Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The 'HijackServer' malicious IIS module is actively compromising IIS servers by exploiting exposed ASP . NET machine keys, enabling unauthenticated remote command execution. This threat, attributed to the RudePanda group, uses a customized rootkit and off-the-shelf tools to maintain persistent access. While primarily used to manipulate search engine results for cryptocurrency scams, the module's capabilities allow attackers or third parties to conduct espionage or build malicious infrastructure. Hundreds of servers worldwide have been affected, indicating a broad impact. The exploitation does not require authentication, and the attack leverages a critical misconfiguration or exposure of sensitive cryptographic keys. European organizations running IIS with exposed ASP . NET machine keys are at risk, especially those in countries with high IIS usage and strategic value. Mitigation requires immediate review and protection of ASP . NET machine keys, deployment of advanced monitoring for rootkit activity, and hardening of IIS configurations.

The 'HijackServer' malware is a sophisticated malicious IIS module discovered by AlienVault, attributed to the RudePanda threat actor. It targets IIS servers by exploiting exposed ASP .NET machine keys, which are cryptographic keys used to secure data such as ViewState, authentication tokens, and other encrypted information within ASP .NET applications. Exposure or leakage of these keys allows attackers to decrypt, forge, or manipulate sensitive data, enabling unauthorized access. The attackers deploy a customized rootkit alongside ready-made tools to gain and maintain persistent access to compromised servers. The rootkit hides the presence of the malware and any malicious activities, complicating detection and remediation efforts. The module enables unauthenticated remote command execution, meaning attackers do not need valid credentials or user interaction to execute arbitrary commands on the server. The primary motivation appears to be search engine optimization (SEO) manipulation to promote cryptocurrency scams, but the malware’s capabilities allow for broader malicious use, including espionage and infrastructure development by third parties. Hundreds of IIS servers globally have been compromised, indicating a widespread campaign. The attack leverages multiple MITRE ATT&CK techniques such as T1218.011 (signed binary proxy execution), T1055 (process injection), T1562.002 (impair defences: disable or modify tools), and others, reflecting a multi-faceted and persistent threat. No specific affected IIS versions are listed, but the reliance on exposed ASP .NET machine keys suggests that servers with weak or improperly managed cryptographic key configurations are vulnerable. No known public exploits have been reported yet, but the threat’s presence in the wild and ease of exploitation pose significant risks.

Detailed information about IIS servers owned by RudePanda like it's 2003. Get real-time updates, technical details, and mitigation strategies.

IIS servers owned by RudePanda like it's 2003 - Live Threat Intelligence - Threat Radar | OffSeq.com

IIS servers owned by RudePanda like it's 2003

Threats Tagged 'hijackdrivermanager'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'hijackdrivermanager'

Lead Pen Test Professional