Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines how threat actors abuse Keitaro, an advertising performance tracker, for various malicious purposes. The report covers a wide range of threats, including malware delivery, phishing, scams, and illegal content distribution. Key findings include the use of Keitaro for cloaking and traffic distribution in malvertising campaigns, spam operations leveraging Keitaro for cryptocurrency wallet draining, and the abuse of Keitaro in investment scams. The report also highlights specific threat actors and their tactics, such as domain hijacking for adult content delivery and the use of fake arrests as clickbait for investment scams. Overall, the analysis demonstrates how Keitaro's features make it attractive to cybercriminals seeking to maximize their reach with minimal effort.

Keitaro is an advertising performance tracking platform designed to help marketers optimize traffic and conversions. However, its legitimate features such as traffic distribution, cloaking, and detailed campaign analytics have been co-opted by threat actors for malicious purposes. This abuse includes the delivery of malware like RustyStealer and DonutLoader, phishing campaigns, and scams targeting cryptocurrency wallets. Attackers use Keitaro’s cloaking capabilities to evade detection by security tools, presenting benign content to researchers while redirecting victims to malicious payloads. Domain hijacking tactics are employed to redirect users to adult content or fraudulent investment schemes, often using clickbait such as fake arrests to lure victims. The platform’s flexibility and ease of use allow cybercriminals to scale their operations with minimal technical overhead. While no specific vulnerable versions or exploits have been identified, the abuse of Keitaro’s legitimate infrastructure represents a significant threat vector. The report highlights the importance of monitoring for Keitaro-related traffic patterns and indicators of compromise to detect and mitigate these threats.

CC=HK ASN=AS15611 iranian research organization for science & technology

Detailed information about Inside Keitaro Abuse Part 2: One Platform, Many Threats. Get real-time updates, technical details, and mitigation strategies.

Inside Keitaro Abuse Part 2: One Platform, Many Threats - Live Threat Intelligence - Threat Radar | OffSeq.com

Inside Keitaro Abuse Part 2: One Platform, Many Threats

Threats Tagged 'domain hijacking'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'domain hijacking'

Lead Pen Test Professional