Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core component, EggStremeAgent, is a full-featured backdoor enabling extensive system reconnaissance, lateral movement, and data theft via an injected keylogger. The attack begins with EggStremeFuel deploying EggStremeLoader to set up a persistent service, which then executes EggStremeReflectiveLoader to launch EggStremeAgent. The framework's fileless nature and use of legitimate Windows processes make it difficult to detect, posing a significant and persistent threat.

EggStreme is a sophisticated, multi-stage Advanced Persistent Threat (APT) malware framework attributed to a Chinese threat actor targeting a Philippine military company. This framework is notable for its fileless nature, which means it operates primarily in memory without writing malicious files to disk, significantly complicating detection by traditional antivirus and endpoint detection systems. The attack chain begins with EggStremeFuel, which deploys EggStremeLoader to establish persistence by creating a persistent Windows service. This service then executes EggStremeReflectiveLoader, which loads the core backdoor component, EggStremeAgent, directly into memory using DLL sideloading techniques. DLL sideloading abuses legitimate Windows processes by tricking them into loading malicious DLLs, thereby evading detection and security controls. EggStremeAgent provides extensive capabilities including system reconnaissance, lateral movement within the network, and data exfiltration. It also includes an injected keylogger (EggStremeKeylogger) to capture sensitive input data. The framework leverages multiple MITRE ATT&CK techniques such as credential dumping (T1003), process injection (T1055), service creation for persistence (T1543.003), and lateral movement via remote services (T1021.002). The use of legitimate Windows processes combined with fileless execution and DLL sideloading makes EggStreme a stealthy and persistent espionage tool, designed for long-term infiltration and data theft. The campaign’s targeting of a military entity underscores its strategic espionage intent.

CC=PH ASN=AS23930 ip-converge data center

CC=MY ASN=AS55720 gigabit hosting sdn bhd

CC=MY ASN=AS135542 light cloud technology

Detailed information about EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company. Get real-time updates, technical details, a

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company - Live Threat Intelligence - Threat Radar | OffSeq.com

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

Threats Tagged 'eggstremeloader'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'eggstremeloader'

Lead Pen Test Professional