Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Play ransomware group has been actively targeting businesses and critical infrastructure across North America, South America, and Europe since June 2022. They gain initial access through exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. The group employs a double extortion model, encrypting systems after data exfiltration. Play ransomware uses AES-RSA hybrid encryption and intermittent encryption techniques. The actors use various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement robust security measures including multifactor authentication, regular patching, network segmentation, and maintaining offline backups to mitigate the risk of ransomware attacks.

The Play ransomware group has been actively conducting targeted ransomware attacks against businesses and critical infrastructure across multiple continents, including Europe, since June 2022. Their attack methodology involves gaining initial access through multiple vectors such as exploiting known vulnerabilities (including CVE-2018-13379, CVE-2022-41082, CVE-2020-12812, CVE-2022-41040, and CVE-2024-57727), using stolen credentials, and abusing remote access services. Once inside the network, the group performs extensive reconnaissance using various tools to map the network, steal credentials, and move laterally to maximize their foothold. The ransomware payload employs a hybrid AES-RSA encryption scheme combined with intermittent encryption techniques, which complicates detection and recovery efforts. The group follows a double extortion model, exfiltrating sensitive data prior to encryption to pressure victims into paying ransoms by threatening data leaks. The tactics, techniques, and procedures (TTPs) align with MITRE ATT&CK techniques such as credential dumping (T1003), data staging (T1560.001), credential access (T1552), data exfiltration (T1570), and use of remote services (T1048). Despite the severity of the threat, no known exploits in the wild have been reported for some of the referenced CVEs, but the group’s use of multiple vulnerabilities and stolen credentials increases attack vectors. The threat actor targets critical infrastructure and enterprises, making the attacks highly disruptive. The advisory recommends implementing multifactor authentication, regular patching of vulnerable systems, network segmentation to contain breaches, and maintaining offline backups to ensure recovery without paying ransom. The threat is ongoing and evolving, with a medium severity rating assigned by the source, but the complexity and impact potential warrant close attention.

Detailed information about StopRansomware: Play Ransomware. Get real-time updates, technical details, and mitigation strategies.

StopRansomware: Play Ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

StopRansomware: Play Ransomware

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

CVE-2024-57727 describes multiple path traversal vulnerabilities in SimpleHelp remote support software version 5.5.7 and earlier. These vulnerabilities permit unauthenticated remote attackers to craft HTTP requests that access and download arbitrary files from the server hosting SimpleHelp. The files accessible include sensitive configuration files containing secrets and hashed user credentials, potentially compromising system confidentiality and integrity. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Detailed information about CVE-2024-57727: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-57727: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-57727: n/a


StopRansomware: Play RansomwareCVE-2018-13379 0 The Play ransomware group has been actively targeting businesses and critical infrastructure across North America, South America, and Europe since June 2022. They gain initial access through exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. The group employs a double extortion model, encrypting systems after data exfiltration. Play ransomware uses AES-RSA hybrid encryption and intermittent encryption techniques. The actors use various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement robust security measures including multifactor authentication, regular patching, network segmentation, and maintaining offline backups to mitigate the risk of ransomware attacks. MediumMalwareGermanyFranceItaly+7#cve-2022-41082 #cve-2018-13379 #cve-2020-12812 Join the discussion	AlienVault OTX General	06/05/2025, 13:24:58 UTC Added: 06/05/2025, 13:43:28 UTC
CVE-2024-57727: n/aCVE-2024-57727 0 SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords. CriticalVulnerability#cve #cve-2024-57727 Join the discussion	CVE Database V5	01/15/2025, 00:00:00 UTC Added: 06/06/2025, 18:02:21 UTC

Threats Tagged 'cve-2024-57727'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-57727'

Lead Pen Test Professional