Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In October 2025, Microsoft Threat Intelligence discovered GigaWiper, a sophisticated Golang-based backdoor that combines command-and-control capabilities with multiple destructive payloads. This versatile implant consolidates functionality from at least three separate malware families: a standalone wiper operating at physical disk level, a destructive component derived from Crucio ransomware that encrypts files with randomly generated unsaved keys, and a reimplemented version of FlockWiper with enhanced multi-pass secure wiping. The backdoor provides 20 different commands enabling threat actors to maintain control, execute operations, collect system information, and trigger destructive actions on demand. GigaWiper establishes persistence through scheduled tasks, communicates via RabbitMQ and Redis servers, and can perform disk wiping, fake ransomware encryption, screen recording, VNC-like remote control, and system-level sabotage including BSOD triggers and event log clearing.

GigaWiper is a multi-functional backdoor written in Golang that consolidates destructive capabilities from multiple malware families: a standalone disk wiper, a Crucio ransomware-derived fake encryption component using random unsaved keys, and a reimplemented FlockWiper with enhanced secure wiping. It offers 20 commands enabling threat actors to maintain persistence, execute destructive operations, collect system information, and remotely control infected systems. Persistence is achieved through scheduled tasks, and communication occurs via RabbitMQ and Redis servers. Destructive features include disk wiping, fake ransomware encryption, screen recording, VNC-like remote control, system sabotage such as blue screen of death triggers, and event log clearing. The malware was publicly detailed by Microsoft Threat Intelligence in July 2026. No patches or remediation guidance are provided, and no known exploits in the wild have been reported.

Detailed information about GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware. Get real-time updates, technical details, and mitigatio

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware - Live Threat Intelligence - Threat Radar | OffSeq.com

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

A highly targeted destructive wiper campaign dubbed 'Lotus Wiper' was discovered targeting the energy and utilities sector in Venezuela during late 2025 and early 2026. The attack begins with batch scripts coordinating execution across networks using domain shares as trigger mechanisms. These scripts disable security services, lock out users, and prepare the environment for the final payload. The Lotus Wiper systematically destroys data by wiping physical drives with zeros, deleting restore points, clearing USN journals, and recursively deleting files. Unlike ransomware, this wiper has no financial motivation or ransom demands, designed purely for data destruction. Evidence suggests attackers maintained long-term domain access prior to the attack, with the wiper compiled months before deployment. The malware targets older Windows systems and uses legitimate system tools like diskpart, robocopy, and fsutil.

Lotus Wiper is a destructive malware campaign targeting the energy and utilities sector in Venezuela, discovered in late 2025 and early 2026. It employs batch scripts that use domain shares as triggers to coordinate execution across networks. These scripts disable security services and lock out users to prepare the environment for the wiper payload. The malware systematically destroys data by zeroing physical drives, deleting system restore points, clearing USN journals, and recursively deleting files. It targets older Windows operating systems and uses legitimate Windows system tools such as diskpart, robocopy, and fsutil to carry out destructive actions. The campaign shows evidence of long-term domain access prior to the attack, with the malware compiled months before deployment. There are no ransom demands or financial motivations, indicating a purely destructive intent. No patches or official remediation guidance are available, and no known exploits in the wild have been reported.

Detailed information about Highly destructive Lotus Wiper used in a targeted attack. Get real-time updates, technical details, and mitigation strategies.

Highly destructive Lotus Wiper used in a targeted attack - Live Threat Intelligence - Threat Radar | OffSeq.com

Highly destructive Lotus Wiper used in a targeted attack

		Threat	Source
Unrated	–	GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware Unrated2026-07-09	AlienVault OTX General	2026-07-09
Unrated	–	Highly destructive Lotus Wiper used in a targeted attack Unrated2026-04-21	AlienVault OTX General	2026-04-21

Threats Tagged 'disk wiping'