Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT36, a Pakistan-based threat actor, is conducting a cyber-espionage campaign against Indian Government entities, targeting BOSS Linux systems with weaponized .desktop files. The group uses spear-phishing emails to deliver malicious payloads, exploiting the Linux environment to maintain persistent access and evade security controls. The campaign involves sophisticated tactics, including the use of custom malware, command and control servers, and data exfiltration techniques. The attackers leverage newly registered domains and employ various MITRE ATT&CK techniques to execute their operations. This activity demonstrates APT36's increasing sophistication and adaptability in targeting critical government infrastructure.

APT36, a Pakistan-based advanced persistent threat (APT) group, is conducting a targeted cyber-espionage campaign against Indian government entities by exploiting BOSS Linux systems. BOSS Linux is a Linux distribution developed and promoted by the Indian government for use in government offices and institutions. The attackers employ spear-phishing emails containing weaponized .desktop files, which are native Linux shortcut files capable of executing commands when opened. These malicious .desktop files serve as the initial infection vector, allowing the attackers to deploy custom ELF (Executable and Linkable Format) malware tailored for the Linux environment. Once executed, the malware establishes persistence on the compromised systems by leveraging autostart mechanisms inherent to Linux desktop environments, enabling the threat actor to maintain long-term access. The campaign uses sophisticated tactics including the use of newly registered domains (e.g., modgovindia.space, securestore.cv) and command and control (C2) servers to receive commands and exfiltrate sensitive data. The attackers employ a wide range of MITRE ATT&CK techniques such as T1037 (Boot or Logon Autostart Execution), T1014 (Rootkit), T1025 (Data from Removable Media), T1082 (System Information Discovery), T1071 (Application Layer Protocol), T1053 (Scheduled Task), T1005 (Data from Local System), T1011.001 (Exfiltration Over C2 Channel), T1222 (File and Directory Permissions Modification), T1003.001 (OS Credential Dumping), T1090 (Proxy), T1083 (File and Directory Discovery), T1064 (Scripting), T1048 (Exfiltration Over Alternative Protocol), T1571 (Non-Standard Port), T1546.004 (Event Triggered Execution), T1095 (Non-Application Layer Protocol), T1498 (Network Denial of Service), T1543.002 (Windows Service), T1105 (Ingress Tool Transfer), T1564.001 (Hidden Files and Directories), and T1001.001 (Data Obfuscation). These techniques demonstrate the group’s adaptability and sophistication in evading detection and maintaining stealthy operations. The campaign’s focus on BOSS Linux systems highlights a strategic targeting of Indian government infrastructure, aiming to gather intelligence and maintain persistent surveillance. Indicators of compromise include multiple malware hashes, IP addresses, and malicious domains associated with the campaign. No known public exploits or CVEs are currently linked to this threat, and the severity is assessed as medium by the source.

Detailed information about APT36: Targets Indian BOSS Linux Systems with Weaponized AutoStart Files. Get real-time updates, technical details, and mitigation st

APT36: Targets Indian BOSS Linux Systems with Weaponized AutoStart Files - Live Threat Intelligence - Threat Radar | OffSeq.com

APT36: Targets Indian BOSS Linux Systems with Weaponized AutoStart Files

Threats Tagged 'elf'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'elf'

Lead Pen Test Professional