Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Russian government-backed threat group COLDRIVER has developed a new malware called LOSTKEYS, capable of stealing files and system information. The group targets high-profile individuals, NGOs, and former intelligence officers through credential phishing and malware delivery. LOSTKEYS is delivered through a multi-step infection chain, starting with a fake CAPTCHA and involving PowerShell commands. The malware evades detection in VMs and uses a substitution cipher for decoding. COLDRIVER's primary goal is intelligence collection for Russia's strategic interests, targeting Western governments, militaries, journalists, and Ukraine-related individuals. The group has been linked to hack-and-leak campaigns in the UK and against NGOs.

COLDRIVER is a Russian government-backed threat actor that has developed a new malware strain named LOSTKEYS, designed primarily for espionage and intelligence collection. LOSTKEYS targets Western governments, militaries, journalists, NGOs, and individuals connected to Ukraine, including former intelligence officers. The infection vector begins with credential phishing campaigns that lure victims into interacting with a fake CAPTCHA, initiating a multi-stage infection chain. This chain leverages PowerShell commands to deploy the malware payload. LOSTKEYS employs advanced evasion techniques such as detecting virtual machine environments to avoid sandbox analysis and uses a substitution cipher to decode its payload, complicating detection and analysis. The malware is capable of stealing documents and system information, facilitating the exfiltration of sensitive data. COLDRIVER’s operations have been linked to hack-and-leak campaigns in the UK and against NGOs, underscoring their focus on high-value intelligence targets. The malware’s tactics, techniques, and procedures (TTPs) include credential theft, document theft, use of PowerShell for execution, and network reconnaissance, aligning with MITRE ATT&CK techniques such as T1566 (Phishing), T1059.001 (PowerShell), T1005 (Data from Local System), and T1102 (Web Service). Despite the lack of known exploits in the wild, the threat is credible given the actor’s history and strategic targeting.

MD5 of e7b6bfbfb6e496e57ceaba00fabe7df1d6b5061c

MD5 of 94bfd6fba2dec53a4df9b815d1f7dc150b37d4af

MD5 of 0ac32fd4e6ef96163084fdb09d05e1ae7124e6d9

MD5 of 56b0d6d7fb81b77c0713361f0b95994d19414bf1

MD5 of bd907c2512facbeef31d4e683828dfece01849e2

MD5 of ff9824395c18e1cf70960862654eb0a8b012eeaa

MD5 of de2e039c69f6f4f5af23d4eac2d3235e2ce4f20c

SHA256 of ff9824395c18e1cf70960862654eb0a8b012eeaa

SHA256 of de2e039c69f6f4f5af23d4eac2d3235e2ce4f20c

SHA256 of bd907c2512facbeef31d4e683828dfece01849e2

SHA256 of 94bfd6fba2dec53a4df9b815d1f7dc150b37d4af

SHA256 of e7b6bfbfb6e496e57ceaba00fabe7df1d6b5061c

SHA256 of 0ac32fd4e6ef96163084fdb09d05e1ae7124e6d9

SHA256 of 56b0d6d7fb81b77c0713361f0b95994d19414bf1

Detailed information about COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs. Get real-time updates, technical details, and mitigatio

Threats Tagged 'document theft'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'document theft'

Lead Pen Test Professional