Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The analysis team has categorized attacks on MS-SQL and MySQL servers installed on Windows systems during Q2 2025. While the number of targeted systems remains stable, attacks on MS-SQL servers have been decreasing. MySQL servers saw a significant spike in attacks in June 2025. The report provides detailed statistics on attack trends, including graphs illustrating the attack status for both server types. It also includes a list of MD5 hashes, URLs, FQDNs, and IP addresses associated with the malicious activities. The analysis covers various types of malware and tools used in these attacks, ranging from backdoors and miners to ransomware and remote access trojans.

The provided report details a campaign of malware attacks targeting Windows-based database servers, specifically MS-SQL and MySQL, during the second quarter of 2025. The analysis highlights a stable number of targeted systems overall, with a notable decrease in attacks against MS-SQL servers but a significant spike in attacks targeting MySQL servers in June 2025. The malware involved encompasses a broad spectrum of threats, including backdoors, cryptocurrency miners, ransomware, and remote access trojans (RATs). The campaign leverages various tools and malware families such as ShadowForce, JuicyPotato, Cobalt Strike, Remcos, Loveminer, and MyKings, indicating a multi-faceted attack approach. Techniques referenced by MITRE ATT&CK IDs (e.g., T1133, T1082, T1190, T1486) suggest exploitation of network services, credential dumping, lateral movement, persistence, and ransomware deployment. Indicators of compromise (IOCs) include multiple IP addresses, domain names, and file hashes associated with malicious payloads and command-and-control infrastructure. The absence of known exploits in the wild implies that the attacks may rely on a combination of credential theft, misconfigurations, and possibly zero-day or unpatched vulnerabilities. The report also references external analysis by AhnLab, providing further technical insights. Overall, this campaign represents a persistent and evolving threat to Windows database servers, with a shift in attacker focus from MS-SQL to MySQL environments.

Detailed information about Statistics Report on Malware Targeting Windows Database Servers in Q2 2025. Get real-time updates, technical details, and mitigation 

Statistics Report on Malware Targeting Windows Database Servers in Q2 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

Statistics Report on Malware Targeting Windows Database Servers in Q2 2025

Threats Tagged 'database'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'database'

Lead Pen Test Professional