Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Chinese cyberespionage group APT41 conducted a targeted attack against government IT services in Africa. The attackers used various tools including Impacket, Cobalt Strike, and custom malware for lateral movement, privilege escalation, and data exfiltration. They leveraged DLL sideloading techniques and a compromised SharePoint server as a command and control center. The attack involved credential harvesting, use of web shells, and custom stealers to collect sensitive data. Notable TTPs included using hardcoded internal service names and proxy servers in malware, and exploiting a captive SharePoint server for C2 communication. The incident highlights the importance of comprehensive infrastructure monitoring and proper access controls.

The reported threat involves a targeted cyberespionage campaign conducted by the Chinese threat actor group APT41 against government IT services in Africa. APT41 is known for sophisticated, multi-stage attacks combining publicly available tools and custom malware to achieve persistence, lateral movement, privilege escalation, and data exfiltration. In this campaign, the attackers leveraged a combination of Impacket (a Python toolkit for network protocol manipulation), Cobalt Strike (a commercial penetration testing tool often abused by threat actors), and custom-developed malware components. A key technique used was DLL sideloading, which involves placing a malicious DLL alongside a legitimate executable to bypass security controls and evade detection. The attackers also compromised a SharePoint server, repurposing it as a command and control (C2) infrastructure, enabling covert communication and control of infected hosts. The campaign included credential harvesting using tools like Mimikatz, deployment of web shells for persistent remote access, and custom stealers designed to exfiltrate sensitive data. Notably, the malware contained hardcoded internal service names and proxy server configurations, indicating a high level of reconnaissance and customization tailored to the victim environment. The use of a captive SharePoint server for C2 communication is a sophisticated tactic that blends malicious traffic with legitimate enterprise services, complicating detection efforts. This attack underscores the importance of comprehensive monitoring of infrastructure components, especially collaboration platforms like SharePoint, strict access control policies, and robust credential management to mitigate risks from advanced persistent threats.

Detailed information about SOC files: an APT41 attack on government IT services in Africa. Get real-time updates, technical details, and mitigation strategies.

SOC files: an APT41 attack on government IT services in Africa - Live Threat Intelligence - Threat Radar | OffSeq.com

SOC files: an APT41 attack on government IT services in Africa

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VELETRIX uses anti-analysis techniques, IPFuscation, and a callback mechanism to execute VShell. The campaign shows overlaps with UNC5174 (Uteus) and Earth Lamia, known China-nexus threat actors. The infrastructure utilizes tools like SuperShell, Cobalt Strike, and Asset Lighthouse System. Active since March 2025, this operation demonstrates advanced tactics, techniques, and procedures associated with Chinese state-sponsored threat groups.

Operation DRAGONCLONE is a sophisticated cyber espionage campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile. The campaign employs a novel loader named VELETRIX alongside VShell, a known adversary simulation tool, to establish and maintain persistence within the victim environment. The infection vector begins with a malicious ZIP archive containing executable and DLL files, leveraging DLL sideloading techniques to evade detection and execute payloads. VELETRIX incorporates advanced anti-analysis methods and IPFuscation to obscure network communications, complicating detection and attribution efforts. The loader uses a callback mechanism to execute VShell, facilitating further post-exploitation activities. The campaign infrastructure includes tools such as SuperShell, Cobalt Strike, and the Asset Lighthouse System, indicating a high level of operational sophistication and resource availability. Attribution links this operation to China-nexus threat actors, specifically UNC5174 (Uteus) and Earth Lamia, groups known for targeting telecommunications and critical infrastructure sectors. The campaign has been active since March 2025, demonstrating ongoing efforts to compromise strategic telecom assets. The attack chain aligns with multiple MITRE ATT&CK techniques including user execution (T1204.002), DLL sideloading (T1574.001), credential dumping (T1003), and network reconnaissance (T1046), among others. Despite the presence of CVE-2024-1709 and CVE-2025-31324 references, no known exploits in the wild have been reported, suggesting the campaign relies on custom tooling and targeted delivery rather than widespread exploitation. Overall, Operation DRAGONCLONE exemplifies a targeted, state-sponsored espionage effort leveraging advanced malware and evasion techniques to infiltrate and persist within a major Chinese telecom entity.

Detailed information about Operation DRAGONCLONE: Chinese Telecom Targeted by Malware. Get real-time updates, technical details, and mitigation strategies.

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and BypassBoss for privilege escalation. Earth Lamia's targets have shifted over time, initially focusing on financial services, then logistics and online retail, and recently IT companies, universities, and government organizations. The group employs various techniques including DLL sideloading, use of legitimate binaries, and development of modular backdoors. Earth Lamia's activities have been linked to other reported campaigns, suggesting a complex and evolving threat landscape.

Earth Lamia is an advanced persistent threat (APT) actor active since 2023, primarily targeting organizations across Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, with a notable emphasis on SQL injection attacks, to gain initial access to targeted systems. Their arsenal includes custom-developed malware such as the PULSEPACK backdoor and BypassBoss, which facilitate persistent access and privilege escalation respectively. Earth Lamia employs sophisticated techniques including DLL sideloading, leveraging legitimate binaries to evade detection, and modular backdoor architectures that allow flexible and adaptive operations. Their targeting has evolved over time, initially focusing on financial services, then expanding to logistics and online retail sectors, and more recently shifting towards IT companies, universities, and government organizations. The group’s tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job), T1592 (Gather Victim Host Information), T1587.001 (Develop Capabilities), T1140 (Deobfuscate/Decode Files or Information), and T1190 (Exploit Public-Facing Application), among others. Despite the lack of confirmed exploits in the wild for some referenced CVEs, the presence of multiple CVEs (including CVE-2017-9805 and several 2024-2025 vulnerabilities) suggests a broad exploitation scope. The group’s linkage to other campaigns and use of tools like Cobalt Strike and Brute Ratel further indicate a complex and evolving threat landscape with significant operational capabilities. The threat actor’s Chinese nexus and multi-industry targeting underscore a strategic intent to infiltrate diverse sectors for espionage or disruption purposes.

Detailed information about Custom Arsenal Developed to Target Multiple Industries. Get real-time updates, technical details, and mitigation strategies.

Custom Arsenal Developed to Target Multiple Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

Custom Arsenal Developed to Target Multiple Industries

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management systems. The threat actors deploy various web shells, including AntSword and Chopper, and use custom Rust-based loaders called TetraLoader to deliver Cobalt Strike beacons and VSHell malware. The attackers conduct reconnaissance, enumerate directories, and stage files for exfiltration. Their tooling and tactics indicate a high level of proficiency in the Chinese language, suggesting a Chinese origin for the threat group.

The threat involves a remote code execution (RCE) zero-day vulnerability identified as CVE-2025-0994 in Cityworks, a widely used asset management system primarily deployed by local government entities for utilities and infrastructure management. Since January 2025, a Chinese-speaking threat actor group known as UAT-6382 has been actively exploiting this vulnerability. The exploitation chain begins with the attackers leveraging the RCE flaw to gain unauthorized access to Cityworks servers. Once inside, they deploy multiple web shells, including AntSword and China Chopper variants, to maintain persistent access and facilitate further operations. The attackers utilize a custom Rust-based loader named TetraLoader to deliver advanced payloads such as Cobalt Strike beacons and VSHell malware, which are commonly used for command and control, lateral movement, and data exfiltration. Their activities include reconnaissance of the compromised environment, directory enumeration, and staging of files for exfiltration, indicating a focus on intelligence gathering and potential disruption or espionage. The tooling and operational tactics demonstrate a high level of sophistication and fluency in Chinese, strongly suggesting the threat actor’s origin. Despite the absence of publicly available patches or CVSS scoring, the exploitation of a zero-day in critical infrastructure management software combined with advanced malware deployment underscores a significant threat to targeted organizations.

Detailed information about Exploits Cityworks zero-day vulnerability to deliver malware. Get real-time updates, technical details, and mitigation strategies.

Exploits Cityworks zero-day vulnerability to deliver malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Exploits Cityworks zero-day vulnerability to deliver malware

This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It highlights the risks associated with sharing ML models, particularly through platforms like Hugging Face, and the potential for malicious actors to exploit serialization formats like pickle files. The report outlines various techniques for detecting and analyzing suspicious models, including static scanning, disassembly, memory forensics, and sandboxing. It also presents case studies of actual incidents involving malicious models, demonstrating the urgency of developing specialized incident response capabilities for AI-related threats.

This threat concerns the emerging risk of malicious machine learning (ML) model artifacts being used as vectors for cyberattacks. Attackers exploit the growing practice of sharing ML models on public or semi-public platforms such as Hugging Face by embedding malicious code within the models. A key technique involves abusing serialization formats like Python's pickle files, which allow arbitrary code execution during deserialization. This enables adversaries to conceal malware payloads inside seemingly benign ML artifacts, evading traditional detection mechanisms. The attack anatomy typically involves embedding payloads such as TrickBot, Cobalt Strike, or Metasploit frameworks within the ML model files. Detection is challenging due to the complexity and novelty of ML model formats but can be approached through static scanning for suspicious patterns, disassembly of embedded code, memory forensics to analyze runtime behavior, and sandboxing to observe execution in isolated environments. Real-world incidents have demonstrated that malicious ML models can serve as delivery mechanisms for advanced persistent threats (APTs) and post-exploitation tools. This evolving threat landscape necessitates specialized incident response capabilities tailored to AI-related threats, including enhanced forensic tools and updated security policies around ML artifact sharing and usage. Although no widespread exploits are currently observed in the wild, the medium severity rating reflects the significant potential risk as ML adoption grows in enterprise environments.

Detailed information about Modern Incident Response: Tackling Malicious ML Artifacts. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'cobalt strike - s0154'

Filter Threats

Threats Tagged 'cobalt strike - s0154'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility