Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.

The RondoDoX botnet campaign, active from March to December 2025, targets IoT devices and web applications by exploiting a critical vulnerability in Next.js, a popular React framework for server-side rendering. This vulnerability, dubbed React2Shell, allows attackers to execute arbitrary code on vulnerable web servers. The campaign unfolds in three phases: initial reconnaissance to identify vulnerable targets, exploitation of Next.js web applications to deploy malicious payloads, and subsequent deployment of IoT botnets. The attackers use multiple command and control (C2) servers to manage infected devices and deploy various malware variants including cryptominers and the React2Shell payload. The botnet leverages compromised IoT devices to amplify its reach and persistence, enabling credential harvesting and multi-architecture malware deployment. The campaign shows a high level of operational sophistication with rapid adaptation to new vulnerabilities and attack trends. Despite the absence of a CVE or official patch, the threat actors exploit publicly known weaknesses in Next.js applications, which are widely used in modern web development. The campaign's use of IoT devices increases the attack surface and complicates mitigation efforts due to the diversity and often poor security posture of IoT ecosystems.

Detailed information about RondoDoX Botnet Weaponizes React2Shell. Get real-time updates, technical details, and mitigation strategies.

RondoDoX Botnet Weaponizes React2Shell - Live Threat Intelligence - Threat Radar | OffSeq.com

RondoDoX Botnet Weaponizes React2Shell

A new malware campaign called EvilAI is spreading globally by disguising itself as legitimate AI-enhanced productivity tools. The malware uses AI-generated code and professional interfaces to evade detection, targeting organizations across sectors like manufacturing, government, and healthcare. It exploits Node.js to execute malicious JavaScript, establishes persistence through scheduled tasks and registry modifications, and communicates with command-and-control servers using encrypted channels. EvilAI enumerates installed software, terminates browser processes, and duplicates credential data. It employs sophisticated obfuscation and anti-analysis techniques to hinder reverse engineering. The malware acts as an initial access vector, potentially deploying additional payloads. This campaign highlights how AI is being weaponized to create increasingly stealthy and adaptive malware threats.

The EvilAI malware campaign represents a sophisticated and emerging threat that leverages AI-generated code and deceptive tactics to infiltrate organizations globally. EvilAI masquerades as legitimate AI-enhanced productivity applications, exploiting the growing trust and adoption of AI tools in professional environments. Technically, the malware exploits Node.js environments to execute malicious JavaScript code, which allows it to operate cross-platform on systems where Node.js is installed. It establishes persistence on infected machines through scheduled tasks and registry modifications, ensuring it remains active across reboots. Communication with its command-and-control (C2) infrastructure is conducted over encrypted channels, complicating detection and analysis of network traffic. EvilAI performs extensive reconnaissance by enumerating installed software, which may help tailor subsequent payloads or identify valuable targets. It actively terminates browser processes, likely to intercept or prevent users from accessing security updates or to facilitate credential theft. Credential duplication is a core capability, enabling attackers to harvest sensitive authentication data for lateral movement or further exploitation. The malware employs advanced obfuscation and anti-analysis techniques, hindering reverse engineering and delaying defensive responses. As an initial access vector, EvilAI can deploy additional malicious payloads, potentially escalating privileges or expanding its foothold within networks. This campaign exemplifies the weaponization of AI to produce stealthier, more adaptive malware that can evade traditional detection mechanisms and target critical sectors such as manufacturing, government, and healthcare.

Detailed information about AI-Generated Code and Fake Apps Used for Far-Reaching Attacks. Get real-time updates, technical details, and mitigation strategies.

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks

A detailed analysis of a malicious PDF editor application called AppSuite PDF Editor reveals it to be a sophisticated backdoor. The software, masquerading as a legitimate productivity tool, is distributed through high-ranking websites. Once installed, it creates scheduled tasks and establishes persistence mechanisms. The backdoor communicates with command and control servers, allowing threat actors to execute arbitrary commands, exfiltrate data, and manipulate browser settings. It specifically targets Chromium-based browsers and other applications like Wave browser, Shift browser, and OneLaunch. The malware employs advanced techniques such as AES encryption, custom obfuscation, and event logging to evade detection. The analysis concludes that AppSuite PDF Editor is definitively malicious and should be classified as a trojan horse with backdoor capabilities.

The AppSuite PDF Editor is a malicious software masquerading as a legitimate PDF editing tool, identified as a trojan horse with backdoor capabilities. Distributed via high-ranking websites to increase its reach and credibility, the malware installs itself on victim systems and establishes persistence through scheduled tasks. It leverages advanced evasion techniques including AES encryption for communication, custom obfuscation to hinder analysis, and event logging to monitor its own activity. Once active, the backdoor connects to command and control (C2) servers, enabling threat actors to execute arbitrary commands remotely. It specifically targets Chromium-based browsers and lesser-known browsers such as Wave, Shift, and OneLaunch, manipulating browser settings to potentially intercept or redirect user traffic. The malware also facilitates data exfiltration, compromising confidentiality by stealing sensitive information. The use of scheduled tasks (MITRE T1053.005) and persistence mechanisms (T1547.001, T1547.009) ensures the malware remains active across reboots. Additional tactics include credential dumping (T1555), file and directory discovery (T1083), and process discovery (T1057), which support lateral movement and deeper system compromise. Despite the sophistication, there are no known exploits in the wild yet, and no CVE identifier has been assigned. The malware’s multi-faceted approach and targeting of productivity tools make it a significant threat vector for organizations relying on PDF editing software and Chromium-based browsers.

Detailed information about Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis. Get real-time updates, technical details, and mitigation strategies

Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis

A malicious campaign utilizing VenomRAT, a Remote Access Trojan, is analyzed. The attackers use a fake Bitdefender download website to spread malware, including VenomRAT, StormKitty, and SilentTrinity. These tools work together to provide initial access, steal credentials, and maintain long-term hidden access. The campaign's infrastructure includes multiple command and control servers and phishing sites impersonating banks and IT services. The analysis reveals the attackers' focus on harvesting financial credentials and crypto wallets while establishing persistent access for potential exploitation or sale. This campaign highlights the growing trend of sophisticated, modular malware built from open-source components, posing a significant threat to everyday internet users.

The VenomRAT malware campaign represents a sophisticated and modular threat leveraging multiple open-source malware components to achieve initial access, credential theft, and persistent remote access. The campaign uses a fake Bitdefender download website as a lure to distribute VenomRAT alongside other malware such as StormKitty and SilentTrinity. VenomRAT is a Remote Access Trojan (RAT) that allows attackers to control infected systems remotely, while StormKitty is known for credential harvesting, and SilentTrinity facilitates stealthy long-term access and lateral movement. The campaign infrastructure includes multiple command and control (C2) servers and phishing sites impersonating banks and IT services, indicating a focus on financial credential theft and crypto wallet compromise. The attackers employ various techniques mapped to MITRE ATT&CK tactics and techniques such as credential dumping (T1003), input capture (T1056.001), process injection (T1055), obfuscation (T1027), and persistence mechanisms (T1547.001), among others. This modular approach allows attackers to maintain stealth and flexibility, making detection and remediation challenging. The campaign highlights the increasing trend of attackers assembling malware from open-source components, lowering the barrier to entry for sophisticated attacks and increasing the threat surface for everyday internet users and organizations alike.

MD5 of e33b8b32bccfb50f604f06a306d1af89ae7b0d583bca20c41fa5811f526aa420

MD5 of 59a08decb8b960b65afe4d5446ef0e00e3a49ab747599b5ee6e7d43813040287

SHA1 of 59a08decb8b960b65afe4d5446ef0e00e3a49ab747599b5ee6e7d43813040287

SHA1 of e33b8b32bccfb50f604f06a306d1af89ae7b0d583bca20c41fa5811f526aa420

MD5 of 4541fd01a19f1e484f24eff86f42ac36ea9b30686fd405ca0a50f3e517657a61

MD5 of 7c3a49906e67a1928113554ff75f684ee54ab74abcf26ac1211d0cd8726cb086

MD5 of 72b7856f3c6851a36642e952b4fb772b9ea0a6a4075c2ed4b59e60cb922f82e3

MD5 of 68f6ff2543066ec8028d9bc101a17a60c47b693bdc0ee4d6167f17d5d4921ab9

MD5 of eb2b61a5f15b19bf7dd0ff3914d3019c26499dd693647b00c1b073037db72e35

MD5 of f0e479cf0dadc7f7d1f999e091b013d236f2c7959591a6b1268ba31b89442ec6

MD5 of ab81ceeb26e22a7c6981a8479cccaa184675ad194b83e447185a1ce42abfbcb0

MD5 of 2d3dc51e6752c4fe95b2b7928ed11b5e06c6a68d19b7d884ab2c8eaab97d4e07

SHA1 of 72b7856f3c6851a36642e952b4fb772b9ea0a6a4075c2ed4b59e60cb922f82e3

SHA1 of ab81ceeb26e22a7c6981a8479cccaa184675ad194b83e447185a1ce42abfbcb0

SHA1 of 7c3a49906e67a1928113554ff75f684ee54ab74abcf26ac1211d0cd8726cb086

SHA1 of eb2b61a5f15b19bf7dd0ff3914d3019c26499dd693647b00c1b073037db72e35

SHA1 of f0e479cf0dadc7f7d1f999e091b013d236f2c7959591a6b1268ba31b89442ec6

SHA1 of 68f6ff2543066ec8028d9bc101a17a60c47b693bdc0ee4d6167f17d5d4921ab9

SHA1 of 2d3dc51e6752c4fe95b2b7928ed11b5e06c6a68d19b7d884ab2c8eaab97d4e07

SHA1 of 4541fd01a19f1e484f24eff86f42ac36ea9b30686fd405ca0a50f3e517657a61

Detailed information about Inside a VenomRAT Malware Campaign. Get real-time updates, technical details, and mitigation strategies.

Inside a VenomRAT Malware Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Inside a VenomRAT Malware Campaign

AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin installation, code execution, and persistence. It installs via scheduled tasks or temporary directory copying, stores plugins in the registry, and communicates with command and control servers over TLS. The Rust variant supports fewer commands compared to its .NET counterpart, suggesting ongoing development. The malware collects system information, including hardware ID, OS details, and antivirus software presence. Debug strings in the samples indicate active development of this Rust version.

AsyncRAT is a remote access trojan (RAT) that has been active since 2019, originally implemented in C#. The recent development involves a significant rewrite of AsyncRAT in the Rust programming language. This transition aims to complicate reverse engineering and malware analysis efforts because Rust currently lacks the mature and widely adopted reverse engineering tools available for C# and .NET binaries. Despite the language shift, the Rust variant retains core functionalities such as plugin installation, arbitrary code execution, and persistence mechanisms. Persistence is achieved by creating scheduled tasks or copying itself into temporary directories. Plugins are stored in the Windows registry, allowing modular expansion of capabilities. Communication with command and control (C2) servers is conducted over TLS-encrypted channels, enhancing stealth and evasion of network detection mechanisms. The Rust variant currently supports fewer commands than its predecessor, indicating it is under active development and may expand capabilities over time. The malware collects detailed system information, including hardware identifiers, operating system details, and the presence of antivirus software, which can be used for environment reconnaissance and tailoring attacks. Debug strings found in samples confirm ongoing development efforts. Indicators of compromise (IOCs) include specific file hashes and domains used for C2 communication, such as backup-tlscom.sytes.net, magic-telecom.ddns.net, and mohsar.ddns.net. No known exploits leveraging this Rust variant are reported in the wild yet, and the threat is assessed at a medium severity level due to its evolving nature and potential for stealthy persistence and control.

Detailed information about Reborn in Rust: Attempt to thwart malware analysis. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'command and control'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'command and control'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility