Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Over the course of three months, Volexity observed UTA0388 using various themes and fictional identities across dozens of spear phishing campaigns. As time passed, Volexity observed UTA0388 broaden their targeting and send emails in a variety of different languages, including English, Chinese, Japanese, French, and German. In most cases, the initial email sent by UTA0388 contained a link to phishing content hosted on a cloud-based service that would lead to malware.

The UTA0388 threat actor has been observed conducting targeted spear phishing campaigns over a three-month period, utilizing large language models (LLMs) to generate convincing and diverse phishing emails. These emails employ various fictional identities and themes, sent in multiple languages including English, Chinese, Japanese, French, and German, to broaden their reach and evade detection. The initial phishing emails typically contain links to cloud-hosted phishing sites that serve malware payloads. The malware uses PowerShell scripts and achieves persistence through scheduled tasks and hijacking execution flows. Command and control communications leverage advanced techniques such as WebSocket-based Govershell C2 channels, enabling stealthy and resilient remote control. The malware delivery often involves archive files (ZIP, RAR) to bypass security controls. The threat actor employs a wide range of MITRE ATT&CK techniques including T1071 (Application Layer Protocol), T1102 (Web Service), T1123 (Audio Capture), T1134 (Access Token Manipulation), T1036 (Masquerading), T1105 (Ingress Tool Transfer), T1059 (Command and Scripting Interpreter), T1574 (Hijack Execution Flow), T1053 (Scheduled Task), and T1566 (Phishing). Although no known exploits are currently in the wild, the campaign demonstrates a sophisticated blend of social engineering and technical exploitation, leveraging LLMs to enhance phishing effectiveness and evade traditional detection methods. The use of multiple languages and cloud infrastructure indicates a broad targeting strategy, likely aiming at high-value organizations globally, including Europe.

MD5 of fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861

SHA1 of fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861

Detailed information about APT Meets GPT: Targeted Operations with Untamed LLMs. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'govershell c2'

Filter Threats

Scan a website for live threats in under a minute

Threats Tagged 'govershell c2'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility