Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Pakistan-linked APT group conducted two campaigns targeting Indian government entities. The Gopher Strike campaign used PDFs with malicious links to deliver an ISO file containing GOGITTER, a Golang downloader that fetches payloads from private GitHub repositories. GITSHELLPAD, a Golang backdoor, was used for C2 communication via GitHub. GOSHELL, a Golang shellcode loader, deployed Cobalt Strike Beacon on specific hostnames. The attackers used various techniques including scheduled tasks for persistence, obfuscation, and environmental keying. Post-compromise activities involved system reconnaissance and data exfiltration. The campaign demonstrated sophisticated TTPs and custom-built tools, indicating a potentially new subgroup or parallel Pakistan-linked threat actor.

This threat involves a Pakistan-linked advanced persistent threat group, APT36, conducting targeted cyber espionage campaigns against Indian government entities. The attackers use a multi-stage infection chain starting with weaponized PDFs containing malicious links that deliver ISO files. These ISO files deploy GOGITTER, a downloader written in Golang, which retrieves additional payloads from private GitHub repositories, leveraging GitHub as a covert command and control (C2) infrastructure. GITSHELLPAD, another Golang-based backdoor, facilitates C2 communication through GitHub, enabling stealthy command execution and data exfiltration. GOSHELL, a Golang shellcode loader, is used to deploy Cobalt Strike Beacon on specific hostnames, providing the attackers with a powerful post-exploitation framework for lateral movement, persistence, and further reconnaissance. The attackers utilize scheduled tasks for persistence, obfuscation techniques to hinder analysis, and environmental keying to ensure payloads execute only in intended environments, reducing the risk of detection. Post-compromise activities include system reconnaissance (e.g., gathering system information and network details) and data exfiltration, indicating espionage objectives. The use of Golang for malware development enhances cross-platform capabilities and complicates detection due to less common signatures. The campaign's sophistication and custom tooling suggest the emergence of a new subgroup or parallel actor within the Pakistan-linked APT ecosystem. No public exploits are currently known, and the campaign is ongoing as of early 2026.

Detailed information about APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1. Get real-time updates, technical details, and

APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1 - Live Threat Intelligence - Threat Radar | OffSeq.com

APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1

Threats Tagged 'goshell'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'goshell'

Lead Pen Test Professional