Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

MystRodX is a sophisticated backdoor discovered in June 2025, featuring stealth and flexibility. It uses multi-layer encryption for sensitive information and can operate in active or passive modes. The backdoor supports file management, port forwarding, reverse shell, and socket management. Its passive mode can be activated by specific DNS or ICMP packets. Analysis reveals a dual-process guardian mechanism and configurable communication protocols. Three active command and control servers were identified, indicating ongoing threat activity. The backdoor's low detection rate and long-term presence in networks since January 2024 highlight its effectiveness in evading security measures.

MystRodX is a sophisticated backdoor malware discovered in June 2025, notable for its stealth capabilities and operational flexibility. It employs multi-layer encryption to protect sensitive data, complicating detection and forensic analysis. The backdoor can function in two distinct modes: an active mode that allows direct interaction and control, and a passive mode triggered by specific network packets, namely DNS queries or ICMP packets. This dual-mode operation enables attackers to maintain covert persistence and evade traditional network monitoring tools. The malware supports a wide range of functionalities including file management, port forwarding, reverse shell access, and socket management, providing attackers with comprehensive control over compromised systems. A unique feature is its dual-process guardian mechanism, which likely ensures persistence and self-protection by monitoring and restarting malicious processes if terminated. Communication with command and control (C2) servers is configurable, enhancing operational security and adaptability. The identification of three active C2 servers indicates ongoing malicious activity. MystRodX has demonstrated a low detection rate and has been present in networks since January 2024, highlighting its effectiveness in evading security measures over an extended period. The malware's use of encrypted communications, stealth triggers, and process guardianship aligns with advanced persistent threat (APT) tactics, making it a significant concern for targeted organizations.

Detailed information about The Covert Dual-Mode Backdoor Threat. Get real-time updates, technical details, and mitigation strategies.

The Covert Dual-Mode Backdoor Threat - Live Threat Intelligence - Threat Radar | OffSeq.com

The Covert Dual-Mode Backdoor Threat

Threats Tagged 'icmp trigger'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'icmp trigger'

Lead Pen Test Professional