Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report details an ongoing campaign by a threat actor operating during Chinese time zone hours, targeting Chinese-speaking individuals and entities globally. Since June 2023, the actor has created over 2,800 domains for malware delivery, primarily targeting Windows systems through fake application download sites and update prompts. The actor has made operational changes, including anti-automation measures, reduced site tracker services, increased server distribution, and more discreet registration details. The campaign uses fake login pages, marketing apps, and cryptocurrency-related apps to distribute malware. The actor's motivations appear to be financially driven, potentially including credential theft, financial theft, and access brokering. The report emphasizes the importance of user awareness, enhanced security measures, and multi-layered defense strategies to counter this persistent threat.

The reported threat describes an ongoing malware delivery campaign attributed to a threat actor known as SilverFox, operating primarily during Chinese time zone hours and targeting Chinese-speaking individuals and entities worldwide. Since June 2023, this actor has registered over 2,800 domains designed to distribute malware, focusing on Windows platforms. The campaign employs social engineering tactics such as fake application download sites, fraudulent update prompts, fake login pages, and the distribution of malicious marketing and cryptocurrency-related applications. Operational security improvements by the actor include anti-automation techniques to evade detection, reduced use of site tracking services to limit exposure, increased distribution of command and control servers, and more discreet domain registration details to hinder attribution and takedown efforts. The malware delivery methods leverage common attack techniques including phishing (T1566.002), masquerading (T1036.005, T1036.004), credential access (T1078), code injection (T1055), and persistence mechanisms (T1547.001). The actor’s motivations appear financially driven, aiming to steal credentials, conduct financial theft, and broker access to compromised systems. The campaign’s scale and sophistication indicate a persistent threat that requires multi-layered defense strategies, including user education to recognize phishing and fake update prompts, enhanced endpoint protection, network monitoring for suspicious domain activity, and proactive threat intelligence sharing. The absence of known exploits in the wild suggests the campaign relies heavily on social engineering rather than zero-day vulnerabilities, but the broad targeting and operational improvements increase its potential impact.

Detailed information about Chinese Malware Delivery Domains: Part III. Get real-time updates, technical details, and mitigation strategies.

Chinese Malware Delivery Domains: Part III - Live Threat Intelligence - Threat Radar | OffSeq.com

Chinese Malware Delivery Domains: Part III

Threats Tagged 'fake-updates'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'fake-updates'

Lead Pen Test Professional