Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.

BlueNoroff, a financially motivated advanced persistent threat (APT) group, has launched two sophisticated campaigns named GhostCall and GhostHire. GhostCall targets macOS devices of technology executives and venture capitalists by impersonating Zoom-like meeting invitations, exploiting social engineering and AI-enhanced images to lure victims into executing multi-stage malware payloads. GhostHire targets Web3 developers through fake recruitment processes, similarly deploying complex malware chains. The malware families involved include ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, which operate across Windows, macOS, and Linux platforms. These malware strains utilize advanced techniques such as process injection, persistence via scheduled tasks (T1053.005), credential dumping (T1003), and obfuscation (T1027). The campaigns leverage trusted communication channels and social engineering to bypass traditional security controls. BlueNoroff’s focus has expanded beyond cryptocurrency theft to comprehensive data acquisition, enabling supply chain attacks and exploitation of established trust relationships for broader operational impact. The attacks require user interaction but no prior authentication, increasing the attack surface. No known public exploits exist yet, but the multi-platform nature and targeting of high-value individuals and developers make this a significant threat vector.

Detailed information about Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs. Get real-time updates, technical details, and mitigation strategies.

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs - Live Threat Intelligence - Threat Radar | OffSeq.com

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

Threats Tagged 'downtroy'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'downtroy'

Lead Pen Test Professional