Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ESET researchers have identified a new threat actor, GhostRedirector, targeting Windows servers with custom tools. The group has compromised at least 65 servers, mainly in Brazil, Thailand, and Vietnam, across various sectors. Their arsenal includes Rungan, a passive C++ backdoor, and Gamshen, a malicious IIS module for SEO fraud. GhostRedirector also uses public exploits for privilege escalation and creates rogue user accounts to maintain access. The attacks aim to manipulate Google search results, promoting gambling websites through shady SEO techniques. Evidence suggests GhostRedirector is a China-aligned actor, active since at least August 2024. The campaign demonstrates sophisticated tactics for server compromise and long-term access maintenance.

GhostRedirector is a newly identified threat actor revealed by ESET researchers, focusing on compromising Windows servers using a combination of custom malware and publicly known exploits. The group’s arsenal includes Rungan, a passive backdoor written in C++, which likely provides stealthy command and control capabilities, and Gamshen, a malicious IIS module designed to manipulate search engine results to promote gambling websites through SEO fraud. The attackers exploit privilege escalation vulnerabilities to gain higher system privileges and create rogue user accounts to maintain persistent access. The campaign has compromised at least 65 servers primarily in Brazil, Thailand, and Vietnam, targeting diverse sectors. The use of a malicious IIS module indicates a focus on web servers running Microsoft’s Internet Information Services, enabling direct manipulation of web traffic and content to influence search engine rankings. The threat actor is believed to be China-aligned and has been active since at least August 2024. Despite no known public exploits currently in the wild specifically for this campaign, the use of public exploits for privilege escalation suggests the attackers leverage existing vulnerabilities to gain initial or escalated access. The campaign’s goal appears to be financial gain through SEO fraud by redirecting or poisoning Google search results to favor gambling websites, which can generate illicit revenue. The sophistication of the tools and persistence mechanisms indicates a well-resourced and patient adversary capable of long-term operations.

Detailed information about GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes. Get real-time updates, technical details, and mitigation 

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes - Live Threat Intelligence - Threat Radar | OffSeq.com

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

Threats Tagged 'comdai'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'comdai'

Lead Pen Test Professional