Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Chinese APT group Silver Fox has launched an SEO poisoning campaign targeting Chinese-speaking users, impersonating Microsoft Teams. The campaign uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution. Silver Fox aims to conduct espionage and financial fraud, posing a significant threat due to its dual mission. The attack chain involves a fake Teams website, malicious ZIP files, and binary data retrieval from XML and JSON files. The malware exploits rundll32.exe for binary proxy execution and establishes C2 communication. Attribution to Silver Fox is based on overlapping infrastructure and links to previous campaigns. Organizations with global operations, especially in China, are advised to implement robust security measures and logging capabilities to defend against this evolving threat.

This threat involves the Chinese APT group Silver Fox launching an SEO poisoning campaign that impersonates Microsoft Teams to lure Chinese-speaking victims into downloading malicious payloads. The attackers created a fake Microsoft Teams website that appears legitimate in search results, tricking users into downloading ZIP archives containing malicious binaries. The malware payload is a modified version of ValleyRAT, a remote access trojan, which includes Cyrillic elements to mislead attribution efforts and suggest a Russian origin. The attack chain includes retrieving binary data embedded within XML and JSON files, which are then executed via the Windows utility rundll32.exe, a technique known as binary proxy execution (T1218.011). This method helps evade detection by running malicious code under a trusted system process. Once executed, the malware establishes command-and-control (C2) communication channels to receive instructions and exfiltrate data. The dual objectives of espionage and financial fraud increase the threat's complexity and potential impact. Attribution to Silver Fox is supported by overlapping infrastructure and links to previous campaigns. The campaign leverages multiple tactics, techniques, and procedures (TTPs) including SEO poisoning, social engineering, obfuscation, and living-off-the-land binaries, making detection and mitigation challenging. Although no known exploits are currently widespread in the wild, the threat is evolving and poses a significant risk to organizations with exposure to Chinese-speaking users or operations in China.

Detailed information about Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack. Get real-time updates, technical details, and mitigation strategi

Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack

Threats Tagged 'false flag'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'false flag'

Lead Pen Test Professional