Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT-C-60 continues to target Japan and East Asia with spear-phishing attacks impersonating job seekers. The attack flow has evolved, now directly attaching malicious VHDX files to emails. The malware, including Downloader1, Downloader2, and SpyGlace, has been updated with new features and communication methods. SpyGlace versions 3.1.12, 3.1.13, and 3.1.14 were observed, with changes in Mutex values and execution paths. The attackers use GitHub for payload distribution and employ sophisticated encoding and encryption techniques. The campaign abuses legitimate services and maintains consistent behavioral patterns despite infrastructure changes.

APT-C-60 is a sophisticated threat actor that continues to conduct targeted spear-phishing attacks primarily against Japan and East Asia by impersonating job seekers to lure victims. The attack vector has evolved to include direct attachment of malicious VHDX (Virtual Hard Disk) files in emails, which is a novel delivery method that can bypass some traditional email security filters. The malware suite used by APT-C-60 includes Downloader1, Downloader2, and SpyGlace, with SpyGlace observed in versions 3.1.12, 3.1.13, and 3.1.14. These versions show modifications in Mutex values and execution paths, indicating ongoing development and evasion efforts. The attackers utilize GitHub as a legitimate platform to host and distribute payloads, complicating detection and takedown efforts. The malware employs advanced encoding and encryption methods, including RC4, to protect communications and payloads. The campaign abuses legitimate Windows features such as COM hijacking (T1553.005), execution through trusted binaries (T1218.011), and persistence mechanisms (T1547.001). The spear-phishing emails exploit social engineering by impersonating job seekers, increasing the likelihood of user interaction. Despite infrastructure changes, the attackers maintain consistent behavioral patterns, indicating a mature and persistent operation. No known exploits in the wild have been reported, but the threat remains active and evolving. The medium severity rating reflects the targeted nature, complexity, and potential impact of the malware if successfully deployed.

Detailed information about Update on Attacks by Threat Group APT-C-60. Get real-time updates, technical details, and mitigation strategies.

Update on Attacks by Threat Group APT-C-60 - Live Threat Intelligence - Threat Radar | OffSeq.com

Update on Attacks by Threat Group APT-C-60

Threats Tagged 'downloader1'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'downloader1'

Lead Pen Test Professional