Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated espionage campaign targeting Indian entities has been identified, masquerading as the Income Tax Department of India. The activity is associated with the SideWinder APT group, which has evolved its toolkit to evade detection by mimicking Chinese enterprise software. The campaign uses DLL side-loading techniques with legitimate Microsoft Defender binaries to bypass EDR, and utilizes public cloud storage and URL shorteners to evade reputation-based detections. The threat actors employ geofencing behavior, focusing on systems in South Asian timezones. The attack chain includes phishing emails, fraudulent websites, and malicious payloads delivered through file-sharing services. The final stage involves a resident agent that beacons to a command-and-control server, mimicking Chinese endpoint tool protocols.

The SideWinder APT campaign represents a highly targeted espionage effort primarily aimed at Indian organizations by masquerading as the Indian Income Tax Department to lure victims. The threat actors have evolved their toolkit to evade detection by mimicking legitimate Chinese enterprise software and leveraging DLL side-loading techniques involving authentic Microsoft Defender binaries, which allows them to bypass Endpoint Detection and Response (EDR) solutions that rely on binary reputation and signature-based detection. The campaign uses public cloud storage services and URL shorteners to obscure the origin and nature of malicious payloads, complicating detection by reputation-based security controls. The attack chain begins with phishing emails containing links to fraudulent websites or file-sharing services hosting the malware. The payloads include a resident agent that establishes persistence and communicates with command-and-control (C2) servers using protocols that imitate Chinese endpoint management tools, further obfuscating attribution and detection. Geofencing behavior restricts the malware’s execution to systems operating within South Asian time zones, reducing the likelihood of detection outside the target region. Although the campaign is focused on Indian targets, the use of globally accessible cloud infrastructure and common Microsoft Defender binaries means that organizations in Europe with business or personnel connections to South Asia, or those using similar software environments, could be at risk. The campaign does not currently have known exploits in the wild beyond targeted phishing and social engineering, and no patches are available as the attack leverages legitimate software features and social engineering rather than software vulnerabilities.

Detailed information about Evasive SideWinder APT Campaign Detected. Get real-time updates, technical details, and mitigation strategies.

Evasive SideWinder APT Campaign Detected - Live Threat Intelligence - Threat Radar | OffSeq.com

Evasive SideWinder APT Campaign Detected

Threats Tagged 'income tax department'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'income tax department'

Lead Pen Test Professional