Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Since the release of XWorm V6.0 on June 4, 2025, we have noted a surge in samples identified as XWorm V6.0 on VirusTotal, reflecting its rapid adoption by threat actors. One prominent campaign illustrates its delivery: a malicious JavaScript (JS) file initiates a PowerShell (PS1) script, which deploys an injector to deliver the XWorm Client.

XWorm V6 is a sophisticated remote access Trojan (RAT) that has gained rapid traction among threat actors since its release on June 4, 2025. The malware is primarily delivered through malicious JavaScript files that execute PowerShell scripts, which in turn deploy an injector to install the XWorm client on victim systems. This multi-stage infection chain allows the malware to evade traditional detection mechanisms by leveraging script-based execution and AMSI (Antimalware Scan Interface) bypass techniques. The malware incorporates a range of capabilities including remote desktop access, file management, credential harvesting, and process injection (notably process hollowing and thread injection), enabling attackers to maintain persistent and stealthy control over compromised hosts. The use of PowerShell and JavaScript as delivery and execution vectors aligns with common phishing campaigns, increasing the likelihood of successful initial compromise. The malware’s modular design allows it to load pivotal plugins that extend its functionality, making it adaptable to different operational needs. Although there are no known exploits in the wild targeting specific vulnerabilities, the threat relies heavily on social engineering and script execution to infiltrate environments. The tags associated with the threat (e.g., T1012, T1027, T1036, T1041, T1055, T1056, T1057, T1059) correspond to MITRE ATT&CK techniques such as system information discovery, obfuscated files or information, masquerading, command and control, process injection, input capture, system service discovery, and command-line interface usage, highlighting the malware’s comprehensive attack lifecycle. The absence of affected versions and patch links indicates that this is a malware campaign rather than a software vulnerability. The threat is documented by AlienVault and analyzed in detail by Trellix researchers, providing actionable intelligence for defenders.

MD5 of 570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869

SHA1 of 570e4d52b259b460aa17e8e286be64d5bada804bd4757c2475c0e34a73aeb869

MD5 of 6a0c1f70af17bd9258886f997bb43266aa816ff24315050bbf5f0e473d059485

MD5 of 000185a17254cd8863208d3828366ec25ddd01596f18e57301355d4a33eac242

MD5 of d46bb31dc93b89d67abffe144c56356167c9e57e3235bfb897eafc30626675bb

MD5 of 1990659a28b2c194293f106e98f5c5533fdad91e50fdeb1a9590d6b1d2983ada

SHA1 of 1990659a28b2c194293f106e98f5c5533fdad91e50fdeb1a9590d6b1d2983ada

SHA1 of d46bb31dc93b89d67abffe144c56356167c9e57e3235bfb897eafc30626675bb

SHA1 of 000185a17254cd8863208d3828366ec25ddd01596f18e57301355d4a33eac242

SHA1 of 6a0c1f70af17bd9258886f997bb43266aa816ff24315050bbf5f0e473d059485

Detailed information about XWorm V6: Exploring Pivotal Plugins. Get real-time updates, technical details, and mitigation strategies.

Threats Tagged 'file manager'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'file manager'

Lead Pen Test Professional