2022, employs simple techniques and off-the-shelf tools, suggesting either low technical expertise or a focus on access brokering. The study demonstrates how intercepting Telegram bot communications can aid in profiling threat actors and provides insights into the campaign's evolution, victimology, and attacker characteristics.

This security threat involves a phishing campaign active since 2022, targeting primarily Italian and US users, with a focus on harvesting credentials for Microsoft services and Italy's PEC (Posta Elettronica Certificata) system. The attackers leverage cloud platforms such as Notion workspaces to host phishing pages, which are designed to mimic legitimate login portals to deceive victims into submitting their credentials. Once credentials are entered, the stolen data is exfiltrated using Telegram bots, which serve as command and control (C2) infrastructure and data relay points. The use of Telegram bots for exfiltration is notable because it allows attackers to bypass traditional network monitoring and detection mechanisms by blending malicious traffic with legitimate Telegram API communications. The campaign employs relatively simple and off-the-shelf tools, indicating either a low level of technical sophistication or a strategic focus on brokering access rather than developing complex malware. The analysis also highlights that intercepting communications between the attackers and their Telegram bots can provide valuable intelligence for profiling the threat actors, understanding their victimology, and tracking the campaign's evolution. The campaign uses a range of tactics and techniques mapped to MITRE ATT&CK IDs such as T1566 (Phishing), T1071 (Application Layer Protocol), T1059 (Command and Scripting Interpreter), T1102 (Web Service), T1041 (Exfiltration Over C2 Channel), T1573 (Encrypted Channel), T1056 (Input Capture), T1132 (Data Encoding), T1189 (Drive-by Compromise), and T1008 (Fallback Channels), illustrating a multi-faceted approach to compromise, data capture, and exfiltration. The threat does not exploit software vulnerabilities directly but relies on social engineering and cloud-based infrastructure abuse, making it highly dependent on user interaction and phishing effectiveness.

Detailed information about How Adversary Telegram Bots Help to Reveal Threats: Case Study. Get real-time updates, technical details, and mitigation strategies.

How Adversary Telegram Bots Help to Reveal Threats: Case Study - Live Threat Intelligence - Threat Radar | OffSeq.com

How Adversary Telegram Bots Help to Reveal Threats: Case Study

Threats Tagged 'cloud platforms'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cloud platforms'

Lead Pen Test Professional