Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CyberEye is a modular, .NET-based Remote Access Trojan that utilizes Telegram for Command and Control, eliminating the need for attackers to maintain their own infrastructure. It offers a wide array of surveillance and data theft capabilities, including keylogging, file grabbing, and clipboard hijacking. The malware employs advanced defense evasion techniques, disabling Windows Defender through PowerShell and registry manipulations. Its modules harvest browser credentials, Wi-Fi passwords, gaming profiles, and session data from various applications. The builder framework allows adversaries to customize payloads, making it accessible to less technically skilled threat actors. CyberEye's persistence mechanisms, anti-analysis features, and use of public messaging platforms for C2 make it a significant threat to both consumers and enterprises.

CyberEye is a modular Remote Access Trojan (RAT) developed using the .NET framework, notable for its use of Telegram as a Command and Control (C2) channel. This design choice allows attackers to leverage a public messaging platform, eliminating the need to maintain dedicated C2 infrastructure, thereby increasing operational stealth and reducing costs. The RAT provides extensive surveillance and data theft capabilities, including keylogging to capture keystrokes, file grabbing to exfiltrate files, and clipboard hijacking to intercept copied data. It also harvests sensitive credentials such as browser-stored passwords, Wi-Fi keys, gaming profiles, and session information from various applications, enabling broad access to victim data. 

CyberEye employs advanced defense evasion techniques, notably disabling Windows Defender via PowerShell scripts and registry modifications, which complicates detection and removal. Its persistence mechanisms ensure the malware remains active across system reboots, while anti-analysis features hinder reverse engineering and forensic investigations. The RAT builder framework allows adversaries to customize payloads, lowering the technical barrier for less skilled threat actors to deploy sophisticated malware. The use of Telegram for C2 communications (leveraging techniques mapped to MITRE ATT&CK techniques such as T1102.002) also helps evade traditional network-based detection methods. Overall, CyberEye represents a versatile and stealthy threat capable of extensive data exfiltration and system control, targeting both consumer and enterprise Windows environments.

Detailed information about Understanding CyberEYE RAT Builder: Capabilities and Implications. Get real-time updates, technical details, and mitigation strategie

Understanding CyberEYE RAT Builder: Capabilities and Implications - Live Threat Intelligence - Threat Radar | OffSeq.com

Understanding CyberEYE RAT Builder: Capabilities and Implications

Operation Sindoor, a coordinated cyber campaign targeting critical Indian sectors, involved state-sponsored APT activity and hacktivist operations. The campaign utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, deployed advanced tactics including the Ares RAT for cyber espionage. The operation targeted defense, government IT, healthcare, telecom, and education sectors. Hacktivists conducted parallel disruptive attacks, using DDoS and defacements. The campaign revealed a convergence of cyber espionage and ideological warfare, showcasing the evolution of modern cyber conflicts. It resulted in data exfiltration, service disruptions, and website defacements, significantly impacting India's cybersecurity landscape and public trust.

Operation Sindoor is a sophisticated, multi-faceted cyber campaign primarily targeting critical sectors within India, orchestrated by the Pakistan-aligned Advanced Persistent Threat group APT36 alongside hacktivist collaborators. The campaign combines state-sponsored cyber espionage with hacktivist-driven disruptive activities, reflecting a hybrid warfare approach that merges intelligence gathering with ideological conflict. APT36 employed advanced tactics such as spear phishing to gain initial access, deploying the Ares Remote Access Trojan (RAT) to conduct stealthy cyber espionage operations. The campaign targeted high-value sectors including defense, government IT infrastructure, healthcare, telecommunications, and education, aiming to exfiltrate sensitive data and undermine operational integrity. Concurrently, hacktivist actors executed distributed denial-of-service (DDoS) attacks and website defacements, amplifying disruption and public distrust. The technical execution involved the use of malicious scripts, spear phishing emails (T1566.001), scheduled task abuse (T1053.005), and living-off-the-land binaries (T1218) to evade detection and maintain persistence. The campaign's infrastructure includes multiple malicious domains such as fogomyart.com and nationaldefencebackup.xyz, which serve as command and control or phishing platforms. Although no known exploits in the wild have been reported, the campaign's blend of espionage and hacktivism demonstrates an evolution in cyber conflict tactics, emphasizing both data theft and public disruption. The operation has significantly impacted India's cybersecurity posture and public trust in digital services.

Detailed information about Operation Sindoor – Anatomy of a Digital Siege. Get real-time updates, technical details, and mitigation strategies.

Operation Sindoor – Anatomy of a Digital Siege - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Sindoor – Anatomy of a Digital Siege

An APT group named Earth Kurma is actively targeting government and telecommunications organizations in Southeast Asia, particularly in the Philippines, Vietnam, Thailand, and Malaysia. The campaign, which dates back to November 2020, employs advanced custom malware, rootkits, and cloud storage services for data exfiltration. Earth Kurma utilizes sophisticated tools like TESDAT, SIMPOBOXSPY, KRNRAT, and MORIYA, demonstrating adaptive malware toolsets and complex evasion techniques. The attackers focus on lateral movement, persistence, and data collection, using various utilities to scan infrastructures and deploy malware. They also employ rootkits to maintain stealth and bypass detection. The group's primary objective appears to be cyberespionage, with a high risk of sensitive data compromise and prolonged, undetected network access.

The Earth Kurma Advanced Persistent Threat (APT) campaign has been active since November 2020, primarily targeting government and telecommunications sectors in Southeast Asia, specifically the Philippines, Vietnam, Thailand, and Malaysia. This threat actor employs a sophisticated and adaptive malware toolset including TESDAT, SIMPOBOXSPY, KRNRAT, and MORIYA, which are custom-developed malware families designed for stealth, persistence, and data exfiltration. The campaign leverages rootkits to maintain long-term undetected access by hiding malicious processes and files from security tools. The attackers utilize cloud storage services as covert channels for exfiltrating sensitive data, complicating detection efforts. Their tactics include extensive infrastructure scanning, lateral movement within compromised networks, and deploying various utilities to facilitate persistence and reconnaissance. The use of multiple MITRE ATT&CK techniques such as T1133 (External Remote Services), T1547 (Boot or Logon Autostart Execution), T1505.002 (Server Software Component: Web Shell), T1071 (Application Layer Protocol), T1053 (Scheduled Task/Job), T1005 (Data from Local System), T1140 (Deobfuscate/Decode Files or Information), T1190 (Exploit Public-Facing Application), T1567 (Exfiltration Over Web Service), T1055 (Process Injection), T1021 (Remote Services), T1112 (Modify Registry), T1595 (Active Scanning), T1083 (File and Directory Discovery), T1074 (Data Staged), and T1078 (Valid Accounts) highlights the complexity and multi-faceted nature of the campaign. The primary objective appears to be cyberespionage, focusing on sensitive data collection and maintaining prolonged, stealthy access to targeted networks. Indicators of compromise include numerous malware hashes and suspicious domains used for command and control or data exfiltration.

MD5 of 8414136128f73fa7e29032df7b8115bc89832c57e2602d81de1e520cc2d7958d

MD5 of b26e8e0be066ee0b86f8fb2b0a703717ebbf34c8a33ef9a6f8f164ad012f1746

MD5 of 66edb72f6f7c8cad23c6659a81fa023f57c1a86c7d7b7022f1453b177f2b3670

MD5 of 1ab42121bb45028a17a3438b65a3634adb7d673a4e1291efeabf227a4e016cfb

SHA1 of 66edb72f6f7c8cad23c6659a81fa023f57c1a86c7d7b7022f1453b177f2b3670

SHA1 of 1ab42121bb45028a17a3438b65a3634adb7d673a4e1291efeabf227a4e016cfb

SHA1 of b26e8e0be066ee0b86f8fb2b0a703717ebbf34c8a33ef9a6f8f164ad012f1746

SHA1 of 8414136128f73fa7e29032df7b8115bc89832c57e2602d81de1e520cc2d7958d

Detailed information about Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors. Get real-time updates, technical details, and mitigatio

Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors - Live Threat Intelligence - Threat Radar | OffSeq.com

Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors

A novel Rust-based infostealer called EDDIESTEALER has been discovered, distributed through fake CAPTCHA campaigns. The malware uses deceptive verification pages to trick users into executing a malicious PowerShell script, which deploys the infostealer. EDDIESTEALER targets sensitive data including credentials, browser information, and cryptocurrency wallet details. It communicates with a command and control server to receive tasks and exfiltrate data. The malware employs string obfuscation, API obfuscation, and other evasion techniques. It specifically targets various crypto wallets, browsers, password managers, FTP clients, and messaging applications. The use of Rust in its development reflects a growing trend among threat actors seeking enhanced stealth and resilience against traditional analysis methods.

EDDIESTEALER is a newly identified Rust-based information-stealing malware distributed primarily through deceptive CAPTCHA verification campaigns. The infection vector involves tricking users into executing a malicious PowerShell script via fake CAPTCHA pages, which then deploys the infostealer onto the victim's system. The malware targets a broad range of sensitive data, including user credentials, browser data, cryptocurrency wallet information, password managers, FTP clients, and messaging applications. Its use of Rust as a development language is notable, as Rust’s memory safety features and modern tooling provide enhanced stealth, resilience, and evasion capabilities against traditional static and dynamic analysis techniques. EDDIESTEALER employs multiple obfuscation methods such as string and API obfuscation to hinder detection and reverse engineering. Once installed, it communicates with a command and control (C2) server to receive commands and exfiltrate stolen data. The malware’s targeting of cryptocurrency wallets and password managers indicates a focus on high-value digital assets and credentials. The infection requires user interaction to execute the PowerShell script, which is a social engineering step embedded in the fake CAPTCHA process. Indicators of compromise include multiple file hashes, IP addresses, and domains associated with the malware’s infrastructure. While no known exploits in the wild are reported, the campaign’s reliance on social engineering and PowerShell execution makes it a significant threat vector, especially for users engaged in cryptocurrency transactions or those with sensitive credential stores.

Detailed information about Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns. Get real-time updates, technical details, and mitigation strate

Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns - Live Threat Intelligence - Threat Radar | OffSeq.com

Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns

A new information-stealing malware called Gremlin Stealer, written in C#, has been identified by researchers. Advertised on Telegram since March 2025, it targets a wide range of data including browser information, crypto wallets, FTP and VPN credentials. The malware exfiltrates stolen data to a web server for publication. It can bypass Chrome's cookie V20 protection and supports various Chromium and Gecko-based browsers. Gremlin Stealer also targets cryptocurrency wallets, Telegram and Discord sessions, and system information. The stolen data is compressed into a ZIP archive and sent to the attacker's server using a Telegram bot. This evolving threat highlights the need for robust cybersecurity measures to protect against such information stealers.

Gremlin Stealer is a newly identified information-stealing malware written in C# and actively advertised on underground forums such as Telegram since March 2025. This malware targets a broad spectrum of sensitive data, including browser information from Chromium and Gecko-based browsers, cryptocurrency wallets, FTP and VPN credentials, as well as Telegram and Discord session data. It is capable of bypassing Chrome's cookie V20 protection, which is a significant security feature designed to prevent unauthorized cookie access. Once the malware collects the targeted data, it compresses it into a ZIP archive and exfiltrates it to an attacker-controlled web server using a Telegram bot, leveraging Telegram's API for covert data transmission. The malware also collects system information, which can be used for further exploitation or profiling of victims. Although no known exploits in the wild have been reported yet, the malware is actively marketed, indicating potential for widespread deployment. The use of Telegram both as a distribution channel and as a command-and-control (C2) mechanism highlights the evolving tactics of threat actors to evade detection and leverage popular communication platforms. The malware's capability to steal credentials from VPNs and FTP clients poses a risk to enterprise environments where such tools are commonly used for secure remote access and file transfers. The targeting of cryptocurrency wallets also indicates a focus on financially motivated attacks. Overall, Gremlin Stealer represents a sophisticated and evolving threat that combines multiple data theft techniques with stealthy exfiltration methods, emphasizing the need for enhanced endpoint security and monitoring.

Detailed information about Gremlin Stealer: New Stealer on Sale in Underground Forum. Get real-time updates, technical details, and mitigation strategies.

Gremlin Stealer: New Stealer on Sale in Underground Forum - Live Threat Intelligence - Threat Radar | OffSeq.com

Gremlin Stealer: New Stealer on Sale in Underground Forum

The Hannibal Stealer is a sophisticated information-stealing malware, rebranded from Sharp and TX stealers. Developed in C#, it targets Chromium and Gecko-based browsers, extracting sensitive data while bypassing Chrome Cookie V20 protection. Its capabilities extend to cryptocurrency wallets, FTP clients, VPN credentials, and various system information. The malware includes a crypto clipper module and is controlled via a dedicated C2 panel. Sold on dark web forums, it employs geofencing, domain-matching, and comprehensive system profiling. The threat actor behind Hannibal Stealer has been linked to previous iterations, indicating minimal innovation beyond rebranding and updated communication methods. Active Telegram channels and control panels suggest ongoing operations and infrastructure maintenance.

HANNIBAL Stealer is a sophisticated information-stealing malware developed in C# and represents a rebranding of previous malware families known as Sharp and TX Stealers. It primarily targets Chromium and Gecko-based browsers, extracting sensitive user data such as saved passwords, cookies, autofill data, and browsing history. Notably, it bypasses Chrome Cookie V20 protection, a security feature designed to safeguard browser cookies, indicating advanced evasion capabilities. Beyond browser data, HANNIBAL Stealer extends its reach to cryptocurrency wallets, FTP clients, VPN credentials, and collects extensive system information, enabling attackers to gain comprehensive access to victim environments. It also includes a crypto clipper module, which can intercept and alter cryptocurrency addresses copied to the clipboard, redirecting funds to attacker-controlled wallets. The malware is controlled via a dedicated command and control (C2) panel, facilitating real-time data exfiltration and remote management. The threat actor employs geofencing and domain-matching techniques to restrict infections to specific geographic regions or domains, likely to avoid detection or target specific victims. Comprehensive system profiling allows the malware to tailor its behavior based on the victim’s environment. The malware is actively sold on dark web forums and supported by active Telegram channels and maintained infrastructure, indicating ongoing operations. Despite its rebranding, the malware shows minimal innovation beyond updated communication methods and infrastructure, relying on established techniques such as process injection, credential dumping, and persistence mechanisms, as indicated by the associated MITRE ATT&CK techniques (e.g., T1003 credential dumping, T1055 process injection, T1543/1547 persistence). No known exploits are currently reported in the wild, but the malware’s capabilities and active distribution suggest a persistent threat to targeted environments.

Detailed information about HANNIBAL Stealer: A Rebranded Threat Born from Sharp and TX Lineage. Get real-time updates, technical details, and mitigation strateg

HANNIBAL Stealer: A Rebranded Threat Born from Sharp and TX Lineage - Live Threat Intelligence - Threat Radar | OffSeq.com

HANNIBAL Stealer: A Rebranded Threat Born from Sharp and TX Lineage

Nitrogen, a new ransomware strain identified in September 2024, has become a significant threat to organizations worldwide, particularly in the financial sector. It encrypts critical data and demands substantial payments for decryption, targeting industries such as finance, construction, manufacturing, and technology in the United States, Canada, and the United Kingdom. The ransomware's attack chain begins with malvertising campaigns on search engines, tricking users into downloading trojanized installers. It uses tools like Cobalt Strike and Meterpreter shells to establish persistence and move laterally within networks. Notable victims include SRP Federal Credit Union, Red Barrels, Control Panels USA, and Kilgore Industries. Nitrogen employs sophisticated tactics, including system reconnaissance, advanced evasion techniques, and exploitation of vulnerable drivers to disable security tools.

Nitrogen is a newly identified ransomware strain first observed in September 2024, which has rapidly emerged as a significant threat primarily targeting organizations within the financial sector, but also impacting construction, manufacturing, and technology industries. The ransomware operates by encrypting critical data and demanding substantial ransom payments for decryption keys. Its infection vector is notably sophisticated, leveraging malvertising campaigns on popular search engines to lure victims into downloading trojanized installers masquerading as legitimate software. Once executed, Nitrogen deploys advanced post-exploitation tools such as Cobalt Strike and Meterpreter shells to establish persistence within compromised networks and facilitate lateral movement across systems. The ransomware conducts thorough system reconnaissance to identify valuable targets and employs advanced evasion techniques to bypass detection by security solutions. A particularly dangerous aspect of Nitrogen is its exploitation of vulnerable device drivers to disable or circumvent endpoint protection tools, thereby increasing its chances of successful encryption and data exfiltration. Notable victims include SRP Federal Credit Union, Red Barrels, Control Panels USA, and Kilgore Industries, highlighting its focus on financially sensitive and operationally critical organizations. Indicators of compromise include several file hashes associated with the malware payloads. Although there are no known public exploits for this ransomware strain yet, its medium severity rating reflects the combination of its technical sophistication and targeted impact. The attack chain and tactics used by Nitrogen demonstrate a high level of adversary capability, making it a credible and ongoing threat to organizations that rely on vulnerable software distribution channels and have insufficient internal network segmentation and endpoint defenses.

Detailed information about New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada. Get real-time updates, technical details, and mitigation st

Title	Severity	Type	Source	Date

Threats Tagged 'data exfiltration'

Filter Threats

Threats Tagged 'data exfiltration'