Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell, Maggie, and Wgdrop. Their activities involve three stages: initial access and reconnaissance, backdoor deployment, and additional malicious behaviors. The group has connections to China and has been quietly stealing information for over 13 years without demanding ransom or releasing stolen data. Their persistent activity suggests preparation for potential large-scale attacks in the future.

TA-ShadowCricket, previously known as Shadow Force, is an advanced persistent threat (APT) group active since 2012, primarily targeting Windows servers and Microsoft SQL (MS-SQL) servers. The group operates an IRC server infrastructure controlling over 2,000 infected IP addresses across 72 countries, indicating a broad global footprint. Their malware toolkit includes several specialized tools such as Upm, SqlShell, Maggie, and Wgdrop, which facilitate multi-stage operations. The attack lifecycle consists of initial access and reconnaissance, followed by backdoor deployment, and culminating in additional malicious activities such as credential theft, lateral movement, and possibly cryptomining. Notably, TA-ShadowCricket has maintained a low profile by quietly exfiltrating sensitive information without engaging in ransom demands or public data leaks, suggesting a strategic intent to build long-term access for potential future large-scale operations. The group’s ties to China and their sustained activity over more than a decade underscore their persistence and sophistication. The use of IRC for command and control (C2) is a classic technique that enables stealthy communications and botnet management. The threat leverages multiple MITRE ATT&CK techniques including credential dumping (T1003), persistence (T1543), remote services exploitation (T1021.001), and obfuscated files or information (T1027), among others, highlighting a comprehensive and adaptable attack methodology. Despite no known public exploits currently in the wild, the extensive infection base and the variety of tools employed make this a significant threat to organizations running vulnerable Windows and MS-SQL server environments.

Detailed information about TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking. Get real-time updates, technical details, and mitigation strategie

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking - Live Threat Intelligence - Threat Radar | OffSeq.com

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking

Threats Tagged 'detofin'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'detofin'

Lead Pen Test Professional