Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Kaspersky Security Blog

Check Point Research

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

SANS ISC Handlers Diary

SecurityWeek

Dark Reading

Threatpost

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis delves into the operations of DeceptiveDevelopment, a North Korea-aligned threat actor, and its connections to North Korean IT worker campaigns. The group targets software developers across major systems, focusing on cryptocurrency and Web3 projects. They use social engineering techniques like fake job offers and the ClickFix method to deliver malware. Their toolset includes multiplatform malware such as BeaverTail, InvisibleFerret, WeaselStore, and TsunamiKit. The group shows links to other North Korean cyber operations through shared malware like Tropidoor and AkdoorTea. The analysis also explores the activities of North Korean IT workers, who use stolen identities and AI-generated content to secure remote jobs, highlighting the interconnected nature of these cyber threats.

The threat campaign attributed to the North Korea-aligned threat actor group known as DeceptiveDevelopment represents a sophisticated and evolving cyber espionage and theft operation targeting software developers, particularly those involved in cryptocurrency and Web3 projects. This group employs advanced social engineering tactics, including fake job offers and the ClickFix method, to trick victims into executing malware. Their malware toolset is diverse and multiplatform, comprising BeaverTail, InvisibleFerret, WeaselStore, and TsunamiKit, which enable remote access, information theft, and persistence on victim systems. The campaign also reveals operational links to other North Korean cyber operations through shared malware families such as Tropidoor and AkdoorTea, indicating a coordinated and resourceful adversary. Notably, the group leverages AI-generated content and stolen identities to infiltrate remote work environments, exploiting the growing trend of remote employment to gain footholds in target organizations. The campaign’s indicators include multiple IP addresses and a .onion domain, suggesting the use of anonymized infrastructure for command and control. The tactics, techniques, and procedures (TTPs) align with MITRE ATT&CK techniques such as credential dumping (T1056.001), user execution via social engineering (T1204.002, T1566.001, T1566.002), masquerading (T1036), process injection (T1055), and remote access (T1078), among others. This campaign highlights the increasing sophistication of North Korean cyber operations, combining traditional crypto theft with AI-based deception to evade detection and maximize impact.

Detailed information about From primitive crypto theft to sophisticated AI-based deception. Get real-time updates, technical details, and mitigation strategies.

From primitive crypto theft to sophisticated AI-based deception - Live Threat Intelligence - Threat Radar | OffSeq.com

DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception

A 2D platformer game called BlockBlasters on Steam has been infected with malware disguised as a patch. The malicious update, released on August 30, 2025, contains files that exhibit multiple malicious behaviors, including stealing crypto wallet data and other sensitive information from users' PCs. The infection process involves multiple stages, including a trojan stealer batch file, VBS loaders, and the main payload consisting of a backdoor and the StealC stealer malware. The campaign affects hundreds of players who have installed the game. The malware collects IP and location information, detects installed antivirus products, gathers login credentials, and uploads data to command and control servers. The game has since been removed from Steam, but not before causing significant damage to unsuspecting users.

The security threat involves a malicious campaign targeting users of the 2D platformer game "BlockBlasters" available on the Steam platform. On August 30, 2025, a malicious patch was distributed disguised as a legitimate game update. This patch contains a multi-stage malware infection chain beginning with a trojan stealer batch file and VBS loaders, ultimately delivering a backdoor and the StealC stealer malware. The malware is designed to steal sensitive information, particularly targeting cryptocurrency wallet data, but also harvesting other credentials and system information. It collects IP addresses and geolocation data, detects installed antivirus software to potentially evade detection, and gathers login credentials from the infected machines. The stolen data is then exfiltrated to attacker-controlled command and control (C2) servers. Hundreds of players who installed the infected game version were affected before the game was removed from Steam. The malware employs various techniques including process injection, credential dumping, and obfuscation, as indicated by the associated MITRE ATT&CK techniques (e.g., T1113, T1056.001, T1082, T1140, T1555, T1055, T1087, T1083, T1571, T1027, T1059.003, T1059.005). Although the game has been removed, the impact on affected users remains significant due to potential financial theft and privacy breaches. No CVE or known exploits in the wild are reported, but the infection vector via a popular gaming platform and the targeting of cryptocurrency assets highlight the threat's sophistication and potential for harm.

Detailed information about Infected Steam game "BlockBlasters" downloads crypto stealer malware. Get real-time updates, technical details, and mitigation strate

Infected Steam game "BlockBlasters" downloads crypto stealer malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Infected Steam game "BlockBlasters" downloads crypto stealer malware

The TAOTH campaign leveraged an abandoned Sogou Zhuyin IME update server and spear-phishing operations to deliver multiple malware families, primarily targeting users across Eastern Asia. Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or login pages, to distribute malware and collect sensitive information. The campaign focused on high-value targets, including dissidents, journalists, researchers, and technology/business leaders in China, Taiwan, Hong Kong, Japan, South Korea, and overseas Taiwanese communities. Infrastructure and tool analysis link TAOTH to previously documented threat activity, showing shared C&C infrastructure, malware variants, and tactics indicative of a single, persistent attacker group with a focus on reconnaissance, espionage, and email abuse.

The TAOTH campaign is a sophisticated cyber-espionage operation targeting primarily Traditional Chinese users and dissidents across Eastern Asia, including China, Taiwan, Hong Kong, Japan, South Korea, and overseas Taiwanese communities. The attackers exploit an abandoned Sogou Zhuyin IME update server to deliver malware through hijacked software updates, combined with spear-phishing tactics that use fake cloud storage or login pages to deceive victims. Multiple malware families are deployed, with infection chains designed to evade detection and maintain persistence. The campaign focuses on high-value targets such as dissidents, journalists, researchers, and technology or business leaders, indicating a strategic intent for reconnaissance, espionage, and information theft. The TAOTH group demonstrates advanced operational security and reuse of infrastructure, malware variants, and tactics consistent with a persistent threat actor. Techniques employed include spear-phishing (T1566), software update hijacking (T1574.002), command and control communications (T1071), and persistence mechanisms (T1547.001). The campaign leverages end-of-support software, which is no longer maintained or patched, increasing the attack surface. Although no known exploits in the wild are reported, the campaign’s use of abandoned infrastructure and targeted social engineering makes it a credible threat. The campaign’s complexity and targeting suggest a well-resourced actor focused on long-term intelligence gathering rather than opportunistic attacks.

Detailed information about TOATH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents. Get real-time updates, technical 

TOATH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents - Live Threat Intelligence - Threat Radar | OffSeq.com

TOATH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

The APT-C-55 (Kimsuky) group, a North Korean threat actor, has launched a new attack campaign targeting South Korea. They used a disguised Bandizip installation package to deliver malicious code and a VMP-protected HappyDoor trojan for espionage activities. The attack involves remote script loading, multi-stage malware deployment, and information theft. The malware collects sensitive data, including user information, system details, and files from specific directories. It also implements keylogging, screen capture, and mobile device monitoring functionalities. The attack methodology and infrastructure align with Kimsuky's historical patterns, including the use of similar scripts, backdoor families, and domain naming conventions.

The threat detailed involves the APT-C-55 group, also known as Kimsuky, a North Korean state-sponsored advanced persistent threat actor. This group has initiated a new espionage campaign primarily targeting South Korea, leveraging a sophisticated multi-stage malware attack. The initial infection vector is a disguised Bandizip installation package, which serves as a trojanized delivery mechanism for the HappyDoor backdoor malware. HappyDoor is protected by VMP (VMProtect), a strong shell obfuscation technology designed to hinder reverse engineering and detection efforts. The attack chain involves remote script loading and multi-stage deployment, enabling the malware to evade early detection and maintain persistence. Once deployed, HappyDoor conducts extensive information theft operations, including harvesting user credentials, system information, and files from targeted directories. It also incorporates advanced surveillance capabilities such as keylogging, screen capturing, and monitoring of mobile devices connected to the infected system. The attack infrastructure and methodologies align with Kimsuky’s historical tactics, techniques, and procedures (TTPs), including the use of similar scripting techniques, backdoor families, and domain naming conventions. Indicators of compromise include multiple file hashes, IP addresses, and suspicious domains linked to the campaign. The malware leverages a variety of MITRE ATT&CK techniques such as T1113 (Screen Capture), T1547 (Boot or Logon Autostart Execution), T1082 (System Information Discovery), T1071 (Application Layer Protocol), T1053 (Scheduled Task), T1005 (Data from Local System), T1140 (Deobfuscate/Decode Files or Information), T1055 (Process Injection), T1059 (Command and Scripting Interpreter), T1083 (File and Directory Discovery), T1074 (Data Staged), T1571 (Non-Standard Port), T1027 (Obfuscated Files or Information), T1056 (Input Capture), T1012 (Query Registry), and T1132 (Data Encoding). This campaign demonstrates a high level of operational security and technical sophistication, emphasizing espionage and data exfiltration objectives.

Detailed information about Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell. Get real-time updates, technical d

Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell

A critical vulnerability named DanaBleed was discovered in DanaBot's C2 server, causing memory leaks from June 2022 to early 2025. This bug, introduced in version 2380, exposed sensitive information including threat actor details, server data, and victim credentials. The leak resulted from uninitialized memory in the C2 protocol update. Researchers gained insights into DanaBot's operations, infrastructure, and affiliates. In May 2025, law enforcement dismantled DanaBot's infrastructure and indicted 16 individuals in Operation Endgame. The blog details the technical analysis of the vulnerability, its impact, and the type of data exposed through the memory leak.

DanaBot is a malware-as-a-service platform primarily engaged in cybercrime activities such as banking fraud and information theft. A critical vulnerability, named DanaBleed, was discovered in the Command and Control (C2) server infrastructure of DanaBot. This vulnerability was introduced in version 2380 of the C2 server software and caused a memory leak due to uninitialized memory during a C2 protocol update. The memory leak persisted from June 2022 until early 2025, inadvertently exposing sensitive internal data including threat actor identities, server infrastructure details, and victim credentials. This flaw was a result of poor memory management in the C2 server’s protocol implementation, leading to inadvertent disclosure of critical data. The vulnerability did not require active exploitation in the wild but was an internal bug within the malware’s own infrastructure. Security researchers and law enforcement leveraged this leak to gain unprecedented insight into DanaBot’s operations, infrastructure, and affiliates. This intelligence gathering culminated in Operation Endgame in May 2025, where law enforcement dismantled DanaBot’s infrastructure and indicted 16 individuals. The malware employs a sophisticated and multi-faceted attack framework, utilizing various MITRE ATT&CK techniques such as Windows Management Instrumentation (T1047), External Remote Services (T1133), Application Layer Protocol (T1071), process injection (T1055), credential dumping (T1003), and phishing (T1566), among others. While the vulnerability primarily affected the DanaBot C2 server infrastructure rather than victim endpoints directly, the leaked data included victim credentials, amplifying risks to affected organizations. No direct exploits of this vulnerability were observed in the wild, but the exposure significantly undermined the threat actor’s operational security and exposed their internal mechanisms.

Detailed information about DanaBot C2 Server Memory Leak Bug. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'information theft'

Filter Threats

Scan a website for live threats in under a minute

Threats Tagged 'information theft'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility