Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

DarkComet RAT malware has resurfaced disguised as a fake Bitcoin-related tool, distributed via a RAR archive containing a UPX-packed executable. Upon execution, it installs itself as 'explorer.exe' in the user's AppData folder and establishes persistence through a registry run key. The malware communicates with its command and control server at kvejo991.ddns.net on port 1604. It performs keylogging, storing captured keystrokes in a dedicated folder, and uses process injection into notepad.exe to evade detection. The malware also spawns multiple cmd.exe and conhost.

The DarkComet Remote Access Trojan (RAT), an older but still effective malware strain, has reemerged in a new campaign disguised as a fake Bitcoin-related application. The malware is distributed as a RAR archive containing a UPX-packed executable file, a packing method used to evade signature-based detection by antivirus solutions. Once the executable is unpacked and run, it installs itself under the name 'explorer.exe' within the user's AppData directory, a common tactic to blend with legitimate Windows processes. To maintain persistence, it creates a registry run key, ensuring execution upon system startup. The RAT establishes command and control (C2) communication with a server hosted at 'kvejo991.ddns.net' on port 1604, allowing attackers to remotely control infected machines. Functionally, DarkComet performs keylogging by capturing keystrokes and storing them in a 'dclogs' folder, enabling theft of sensitive information such as credentials. For stealth, it injects its payload into the legitimate notepad.exe process and spawns multiple cmd.exe and conhost.exe processes, complicating detection and analysis. The use of cryptocurrency-themed social engineering lures increases the likelihood of user interaction and infection. Although no new exploits or vulnerabilities are leveraged, the malware’s persistence and data exfiltration capabilities pose significant risks. Indicators of compromise include multiple file hashes and the C2 domain and URL. The malware’s tactics align with MITRE ATT&CK techniques such as T1056.001 (Keylogging), T1566.001 (Phishing), T1204 (User Execution), T1041 (Exfiltration Over C2 Channel), T1547.001 (Registry Run Keys), T1027.002 (Packing), and T1071.001 (Application Layer Protocol).

Detailed information about DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool. Get real-time updates, technical details, and mitigation strategies.

DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool - Live Threat Intelligence - Threat Radar | OffSeq.com

DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool

Threats Tagged 'darkcomet rat'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'darkcomet rat'

Lead Pen Test Professional