Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A phishing campaign targeting Ukrainian government entities uses malicious SVG files to initiate an infection chain. The attack begins with emails containing SVG attachments that redirect victims to a download site. A CHM file is then used to execute a remote HTA loader, which delivers two malware payloads: Amatera Stealer and PureMiner. Amatera Stealer harvests extensive information from infected systems, including credentials, system data, application data, browser files, and cryptocurrency wallets. PureMiner collects hardware information and monitors system activity to deploy efficient CPU or GPU mining modules. The campaign demonstrates sophisticated techniques, including fileless malware delivery and the use of multiple stages to evade detection.

This threat describes a sophisticated phishing campaign targeting Ukrainian government entities that leverages malicious SVG (Scalable Vector Graphics) files as the initial infection vector. The attack begins with emails containing SVG attachments, which when opened, redirect victims to a malicious download site. From there, a CHM (Compiled HTML Help) file is downloaded and executed, which in turn runs a remote HTA (HTML Application) loader. This multi-stage infection chain ultimately delivers two distinct malware payloads: Amatera Stealer and PureMiner.

Amatera Stealer is an information-stealing malware that harvests a wide range of sensitive data from infected systems. This includes user credentials, system and application data, browser files, and cryptocurrency wallet information, posing a significant risk to confidentiality and privacy. PureMiner is a cryptomining malware that collects hardware details and monitors system activity to optimize the deployment of CPU or GPU mining modules, thereby degrading system performance and increasing operational costs.

The campaign employs advanced evasion techniques such as fileless malware delivery and multiple infection stages to avoid detection by traditional antivirus and endpoint security solutions. The use of SVG files as a phishing vector is notable because SVGs are often overlooked as potentially malicious, allowing the attackers to bypass some email security filters. The combination of credential theft and cryptomining indicates a dual-purpose campaign aimed at both espionage and financial gain.

Indicators of compromise include numerous file hashes and malicious domains associated with the campaign, which can be used for detection and blocking. The attack chain leverages known tactics such as phishing (T1566), execution through HTA files (T1218.001), fileless techniques (T1055), and persistence mechanisms (T1547), highlighting the threat actor's sophistication and operational security.

Detailed information about SVG Phishing hits Ukraine with Amatera Stealer, PureMiner. Get real-time updates, technical details, and mitigation strategies.

SVG Phishing hits Ukraine with Amatera Stealer, PureMiner - Live Threat Intelligence - Threat Radar | OffSeq.com

SVG Phishing hits Ukraine with Amatera Stealer, PureMiner

Threats Tagged 'hta loader'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'hta loader'

Lead Pen Test Professional