Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated phishing campaign has been identified, utilizing carefully crafted emails to deliver malicious URLs linked to convincing phishing pages. These pages entice recipients to download JavaScript files that act as droppers for UpCrypter, a malware that ultimately deploys various remote access tools (RATs). The attack chain begins with obfuscated scripts redirecting victims to spoofed sites personalized with the target's email domain. The campaign uses different lures, including voicemail-themed and purchase order-themed emails. UpCrypter, the central loader framework, stages and deploys multiple RATs, including PureHVNC, DCRat, and Babylon RAT. The malware employs anti-VM and anti-analysis techniques, downloads additional payloads, and establishes persistence. This campaign operates globally, affecting multiple industries, and demonstrates an adaptable threat delivery ecosystem capable of bypassing defenses and maintaining persistence across different environments.

This threat describes a sophisticated phishing campaign leveraging UpCrypter, a malware loader framework, to deliver multiple remote access tools (RATs) such as PureHVNC, DCRat, and Babylon RAT. The attack begins with carefully crafted phishing emails that contain malicious URLs leading to convincing spoofed phishing pages. These pages are personalized with the target's email domain to increase credibility and entice victims to download obfuscated JavaScript files. These scripts act as droppers that initiate the deployment of UpCrypter. UpCrypter then stages and deploys various RATs capable of remote control, data exfiltration, and persistence on infected systems. The malware employs advanced evasion techniques including anti-virtual machine (anti-VM) and anti-analysis methods to avoid detection by security tools and researchers. It also downloads additional payloads dynamically and establishes persistence mechanisms to maintain long-term access. The campaign uses multiple social engineering lures, such as voicemail notifications and purchase order themes, to target a broad range of industries globally. The threat actors behind this campaign have built an adaptable delivery ecosystem that can bypass defenses and maintain footholds across diverse environments. The use of multiple RATs and obfuscation techniques indicates a modular and flexible attack infrastructure designed for stealth and persistence. The campaign is ongoing and global, with no specific affected software versions noted, and no known public exploits beyond the phishing vector. The threat is rated medium severity by the source, reflecting its complexity and potential impact but also the requirement for user interaction and phishing delivery.

Detailed information about Phishing Campaign Targeting Companies via UpCrypter. Get real-time updates, technical details, and mitigation strategies.

Phishing Campaign Targeting Companies via UpCrypter - Live Threat Intelligence - Threat Radar | OffSeq.com

Phishing Campaign Targeting Companies via UpCrypter

Threats Tagged 'global campaign'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'global campaign'

Lead Pen Test Professional