Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign is targeting users through fake YouTube video download sites, distributing Proxyware malware. The attack involves a downloader disguised as WinMemoryCleaner, which installs NodeJS and runs malicious JavaScript. This script then installs various Proxyware programs, including DigitalPulse, HoneyGain, and recently, Infatica. The malware uses Task Scheduler for persistence and sends system information to a C&C server. The Proxyware exploits the infected system's network bandwidth for the attacker's profit. Users in South Korea have been particularly targeted. To prevent infection, users should avoid installing executables from suspicious websites and use antivirus software.

This threat involves a malicious campaign distributing Proxyware malware through fake YouTube video download websites. The attack vector is a downloader masquerading as a legitimate utility named WinMemoryCleaner. Upon execution, this downloader installs NodeJS on the victim's system and executes malicious JavaScript code. This script subsequently installs multiple Proxyware applications, including DigitalPulse, HoneyGain, and the more recent Infatica. Proxyware software typically allows users to share their internet bandwidth for profit, but in this malicious context, the infected system's network resources are exploited without user consent to generate illicit revenue for the attacker. Persistence is achieved by leveraging the Windows Task Scheduler to ensure the malware runs on system startup or at scheduled intervals. Additionally, the malware collects system information and sends it to a command and control (C&C) server, potentially enabling further malicious activities or updates. The campaign is notable for targeting users in South Korea, but the distribution method—fake YouTube video download sites—is globally accessible, posing a risk to users worldwide. The malware employs multiple techniques identified by MITRE ATT&CK tags such as T1053.005 (Scheduled Task), T1036.005 (Masquerading), T1082 (System Information Discovery), T1497 (Virtualization/Sandbox Evasion), T1059.001 and T1059.003 (Command and Scripting Interpreter), T1547.001 (Boot or Logon Autostart Execution), T1571 (Non-Standard Port), T1105 (Ingress Tool Transfer), and T1204.001 (User Execution). Indicators of compromise include specific file hashes and domains associated with the malware's infrastructure. No known exploits in the wild have been reported, but the campaign's medium severity rating reflects the potential for unauthorized bandwidth usage and system compromise. Users are advised to avoid downloading executables from untrusted sources and to maintain updated antivirus solutions to detect and prevent infection.

Detailed information about Proxyware Malware Being Distributed on YouTube Video Download Site. Get real-time updates, technical details, and mitigation strategi

Proxyware Malware Being Distributed on YouTube Video Download Site - Live Threat Intelligence - Threat Radar | OffSeq.com

Proxyware Malware Being Distributed on YouTube Video Download Site

Threats Tagged 'digitalpulse'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'digitalpulse'

Lead Pen Test Professional