Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In July-August 2025, India faced a surge of cross-border cyberattacks combining data breaches, DDoS, defacement, phishing, and malware. Pakistani, Bangladeshi, Russian, Indonesian, and likely Chinese actors targeted Indian judicial, defense, and transport systems. High-impact incidents included judicial server breaches, government website disruptions, retaliatory defacements, phishing schemes, and malware campaigns. Indian groups retaliated under 'Operation Vasudev Strike'. The attacks demonstrated the growing scale, sophistication, and multinational nature of hacktivist operations targeting India's digital infrastructure, blending hacktivism and cybercrime to challenge national security and public trust.

Between July and August 2025, India experienced a coordinated surge of cyberattacks originating from multiple countries including Pakistan, Bangladesh, Russia, Indonesia, and likely China. These attacks targeted critical Indian infrastructure sectors such as judicial systems, defense, and transportation. The threat actors employed a diverse range of tactics including data breaches, distributed denial-of-service (DDoS) attacks, website defacements, phishing campaigns, and malware infections. The malware components referenced include suspicious executables such as smss.exe, sysaid.exe, fshost64.exe, svchost.exe, and manc.exe, which may be masquerading as legitimate Windows processes to evade detection. The attack techniques align with MITRE ATT&CK tactics and techniques such as persistence (T1547), discovery (T1082), command and control (T1071), credential access (T1112), defense evasion (T1027), and execution (T1059), among others. The attackers exploited multiple vectors including phishing (T1566) and exploitation of public-facing applications (T1190). The attacks also involved retaliatory hacktivist actions by Indian groups under the banner 'Operation Vasudev Strike', illustrating the complex geopolitical and hacktivist dynamics at play. Indicators of compromise include multiple malware hashes, IP addresses, and suspicious domains used for command and control or phishing infrastructure. Although no known exploits in the wild or CVE identifiers are associated, the campaign demonstrates a sophisticated, multi-nation hacktivist operation blending cybercrime and political motives to undermine national security and public trust in India’s digital infrastructure.

Detailed information about Digital Frontlines: India Under Multi-Nation Hacktivist Attack. Get real-time updates, technical details, and mitigation strategies.

Digital Frontlines: India Under Multi-Nation Hacktivist Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

Digital Frontlines: India Under Multi-Nation Hacktivist Attack

This comprehensive analysis covers cyber threats and security issues affecting financial companies in South Korea and globally. It examines malware and phishing cases targeting the financial sector, including the top 10 malware strains and leaked Korean account statistics on Telegram. The report delves into dark web threats, focusing on credit card data breaches, financial institution database leaks, and ransomware attacks. Notable incidents include the M*** digital payment platform data breach in Indonesia, affecting 44 million users, and the Everest ransomware group's attack on J*** Bank in Jordan, compromising 11.7 GB of internal data. The analysis emphasizes the need for enhanced security measures, including real-time protection systems, account takeover detection, and strengthened internal defense mechanisms in the financial industry.

The June 2025 Security Issues report highlights a range of cyber threats targeting the financial sector in South Korea and globally, with a focus on malware, phishing, ransomware, and data breaches. The report identifies the top 10 malware strains affecting financial institutions and notes the leakage of Korean account statistics on Telegram, indicating active data exfiltration and potential credential abuse. Dark web activities are emphasized, particularly the trade and exposure of credit card data and financial institution database leaks. Noteworthy incidents include a massive data breach of a digital payment platform in Indonesia impacting 44 million users and a ransomware attack by the Everest group on a bank in Jordan, resulting in the compromise of 11.7 GB of internal data. The threat actors employ various tactics, techniques, and procedures (TTPs) such as data destruction (T1489), command and control communication (T1071), data from local system (T1005), data from network shared drive (T1567), exploitation for credential access (T1219), data encrypted for impact (T1486), and account takeover strategies. The report underscores the critical need for real-time protection systems, advanced account takeover detection, and robust internal defense mechanisms tailored for the financial sector to mitigate these evolving threats. Indicators of compromise (IOCs) include multiple malware hashes linked to these campaigns, although no known exploits are currently reported in the wild. The medium severity rating reflects the significant but not yet fully exploited threat landscape.

Detailed information about June 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

June 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

June 2025 Security Issues in Korean & Global Financial Sector

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data breaches, database breaches, and ransomware attacks. A notable case involves the Arkana ransomware group's breach of a global online brokerage firm, In***, resulting in the theft of 50 GB of customer data, including KYC submissions and information of over 163,000 customers. The incident highlights vulnerabilities in trading platforms' identity verification and account protection systems, emphasizing the need for enhanced security measures beyond regulatory compliance.

The May 2025 Security Issues campaign highlights a series of cyber threats targeting financial institutions primarily in South Korea but with global implications. The campaign details multiple attack vectors including malware infections, phishing campaigns, and ransomware attacks, with a focus on the financial sector. Key malware strains are identified among the top 10 most prevalent, contributing to data breaches and account compromises. A significant incident involved the Arkana ransomware group breaching a global online brokerage firm, resulting in the theft of approximately 50 GB of sensitive customer data. This data included Know Your Customer (KYC) submissions and personal information of over 163,000 customers, exposing critical vulnerabilities in identity verification and account protection mechanisms within trading platforms. The campaign also discusses the presence of stolen financial data on the dark web, including credit card and database breaches, which facilitate identity theft and fraud. The threat actors employ a range of tactics, techniques, and procedures (TTPs) such as ransomware deployment (T1486), data destruction (T1489), credential access (T1078), phishing (T1566), and command and control communications (T1071). The campaign underscores that existing regulatory compliance measures are insufficient to mitigate these risks, emphasizing the need for enhanced security controls tailored to the unique challenges of financial services platforms. Indicators of compromise include multiple malware hashes linked to the Arkana group and associated ransomware families like LockBit. Although no known exploits in the wild are reported, the campaign reflects ongoing and evolving threats to financial institutions' confidentiality, integrity, and availability of data and services.

Detailed information about May 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

May 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

May 2025 Security Issues in Korean & Global Financial Sector

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. The breach exposed LockBit's research into victims' finances and their willingness to provide additional services for a fee. The incident highlights the complexities of cybercrime negotiations and the human stories behind the headlines. Additionally, Cisco Talos observed a trend of attack kill chains being split into two stages, executed by separate threat actors, leading to refined definitions of initial access brokers.

The recent breach of LockBit's dark web affiliate panels has provided an unprecedented insight into the operational mechanics of one of the most prolific ransomware groups. LockBit operates on an affiliate model, where independent threat actors gain access to ransomware tools and infrastructure to conduct attacks, sharing profits with the core group. The leaked data includes Bitcoin addresses used for ransom payments, administrative credentials for affiliate panels, and chat logs revealing negotiation tactics and ransom demand strategies. These ransom demands vary widely, sometimes causing confusion among victims, indicating a flexible and complex negotiation process tailored to each victim's perceived ability to pay. The breach also exposed LockBit's internal research into victims' financial situations, suggesting a targeted approach to maximize ransom yields. Additionally, LockBit offers ancillary paid services such as data leak site management and victim support, reflecting a sophisticated criminal business model.

Cisco Talos has observed an evolution in ransomware operations, with attack kill chains being split into two stages executed by separate threat actors. This division refines the role of initial access brokers, who specialize in gaining network entry and then selling or handing off access to ransomware affiliates. This operational separation complicates detection and response efforts. The technical indicators provided, including multiple file hashes, can assist defenders in identifying related malware or tools used by LockBit affiliates. Overall, this breach sheds light on the human and operational complexities behind ransomware campaigns, emphasizing the importance of understanding adversary tactics beyond mere technical exploits.

Detailed information about Unfiltered look into LockBit’s operations. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'data breach'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'data breach'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility