Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Blitz is a new Windows-based malware discovered in 2024 consisting of a downloader and bot payload. The latest version was spread through backdoored game cheats for Standoff 2 distributed via Telegram. Blitz abuses Hugging Face Spaces to host components of its C2 infrastructure and payloads. The malware performs information stealing and DDoS attacks. An XMRig cryptocurrency miner was also deployed as follow-up malware. By May 2025, the developer claimed to have abandoned the project. Russia accounted for the highest number of infections among 289 victims across 26 countries. Palo Alto Networks customers are protected through various security products and services.

Blitz is a Windows-based malware campaign identified in 2024, characterized by a modular architecture consisting primarily of a downloader and a bot payload. The malware's distribution vector is notably through backdoored game cheats for the popular mobile game Standoff 2, which were disseminated via Telegram channels. This method leverages the gaming community's trust and eagerness for cheats to propagate the malware. A distinctive feature of Blitz is its abuse of Hugging Face Spaces, a legitimate AI model hosting platform, to host components of its command and control (C2) infrastructure and payloads. This tactic complicates detection and takedown efforts because it blends malicious activity with legitimate cloud services.

Once deployed, Blitz performs multiple malicious activities: it steals sensitive information from infected systems and conducts distributed denial-of-service (DDoS) attacks, potentially disrupting network availability for targeted entities. Additionally, the malware deploys an XMRig cryptocurrency miner as a secondary payload, which hijacks system resources to mine Monero cryptocurrency, leading to degraded system performance and increased operational costs. By May 2025, the malware developer reportedly abandoned the project, but the infection footprint remains significant, with 289 victims identified across 26 countries. Russia has the highest infection count, indicating either targeting preferences or greater exposure.

The malware employs a wide range of tactics and techniques as mapped to MITRE ATT&CK, including credential dumping (T1003.001), input capture (T1056.001), command and control over web protocols (T1071), process injection (T1055), and persistence mechanisms (T1547.001), among others. These techniques enable stealthy operation, lateral movement, and sustained presence within compromised environments. Palo Alto Networks customers benefit from protection via their security products, but organizations outside this ecosystem may remain vulnerable.

Overall, Blitz represents a multifaceted threat combining social engineering (via game cheats), abuse of legitimate cloud infrastructure, and a blend of espionage and resource hijacking activities.

Detailed information about Blitz Malware: A Tale of Game Cheats and Code Repositories. Get real-time updates, technical details, and mitigation strategies.

Blitz Malware: A Tale of Game Cheats and Code Repositories - Live Threat Intelligence - Threat Radar | OffSeq.com

Blitz Malware: A Tale of Game Cheats and Code Repositories

A series of attacks targeting Korean Internet cafés have been identified, focusing on systems with specific management software installed. The threat actor, active since 2022, uses Gh0st RAT for system control and ultimately installs T-Rex CoinMiner for cryptocurrency mining. The initial access method remains unknown. The attacks involve memory patching of management software and use of downloaders. The malware suite includes Gh0st RAT, its droppers, patchers, downloaders, and T-Rex CoinMiner. Unlike typical coin mining operations using XMRig for Monero, this actor employs T-Rex, likely due to the presence of high-performance GPUs in Internet café PCs. The attacks have been ongoing since late 2024, prompting responses from management software manufacturers.

The T-Rex CoinMiner campaign targets Internet cafés in Korea by compromising systems running specific management software. Active since late 2024, the threat actor employs a multi-stage malware suite beginning with Gh0st RAT, a remote access trojan used for persistent system control. The initial infection vector remains unknown, but the attack involves memory patching of the management software and the use of downloaders to deploy additional payloads. Unlike common cryptocurrency mining malware that typically uses XMRig for Monero mining, this actor uses T-Rex CoinMiner, optimized for GPUs, reflecting the high-performance graphics hardware found in Internet café PCs. The malware suite includes Gh0st RAT, its droppers, patchers, downloaders, and the T-Rex miner itself. This approach allows the attacker to covertly mine cryptocurrency while maintaining control over compromised systems. The campaign’s focus on Internet cafés suggests targeting environments with multiple high-end GPUs, maximizing mining efficiency. Management software vendors have responded to the threat, but no patches or mitigations have been publicly detailed. The campaign does not currently have known exploits in the wild beyond the described activity, and the initial infection vector remains unclear, complicating detection and prevention efforts.

Detailed information about Analysis of T-Rex CoinMiner Attacks Targeting Internet Cafés in Korea. Get real-time updates, technical details, and mitigation strat

Analysis of T-Rex CoinMiner Attacks Targeting Internet Cafés in Korea - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of T-Rex CoinMiner Attacks Targeting Internet Cafés in Korea

A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' component is a modified DeroHE CLI miner with hardcoded wallet and node addresses. This campaign demonstrates the potential risks of insecurely published Docker APIs and the need for robust container security measures.

This threat involves a cryptocurrency mining malware campaign targeting containerized Linux environments by exploiting exposed Docker APIs, specifically those accessible without proper authentication or encryption (commonly on TCP port 2375). The campaign uses two Golang-based malware components named 'nginx' and 'cloud'. The 'nginx' component acts as a propagation mechanism by scanning networks for Docker hosts with exposed APIs. Once a vulnerable host is found, it creates malicious containers or compromises existing ones to establish persistence and spread laterally within the container ecosystem. Notably, this malware operates autonomously without relying on a command-and-control (C2) server, which complicates detection and takedown efforts. The 'cloud' component is a modified version of the DeroHE CLI miner, a cryptocurrency miner for the Dero blockchain, with hardcoded wallet and node addresses to ensure mined coins are sent to the attacker. The use of Golang facilitates cross-platform deployment and ease of execution within containerized environments. This campaign highlights the critical security risks posed by misconfigured or insecure Docker APIs, which are often left exposed due to lack of awareness or misconfiguration. The malware’s ability to autonomously propagate and maintain persistence within containerized Linux environments underscores the importance of securing container orchestration platforms and Docker daemon access. Indicators of compromise include specific file hashes and suspicious domains related to the malware’s operation. Although no widespread exploits beyond this campaign have been reported, the medium severity rating reflects the potential for resource abuse, operational disruption, and lateral movement within containerized infrastructures. This threat is particularly relevant given the increasing adoption of container technologies and cloud-native deployments in modern IT environments.

Detailed information about Dero miner spreads inside containerized Linux environments. Get real-time updates, technical details, and mitigation strategies.

Dero miner spreads inside containerized Linux environments - Live Threat Intelligence - Threat Radar | OffSeq.com

Dero miner spreads inside containerized Linux environments

A new Dero mining campaign exploits insecurely published Docker APIs to spread through containerized Linux environments. The attack uses two Golang malware implants: 'nginx' for propagation and 'cloud' for cryptocurrency mining. The 'nginx' malware scans for vulnerable Docker APIs, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' miner is based on the open-source DeroHE CLI project, with hardcoded wallet and node addresses. This campaign differs from previous attacks on Kubernetes clusters by actively spreading and compromising more networks. The threat highlights the importance of securing containerized infrastructures and monitoring for malicious activities.

This threat describes a cryptojacking campaign leveraging insecurely exposed Docker APIs to propagate a Dero cryptocurrency mining operation within containerized Linux environments. The attack utilizes two distinct Golang-based malware implants: 'nginx' and 'cloud'. The 'nginx' implant is responsible for propagation and persistence. It actively scans for Docker APIs that are published without adequate authentication or network restrictions, enabling it to create malicious containers and compromise existing ones. This implant maintains persistence autonomously and spreads laterally without relying on a centralized command-and-control (C2) infrastructure, complicating detection and takedown efforts. The 'cloud' miner implant is derived from the open-source DeroHE CLI project, modified with hardcoded wallet and node addresses to funnel mined cryptocurrency to the attacker. Unlike previous cryptojacking campaigns targeting Kubernetes clusters, this campaign aggressively spreads through Docker APIs, increasing its infection footprint and impact. Indicators of compromise include several malware hashes and suspicious domains such as d.windowsupdatesupport.link and h.windowsupdatesupport.link, which may be used for persistence or additional payload delivery. The campaign highlights a critical security gap in containerized infrastructure management, particularly the exposure of Docker APIs to untrusted networks or users. The medium severity rating reflects its potential for resource abuse and lateral movement but lacks evidence of destructive payloads or data exfiltration. Overall, this threat underscores the necessity for robust Docker API security, container monitoring, and network segmentation in Linux container environments to prevent unauthorized container creation and cryptojacking activities.

Detailed information about Dero miner zombies biting through Docker APIs to build a cryptojacking horde. Get real-time updates, technical details, and mitigatio

Title	Severity	Type	Source	Date

Threats Tagged 'cryptocurrency mining'

Filter Threats

Threats Tagged 'cryptocurrency mining'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility