Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept.2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.

The threat involves a hacktivist group known as TwoNet, aligned with Russian interests, conducting targeted attacks against OT and ICS environments, specifically water treatment facilities. The attack was observed in September 2025 via a Forescout honeypot designed to mimic a water treatment plant. TwoNet gained unauthorized access to the human-machine interface (HMI), a critical control point in OT systems, allowing them to perform defacement, disrupt processes, manipulate operations, and evade detection. The attack chain includes exploitation of vulnerabilities (MITRE ATT&CK T1190), lateral movement through remote services (T1021), use of valid credentials (T1078), network reconnaissance (T1016.001), exploitation of Modbus protocol weaknesses (T1210), and data manipulation or destruction (T1464). The group also uses ransomware-as-a-service (RAAS) tools such as MegaMedusa and Overflame, indicating potential for ransomware deployment in OT environments. IP indicators span multiple countries, including Russia, Iran, Germany, and France, reflecting a geographically dispersed infrastructure supporting the attack. Although no active exploits are publicly known, the attack demonstrates the increasing risk posed by hacktivist groups targeting critical infrastructure with sophisticated tactics. The medium severity rating reflects the potential for operational disruption and safety risks inherent in OT/ICS compromises.

CC=IR ASN=AS58224 iran telecommunication company pjs

CC=IR ASN=AS197207 mobile communication company of iran plc

Detailed information about Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS. Get real-time updates, technical details, and mitigation s

Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS - Live Threat Intelligence - Threat Radar | OffSeq.com

Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS

Threats Tagged 'human-machine interface'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'human-machine interface'

Lead Pen Test Professional