Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A hacking group named NetMedved has been conducting phishing attacks against Russian organizations since October 2025. The campaign uses malicious LNK files disguised as business documents to deliver NetSupport RAT malware. The attackers employ various techniques including PowerShell scripts, finger protocol, and anti-analysis checks. They utilize multiple domains for payload delivery and command and control. The group's infrastructure overlaps with previous campaigns from 2024, suggesting an evolution of tactics rather than a new actor. NetMedved's operations involve social engineering, custom obfuscation, and abuse of legitimate tools to evade detection and maintain persistence on compromised systems.

The 'Bear' attacks represent a targeted phishing campaign conducted by the threat actor NetMedved since October 2025, focusing on Russian organizations. The attackers distribute malicious LNK shortcut files masquerading as legitimate business documents, which when opened, execute payloads that deploy the NetSupport Remote Access Trojan (RAT). This RAT enables remote control and espionage capabilities. The campaign leverages PowerShell scripts for execution and persistence, uses the finger protocol for communication or reconnaissance, and incorporates anti-analysis checks to evade sandboxing and forensic investigation. The attackers utilize multiple domains for payload delivery and command and control (C2) infrastructure, complicating detection and takedown efforts. The infrastructure and tactics show continuity with campaigns from 2024, suggesting a refinement of methods rather than a new actor emergence. Social engineering is heavily employed to trick victims into opening malicious files, while custom obfuscation techniques and abuse of legitimate system tools help maintain stealth and persistence. Indicators of compromise include suspicious LNK files, unusual PowerShell activity, and network connections to known malicious domains. Despite the absence of known exploits in the wild, the campaign's sophistication and persistence mechanisms pose a credible threat to targeted organizations.

Detailed information about The 'Bear' attacks: what we learned about the phishing campaign targeting Russian organizations. Get real-time updates, technical det

The 'Bear' attacks: what we learned about the phishing campaign targeting Russian organizations - Live Threat Intelligence - Threat Radar | OffSeq.com

The 'Bear' attacks: what we learned about the phishing campaign targeting Russian organizations

Threats Tagged 'finger protocol'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'finger protocol'

Lead Pen Test Professional