Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new cluster is spreading malware through phishing attacks targeting Russia. The attack methodology involves fake pages that imitate file downloads from Telegram. The article likely details the structure of these attacks, providing insights into how the malicious actors are exploiting user trust in the popular messaging platform to deliver their payload. This emerging threat, dubbed Vortex Werewolf, appears to be a sophisticated campaign specifically targeting Russian users or entities.

The Vortex Werewolf campaign is a newly identified malware distribution operation primarily targeting Russian users through phishing attacks. The attackers create fake web pages that impersonate legitimate Telegram file download pages, exploiting the widespread trust and usage of Telegram in Russia. Victims are lured into downloading malicious files under the guise of legitimate content, which then execute malware on their systems. The campaign employs several MITRE ATT&CK techniques: T1566 (Phishing), specifically T1566.002 (Spearphishing Link), T1059 (Command and Scripting Interpreter), and T1204.001 (User Execution: Malicious File). These techniques indicate a multi-stage attack involving social engineering to deliver and execute malicious payloads. While the campaign currently focuses on Russian targets, the use of Telegram as a delivery vector means that any user or organization relying on Telegram for file sharing could be at risk if the campaign expands. No known exploits are reported in the wild, and no specific software vulnerabilities are exploited, indicating the attack relies heavily on user deception and social engineering rather than technical exploits. The campaign's medium severity rating reflects its targeted nature, the need for user interaction, and the absence of automated exploitation mechanisms. The sophistication of the fake pages and the use of a trusted platform like Telegram increase the likelihood of successful compromise among targeted users.

Detailed information about Approaching Cyclone: Vortex Werewolf Attacks Russia. Get real-time updates, technical details, and mitigation strategies.

Approaching Cyclone: Vortex Werewolf Attacks Russia - Live Threat Intelligence - Threat Radar | OffSeq.com

Approaching Cyclone: Vortex Werewolf Attacks Russia

Threats Tagged 'file downloads'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'file downloads'

Lead Pen Test Professional