Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.

Pay2Key.I2P represents the resurgence of the Iranian-backed ransomware-as-a-service (RaaS) operation known as Pay2Key, which has been linked to the Fox Kitten advanced persistent threat (APT) group. This campaign targets Western organizations with a dual motivation: financial gain and geopolitical objectives aligned with Iranian interests. The operation has reportedly amassed over $4 million in ransom payments within a four-month period, demonstrating both its effectiveness and scale. Pay2Key.I2P distinguishes itself through sophisticated evasion techniques, including anti-analysis checks and code obfuscation, which complicate detection and forensic analysis. The group’s strategic marketing efforts on darknet forums and social media platforms indicate a well-planned and ongoing rollout. Notably, the ransomware has expanded its attack surface by incorporating Linux-targeted payloads, increasing the range of potential victims beyond traditional Windows environments. The collaboration with Mimic ransomware suggests a coordinated approach to maximize impact and ransom collection. The tactics, techniques, and procedures (TTPs) associated with this campaign include credential dumping, process injection, obfuscation, defense evasion, and ransomware deployment, as indicated by the referenced MITRE ATT&CK techniques (e.g., T1489, T1553.002, T1140, T1036, T1055, T1486). Although no specific affected software versions or patches are identified, the campaign’s operational sophistication and geopolitical backing make it a persistent threat to critical infrastructure and enterprises in the West.

Detailed information about Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West. Get real-time updates, technical details, and mitigation strategies.

Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West - Live Threat Intelligence - Threat Radar | OffSeq.com

Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West

A sophisticated SEO spam infection was discovered utilizing a cleverly crafted plugin that mimics the infected domain's name to avoid detection. The malware injects spam content into websites, targeting search engine rankings, and only activates under specific conditions like when a crawler is detected. The plugin's code is heavily obfuscated, using thousands of variable assignments broken into small parts. When decoded, the malware downloads files from external hosts, fetches remote content, and delivers custom spam to search engines while appearing normal to regular users. The attacker's domain, mag1cw0rld[.]com, is used for remote control. This technique allows the spam to remain undetected for longer periods, making it challenging to identify with traditional tools.

This threat involves a sophisticated SEO spam campaign that leverages a malicious WordPress plugin designed to evade detection by mimicking the infected website's own domain name. The malware is embedded within a plugin that appears legitimate and uses heavy code obfuscation techniques, including thousands of fragmented variable assignments, to conceal its true functionality. Once active, the plugin injects spam content into the infected website, but only under specific conditions such as when a search engine crawler visits the site. This selective activation helps the malware avoid detection by regular users and traditional security tools. The malicious code downloads additional files from external hosts and fetches remote content controlled by the attacker via the domain mag1cw0rld.com, which serves as a command and control (C2) server. The injected spam content is tailored to manipulate search engine rankings, thereby potentially damaging the SEO reputation of the victim's website and redirecting traffic or boosting attacker-controlled sites. The use of domain mimicry and obfuscation techniques complicates detection and remediation efforts. Although no known exploits are reported in the wild, the stealthy nature of this malware and its ability to evade conventional detection mechanisms make it a persistent threat to WordPress-based websites.

Detailed information about Fake Spam Plugin Uses Victim's Domain Name to Evade Detection. Get real-time updates, technical details, and mitigation strategies.

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection

Skeleton Spider, also known as FIN6, is a financially motivated cybercrime group that has evolved from POS breaches to broader enterprise threats. They employ social engineering tactics, posing as job seekers on platforms like LinkedIn to deliver phishing messages. Their preferred payload is more_eggs, a JavaScript-based backdoor. The group uses trusted cloud services like AWS to host malicious infrastructure, evading detection. Their phishing emails impersonate job applicants, with domains mimicking real names. FIN6 employs sophisticated filtering techniques to ensure malware delivery only to intended targets. The more_eggs malware, developed by Venom Spider, allows for command execution and credential theft. Defense strategies include cautious handling of resume links, blocking execution of suspicious files, and implementing EDR policies.

Skeleton Spider, also known as FIN6, is a financially motivated cybercrime group that has transitioned from primarily targeting point-of-sale (POS) systems to launching broader enterprise-level attacks. Their current modus operandi involves sophisticated social engineering campaigns, notably posing as job seekers on professional networking platforms like LinkedIn. They send phishing emails impersonating job applicants, using domains that closely mimic legitimate names to increase credibility. The payload of choice is the more_eggs malware, a JavaScript-based backdoor developed by the Venom Spider group. This malware enables attackers to execute arbitrary commands and steal credentials from compromised systems. A notable aspect of this threat is the use of trusted cloud infrastructure, specifically Amazon Web Services (AWS), to host malicious components. This tactic helps evade traditional detection mechanisms that might block known malicious IPs or domains. FIN6 also employs advanced filtering techniques to ensure that their malware is delivered only to intended targets, reducing noise and increasing the likelihood of successful compromise. The attack chain involves phishing with resume lures containing links or attachments that, when interacted with, lead to the execution of the more_eggs backdoor. The malware leverages various techniques such as process injection, persistence mechanisms, and command and control communications over legitimate protocols to maintain stealth and persistence within victim environments. The group’s use of cloud services and evasion tactics complicates detection and response efforts. Defensive measures recommended include heightened scrutiny of unsolicited resume links, blocking execution of suspicious JavaScript files, and deploying Endpoint Detection and Response (EDR) solutions with policies tuned to detect behaviors associated with more_eggs and related tactics.

Detailed information about Eggs in a Cloudy Basket: Skeleton Spider's Trusted Cloud Malware Delivery. Get real-time updates, technical details, and mitigation s

Eggs in a Cloudy Basket: Skeleton Spider's Trusted Cloud Malware Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

Eggs in a Cloudy Basket: Skeleton Spider's Trusted Cloud Malware Delivery

SvcStealer 2025 is a novel information stealer delivered through spear phishing email attachments. It harvests sensitive data including machine information, installed software, user credentials, cryptocurrency wallets, and browser data. The malware creates a unique folder, terminates specific processes, and collects data from various sources. It compresses the gathered information, establishes a connection with a C2 server, and uploads the data. The malware can also capture screenshots and potentially download additional payloads. It employs evasion techniques by deleting traces and ensuring only one instance runs on the victim's machine. The threat actors behind SvcStealer could potentially act as initial access brokers, selling the gathered information on underground forums and criminal marketplaces.

SvcStealer 2025 is a newly identified information-stealing malware primarily distributed via spear phishing email attachments. Upon execution, the malware creates a unique folder on the infected machine to isolate its operations and ensure persistence. It actively terminates specific processes that might interfere with its data collection or detection, demonstrating a targeted approach to evade security controls. The malware harvests a broad spectrum of sensitive information including detailed machine information, installed software inventories, user credentials stored on the system, browser data such as cookies and saved passwords, and cryptocurrency wallet data. This comprehensive data collection suggests a dual focus on corporate espionage and financial theft. After gathering the data, SvcStealer compresses the information to optimize exfiltration and establishes a connection with a command-and-control (C2) server to upload the stolen data. Additionally, it can capture screenshots, potentially to gather contextual information or bypass certain security mechanisms that rely on textual data alone. The malware also has the capability to download and execute additional payloads, which could escalate the attack or introduce further malicious functionalities. To avoid detection and forensic analysis, SvcStealer employs evasion techniques such as deleting traces of its activity and ensuring that only a single instance runs on the victim machine at any time. The threat actors behind SvcStealer are likely to operate as initial access brokers, selling harvested credentials and sensitive data on underground forums and criminal marketplaces, which could facilitate further attacks by other malicious actors. Currently, there are no known exploits in the wild beyond the spear phishing vector, and no specific affected software versions have been identified. The malware’s medium severity rating reflects its potential impact balanced against the targeted delivery method and current detection capabilities.

Detailed information about New Stealer on the Horizon. Get real-time updates, technical details, and mitigation strategies.

New Stealer on the Horizon - Live Threat Intelligence - Threat Radar | OffSeq.com

New Stealer on the Horizon

A new PowerShell-based shellcode loader has been discovered, designed to execute a variant of Remcos RAT. The attack chain begins with malicious LNK files in ZIP archives, using mshta.exe for initial execution. The loader employs fileless techniques, executing code directly in memory to evade traditional defenses. It leverages Windows APIs to allocate memory and execute binary code. The Remcos RAT provides full system control, featuring keylogging, screen capture, and credential theft capabilities. It uses advanced evasion techniques like process hollowing and UAC bypass. The malware establishes persistence through registry modifications and connects to a command and control server over TLS. This sophisticated attack emphasizes the need for behavioral analytics and proactive security measures to detect and mitigate such stealthy threats.

This threat involves a sophisticated fileless malware attack leveraging PowerShell to load and execute shellcode directly in memory, thereby bypassing traditional file-based detection mechanisms. The attack initiates via malicious LNK shortcut files embedded within ZIP archives, which when opened, trigger mshta.exe to execute the initial payload. The PowerShell-based loader then uses Windows API calls to allocate memory and execute binary code without writing files to disk, significantly enhancing stealth. The payload is a variant of Remcos RAT, a remote access trojan that grants attackers full control over the compromised system. Remcos RAT capabilities include keylogging, screen capture, credential theft, and other espionage functions. It employs advanced evasion techniques such as process hollowing—injecting malicious code into legitimate processes—and User Account Control (UAC) bypass to escalate privileges without user consent. Persistence is achieved through registry modifications, ensuring the malware survives system reboots. Communication with the command and control (C2) server is conducted over encrypted TLS channels, complicating network detection. This attack chain exemplifies modern threat actor tactics that emphasize stealth, memory-resident execution, and multi-layered evasion, making detection and mitigation challenging without behavioral analytics and endpoint detection and response (EDR) solutions capable of monitoring in-memory activities and anomalous process behaviors.

Detailed information about Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT. Get real-time updates, technical details, and mitigation s

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT - Live Threat Intelligence - Threat Radar | OffSeq.com

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT

This analysis examines BRICKSTORM, an espionage backdoor linked to China-nexus cluster UNC5221. It details newly identified Windows variants, expanding on previous Linux presence. The backdoor, used in long-term espionage campaigns, targets European industries of strategic interest to China. BRICKSTORM provides file management and network tunneling capabilities, using multiple layers of encryption and leveraging cloud providers to evade detection. The analysis covers the backdoor's inner workings, including its command and control infrastructure, protocol details, and evasion techniques. It highlights the persistent nature of these intrusions and the challenges they pose to defensive measures. The document concludes with recommendations for detection and mitigation strategies.

BRICKSTORM is a sophisticated espionage backdoor attributed to the China-linked threat cluster UNC5221, recently identified with new Windows variants complementing its previously known Linux-based versions. This malware is designed for persistent, long-term espionage campaigns targeting European industries deemed strategically important to Chinese interests. BRICKSTORM provides advanced capabilities including file management and network tunneling, enabling attackers to exfiltrate sensitive data and maintain covert communication channels. The backdoor employs multiple layers of encryption and leverages legitimate cloud service providers to mask its command and control (C2) infrastructure, complicating detection and attribution efforts. Its protocol details reveal custom communication methods optimized for stealth and resilience against network monitoring tools. The malware’s evasion techniques include obfuscation, use of legitimate cloud infrastructure, and persistence mechanisms that allow it to survive system reboots and security tool interventions. These features collectively make BRICKSTORM a challenging threat for defenders, as it can maintain long-term access to compromised environments while minimizing its footprint. The analysis underscores the need for specialized detection strategies focusing on anomalous network tunneling behaviors, encrypted traffic patterns to cloud services, and unusual file management activities within targeted environments.

Detailed information about BRICKSTORM Backdoor Analysis: A Persistent Espionage Threat to European Industries. Get real-time updates, technical details, and mit

Title	Severity	Type	Source	Date

Threats Tagged 'evasion techniques'

Filter Threats

Threats Tagged 'evasion techniques'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility