Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new malware-as-a-service (MaaS) called TrustConnect has been discovered masquerading as a legitimate remote monitoring and management (RMM) tool. The malware, classified as a remote access trojan (RAT), uses a fake business website as its command and control center and MaaS portal. Priced at $300 per month, it offers features like a web-based C2 dashboard, automated payload generation with digital signatures, and remote desktop capabilities. The malware has been distributed through various email campaigns, often alongside legitimate RMM tools. Proofpoint researchers identified links between TrustConnect's creator and previous users of Redline stealer. The emergence of this new MaaS demonstrates the ongoing evolution of the cybercrime market and the thriving ecosystem of RMM abuse.

TrustConnect is a sophisticated remote access trojan (RAT) offered as a malware-as-a-service (MaaS) that impersonates legitimate remote monitoring and management (RMM) software. It is marketed via a fake business website that serves as both the command and control (C2) infrastructure and the MaaS portal. For $300 per month, customers gain access to a web-based C2 dashboard, automated payload generation with digital signatures to evade detection, and remote desktop control features. The malware is primarily distributed through targeted email campaigns, often bundled with or mimicking legitimate RMM tools to increase trust and evade suspicion. Proofpoint researchers have linked the TrustConnect creator to prior users of the Redline stealer, suggesting a well-established cybercriminal network behind this operation. The malware abuses the trust placed in RMM tools, which are commonly used by IT administrators for legitimate remote access and management, thereby complicating detection and response. Indicators of compromise include multiple malicious domains and IP addresses hosting payloads, as well as specific file hashes associated with the malware. Although no CVE or known exploits in the wild are reported yet, the malware’s capabilities allow attackers to remotely control infected systems, exfiltrate data, and potentially move laterally within networks. This MaaS model lowers the barrier to entry for cybercriminals, fueling the ongoing evolution of cybercrime and the abuse of trusted IT management tools.

Detailed information about (Don't) TrustConnect: It's a RAT in an RMM hat. Get real-time updates, technical details, and mitigation strategies.

(Don't) TrustConnect: It's a RAT in an RMM hat - Live Threat Intelligence - Threat Radar | OffSeq.com

(Don't) TrustConnect: It's a RAT in an RMM hat

Threats Tagged 'docconnect'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'docconnect'

Lead Pen Test Professional