Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The TAOTH campaign leveraged an abandoned Sogou Zhuyin IME update server and spear-phishing operations to deliver multiple malware families, primarily targeting users across Eastern Asia. Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or login pages, to distribute malware and collect sensitive information. The campaign focused on high-value targets, including dissidents, journalists, researchers, and technology/business leaders in China, Taiwan, Hong Kong, Japan, South Korea, and overseas Taiwanese communities. Infrastructure and tool analysis link TAOTH to previously documented threat activity, showing shared C&C infrastructure, malware variants, and tactics indicative of a single, persistent attacker group with a focus on reconnaissance, espionage, and email abuse.

The TAOTH campaign is a sophisticated cyber-espionage operation targeting primarily Traditional Chinese users and dissidents across Eastern Asia, including China, Taiwan, Hong Kong, Japan, South Korea, and overseas Taiwanese communities. The attackers exploit an abandoned Sogou Zhuyin IME update server to deliver malware through hijacked software updates, combined with spear-phishing tactics that use fake cloud storage or login pages to deceive victims. Multiple malware families are deployed, with infection chains designed to evade detection and maintain persistence. The campaign focuses on high-value targets such as dissidents, journalists, researchers, and technology or business leaders, indicating a strategic intent for reconnaissance, espionage, and information theft. The TAOTH group demonstrates advanced operational security and reuse of infrastructure, malware variants, and tactics consistent with a persistent threat actor. Techniques employed include spear-phishing (T1566), software update hijacking (T1574.002), command and control communications (T1071), and persistence mechanisms (T1547.001). The campaign leverages end-of-support software, which is no longer maintained or patched, increasing the attack surface. Although no known exploits in the wild are reported, the campaign’s use of abandoned infrastructure and targeted social engineering makes it a credible threat. The campaign’s complexity and targeting suggest a well-resourced actor focused on long-term intelligence gathering rather than opportunistic attacks.

Detailed information about TOATH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents. Get real-time updates, technical 

TOATH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents - Live Threat Intelligence - Threat Radar | OffSeq.com

TOATH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Threats Tagged 'gtelam'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'gtelam'

Lead Pen Test Professional