Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

UAT-8099 is a malware campaign active from August 2025 to early 2026 targeting vulnerable IIS servers, primarily in Asia, with a focus on Thailand and Vietnam. It uses web shells, PowerShell scripts, and the GotoHTTP tool to maintain persistent remote access. New BadIIS malware variants show enhanced persistence, regional customization, and SEO fraud capabilities, with a Linux ELF variant indicating cross-platform targeting. The campaign shares infrastructure with the WEBJACK campaign, suggesting operational overlap. Although no known exploits are reported in the wild, advanced evasion and persistence techniques pose risks to confidentiality, integrity, and availability. European organizations with exposed IIS servers, especially those with business ties to Asia, should be vigilant. Targeted detection of web shells, PowerShell abuse, and monitoring for GotoHTTP traffic are critical mitigations. Germany, France, and the UK are most likely affected due to IIS usage and strategic interests in Asia.

The UAT-8099 malware campaign, active from August 2025 through early 2026, targets vulnerable Microsoft IIS web servers, focusing primarily on Asian countries such as Thailand and Vietnam. The threat actor employs multiple sophisticated persistence mechanisms, including web shells and PowerShell scripts, to maintain long-term remote access. Additionally, the campaign utilizes the GotoHTTP tool, which facilitates covert command and control communications. New variants of the BadIIS malware family have been identified, exhibiting enhanced persistence capabilities, regional customization tailored to target geographies, and SEO fraud functionalities that manipulate search engine rankings for malicious benefit. Notably, a Linux ELF variant has been discovered, indicating the campaign’s expansion beyond Windows IIS servers to cross-platform environments. The campaign shares infrastructure and malware hashes with the WEBJACK campaign, implying operational overlap or shared threat actor resources. Despite the absence of publicly known exploits in the wild, the malware employs advanced evasion techniques such as obfuscated PowerShell commands, fileless persistence, and stealthy network communications to avoid detection by traditional security controls. The campaign’s tactics align with MITRE ATT&CK techniques including T1059.007 (PowerShell), T1547 (Boot or Logon Autostart Execution), and T1505.003 (Server Software Component), among others. The threat poses a medium severity risk, with potential impacts on confidentiality through data exfiltration, integrity via unauthorized modifications, and availability through potential service disruptions. European organizations operating IIS servers exposed to the internet, especially those with business or infrastructure ties to Asia, should be alert to this threat. Detection strategies should focus on identifying web shell signatures, monitoring anomalous PowerShell activity, and network traffic analysis for GotoHTTP communications. Given the campaign’s regional focus and infrastructure overlap, proactive threat hunting and incident response readiness are advised.

Detailed information about Dissecting UAT-8099: New persistence mechanisms and regional focus. Get real-time updates, technical details, and mitigation strategi

Dissecting UAT-8099: New persistence mechanisms and regional focus - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting UAT-8099: New persistence mechanisms and regional focus

Threats Tagged 'gotohttp'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'gotohttp'

Lead Pen Test Professional