Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new campaign by Kimsuky involves distributing malicious mobile apps through QR codes and phishing websites. The apps, masquerading as delivery services, VPNs, and cryptocurrency tools, decrypt an embedded APK to deploy a RAT with extensive capabilities. The malware uses a native decryption function and diverse decoy behaviors. Infrastructure overlaps and Korean language comments link this activity to Kimsuky. The threat actor employs sophisticated phishing techniques and leverages QR codes to redirect victims to malicious downloads. The malware requests extensive permissions and implements keylogging, audio recording, and data exfiltration. Multiple C&C servers were identified, some hosting Naver and Kakao phishing sites.

This threat involves a campaign by the North Korean-linked group Kimsuky distributing malicious Android applications through QR codes and phishing websites. The malicious apps masquerade as legitimate services such as delivery companies, VPN providers, and cryptocurrency tools to lure victims into installation. Once installed, the apps use a native decryption function to unpack an embedded APK that deploys a Remote Access Trojan (RAT) with extensive capabilities. These capabilities include keylogging to capture user input, audio recording to capture conversations, and data exfiltration to steal sensitive information. The malware requests broad permissions on the infected device, enabling deep surveillance and control. The campaign infrastructure shows overlaps with previous Kimsuky activity, including Korean language comments in the code and use of phishing sites mimicking popular Korean platforms like Naver and Kakao. The attackers employ sophisticated phishing and social engineering techniques, leveraging QR codes to redirect victims to malicious downloads, increasing the likelihood of infection. Multiple command and control (C&C) servers have been identified, indicating a distributed infrastructure to maintain persistence and control over infected devices. Although no CVE or known exploits in the wild are reported, the threat is significant due to the invasive nature of the RAT and the social engineering delivery vector. The campaign targets mobile users, exploiting trust in common apps and services, and uses decoy behaviors to evade detection. Indicators of compromise include numerous file hashes, IP addresses, and domains related to the campaign, which can be used for detection and blocking.

Detailed information about Kimsuky Distributing Malicious Mobile App via QR Code. Get real-time updates, technical details, and mitigation strategies.

Kimsuky Distributing Malicious Mobile App via QR Code - Live Threat Intelligence - Threat Radar | OffSeq.com

Kimsuky Distributing Malicious Mobile App via QR Code

Threats Tagged 'docswap'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'docswap'

Lead Pen Test Professional