Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The attack utilized social engineering involving a compromised Telegram account, fake Zoom meeting, and reported AI-generated video. UNC1069 has shifted from spear-phishing to targeting Web3 industry entities like centralized exchanges, software developers, and venture capital firms. The intrusion demonstrated sophisticated techniques to bypass macOS security features and harvest credentials, browser data, and cryptocurrency information. This marks a significant expansion in UNC1069's capabilities and highlights their focus on financial theft and fueling future social engineering campaigns.

UNC1069, a North Korean state-sponsored threat actor, has escalated its cyber operations by targeting the cryptocurrency and decentralized finance (DeFi) sectors with a sophisticated campaign deploying seven unique malware families, including newly identified tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH. These malware families are engineered to evade macOS security mechanisms and focus on harvesting host system data, victim credentials, browser data, and cryptocurrency wallet information. The campaign employs advanced social engineering techniques enhanced by AI, such as leveraging compromised Telegram accounts, staging fake Zoom meetings, and using AI-generated deepfake videos to deceive victims. This represents a tactical shift from traditional spear-phishing to direct targeting of Web3 industry stakeholders, including centralized cryptocurrency exchanges, software developers, and venture capital firms involved in blockchain investments. The malware families incorporate various tactics aligned with MITRE ATT&CK techniques such as process injection (T1055.001), credential dumping (T1005), and user execution (T1204), indicating a multi-faceted approach to infiltration and data exfiltration. The campaign's sophistication and focus on financial theft underscore UNC1069's intent to monetize stolen data and credentials, potentially enabling further social engineering campaigns and financial fraud. Although no known public exploits are reported, the campaign's complexity and use of AI-enhanced deception elevate the threat profile significantly.

Detailed information about Cryptocurrency Sector Targeted with New Tooling and AI-Enabled Social Engineering. Get real-time updates, technical details, and miti

Cryptocurrency Sector Targeted with New Tooling and AI-Enabled Social Engineering - Live Threat Intelligence - Threat Radar | OffSeq.com

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

Threats Tagged 'deepbreath'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'deepbreath'

Lead Pen Test Professional