Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A cluster of suspicious activity, tracked as CL-STA-1020, has been targeting governmental entities in Southeast Asia since late 2024. The threat actors have developed a new Windows backdoor called HazyBeacon, which uses AWS Lambda URLs for command and control communication. This technique leverages legitimate cloud functionality to create a covert, scalable, and hard-to-detect communication channel. The attackers' primary goal appears to be covert intelligence gathering, focusing on sensitive government data related to trade disputes. They also use Google Drive and Dropbox for data exfiltration, blending with normal network traffic. The attack involves DLL sideloading, persistence through a Windows service, and various payloads for file collection and exfiltration.

The threat identified as CL-STA-1020 represents a sophisticated cyber espionage campaign targeting governmental entities primarily in Southeast Asia since late 2024. The attackers have developed a novel Windows backdoor named HazyBeacon that employs an innovative command and control (C2) communication technique leveraging AWS Lambda URLs. This approach exploits legitimate cloud infrastructure to establish a covert, scalable, and difficult-to-detect communication channel, effectively blending malicious traffic with normal cloud service usage. The backdoor uses DLL sideloading to execute malicious payloads, ensuring persistence by installing itself as a Windows service. The attackers deploy various payloads designed for file collection and exfiltration, utilizing popular cloud storage services such as Google Drive and Dropbox to exfiltrate sensitive data. This method further obfuscates malicious activity by mimicking legitimate network traffic patterns. The primary objective appears to be covert intelligence gathering focused on sensitive government information, particularly related to trade disputes. The attack chain involves multiple advanced techniques including process injection, credential access, obfuscation, and use of trusted cloud services for C2 and data exfiltration, as indicated by the MITRE ATT&CK tags such as T1053.005 (Scheduled Task/Job), T1560.001 (Archive Collected Data), T1132.001 (Data Encoding), T1071.004 (Application Layer Protocol: DNS), and others. No known public exploits or CVEs are associated with this backdoor yet, but the threat actor demonstrates significant operational security and sophistication. The use of cloud services for C2 and exfiltration complicates detection and mitigation efforts, requiring enhanced monitoring of cloud service usage and network traffic analysis to identify anomalous patterns.

Detailed information about Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication. Get real-time updates, 

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication - Live Threat Intelligence - Threat Radar | OffSeq.com

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads. The threat actor employs various evasion techniques including API hashing, direct syscalls, DLL sideloading, and self-deletion. Google Drive is abused as a command-and-control server. While attribution remains uncertain, similarities with Winnti, Lazarus, and APT10 techniques have been observed. The campaign has been active since December 2024 and is expected to continue with new implants targeting additional applications.

The Swan Vector campaign is a sophisticated Advanced Persistent Threat (APT) operation targeting educational institutions and mechanical engineering sectors primarily in Taiwan and Japan. The attack employs a multi-stage infection chain beginning with malicious LNK (Windows shortcut) files that serve as the initial infection vector. Upon execution, these LNK files trigger the loading of DLL implants named Pterois and Isurus. These implants leverage advanced evasion techniques such as API hashing, which obfuscates API calls to avoid detection by security tools; direct syscalls, which bypass user-mode hooks; DLL sideloading, where malicious DLLs are loaded by legitimate applications to evade detection; and self-deletion to remove traces post-execution. The implants facilitate the deployment of Cobalt Strike payloads, a well-known post-exploitation framework used for lateral movement, persistence, and command and control (C2). Notably, the threat actor abuses Google Drive as a C2 server, leveraging a trusted cloud service to evade network-based detection and filtering. Although attribution is uncertain, the tactics, techniques, and procedures (TTPs) share similarities with known APT groups such as Winnti, Lazarus, and APT10, indicating a high level of sophistication and potential state-sponsored backing. Active since December 2024, the campaign is expected to evolve with new implants targeting additional applications, suggesting ongoing and adaptive threat activity.

Detailed information about Targeting Taiwan & Japan with DLL Implants. Get real-time updates, technical details, and mitigation strategies.

Targeting Taiwan & Japan with DLL Implants - Live Threat Intelligence - Threat Radar | OffSeq.com

Targeting Taiwan & Japan with DLL Implants

This analysis covers APT attacks detected in South Korea during April 2025. Spear phishing emerged as the primary distribution method for these attacks. Two main types of spear phishing were observed: Type A, which uses LNK files to distribute compressed malicious scripts for information leakage and additional malware downloads, and Type B, which executes RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks often employ decoy documents and target specific individuals or groups with crafted emails. Various file names were used to disguise the malicious content, often mimicking official documents or applications. The report highlights the sophisticated nature of these APT attacks and their potential impact on South Korean targets.

The April 2025 Threat Trend Report details a series of advanced persistent threat (APT) attacks primarily targeting South Korea, with spear phishing as the main distribution vector. Two spear phishing variants were identified: Type A uses malicious LNK shortcut files that execute compressed scripts designed to leak sensitive information and download additional malware payloads. Type B spear phishing campaigns deploy Remote Access Trojans (RATs), specifically XenoRAT and RoKRAT, leveraging legitimate cloud storage APIs such as Dropbox and Google Drive to execute malicious code. These attacks employ decoy documents and carefully crafted emails to target specific individuals or groups, often mimicking official documents or applications to increase the likelihood of engagement. The use of LNK files is notable because they can execute code without triggering traditional executable file detection, while the exploitation of trusted cloud services complicates detection and response efforts. Indicators of compromise include multiple malware file hashes, IP addresses, and domains linked to command and control infrastructure. Although no known exploits in the wild have been reported, the sophistication and stealth of these campaigns suggest a well-resourced adversary focused on espionage, information exfiltration, and establishing long-term persistence within victim networks. The attacks utilize various MITRE ATT&CK techniques such as spear phishing attachments (T1566.001), execution through LNK files (T1204.002), use of cloud services for command and control (T1102.002), and obfuscation (T1027). The campaign’s focus on RAT deployment and information leakage poses significant risks to confidentiality, integrity, and availability of targeted systems.

Detailed information about April 2025 Threat Trend Report on APT Attacks (South Korea). Get real-time updates, technical details, and mitigation strategies.

April 2025 Threat Trend Report on APT Attacks (South Korea) - Live Threat Intelligence - Threat Radar | OffSeq.com

April 2025 Threat Trend Report on APT Attacks (South Korea)

This analysis explores the detection of malicious .desktop files used by threat actors to infect Linux systems. It explains the structure of these files and how they are manipulated to obfuscate malicious content. The report details the execution process of these files, which often involve opening PDF files from Google Drive as a distraction while downloading malware. Various threat hunting techniques are presented, including searching for specific processes, command lines, and file contents. The article provides several Google Threat Intelligence queries for identifying suspicious .desktop files and related malicious activities. It also includes a list of recently discovered samples potentially linked to a campaign reported by Zscaler.

This threat involves the use of malicious .desktop files to compromise Linux systems. .desktop files are configuration files used by Linux desktop environments such as GNOME, KDE, and XFCE to define how applications are launched, including their icons, names, and execution commands. Threat actors manipulate these files to embed obfuscated malicious commands that execute malware payloads when the user interacts with them. A common tactic observed is the use of these .desktop files to open seemingly benign PDF documents hosted on Google Drive, serving as a distraction or social engineering lure. Meanwhile, in the background, the malicious .desktop file initiates the download and execution of malware, effectively bypassing casual user scrutiny. The obfuscation techniques employed in these files complicate detection, as the malicious commands are hidden within legitimate-looking desktop entry syntax. The report outlines various threat hunting methodologies, including searching for suspicious process names, command-line arguments, and specific file content patterns associated with these malicious .desktop files. It also provides Google Threat Intelligence queries to identify such files and related malicious activities. The campaign appears to be ongoing, with recently discovered samples linked to a Zscaler-reported campaign, although no known exploits are currently in the wild. The threat primarily targets Linux desktop environments, leveraging common user behaviors and trusted cloud services like Google Drive to facilitate infection.

MD5 of b6170fd0a1a75e043cd412300db4c67a351f71a6

MD5 of 040711b2e577fcdba8dc130f72475935893e8471

SHA256 of b6170fd0a1a75e043cd412300db4c67a351f71a6

SHA256 of 040711b2e577fcdba8dc130f72475935893e8471

Detailed information about Actionable threat hunting with Threat Intelligence (I) - Hunting malicious desktop files. Get real-time updates, technical details, a

Title	Severity	Type	Source	Date

Threats Tagged 'google drive'

Filter Threats

Threats Tagged 'google drive'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility