Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Between June and December 2025, state-sponsored threat group Lotus Blossom compromised the hosting infrastructure for Notepad++, allowing them to intercept and redirect update traffic. This enabled selective targeting of users primarily in Southeast Asian government, telecommunications and critical infrastructure sectors. Two infection chains were identified - one using Lua script injection to deliver Cobalt Strike and another using DLL side-loading for a Chrysalis backdoor. The campaign affected additional sectors across South America, US, Europe and Southeast Asia including cloud hosting, energy, financial, government, manufacturing and software development. The attack exploited insufficient verification in older versions of the Notepad++ updater to serve malicious installers to targeted victims.

The threat involves a sophisticated supply chain compromise of the Notepad++ software update infrastructure by the state-sponsored group Lotus Blossom between June and December 2025. By compromising the hosting infrastructure, the attackers were able to intercept and redirect update traffic, selectively delivering malicious installers to targeted victims. The attack exploited older versions of the Notepad++ updater that lacked sufficient verification mechanisms, allowing the insertion of malicious payloads without detection. Two distinct infection chains were identified: one leveraging Lua script injection to deploy Cobalt Strike, a widely used post-exploitation framework, and another using DLL side-loading to install the Chrysalis backdoor, enabling persistent remote access. The campaign primarily targeted Southeast Asian government, telecommunications, and critical infrastructure sectors but also impacted organizations in South America, the US, Europe, and Southeast Asia across cloud hosting, energy, financial, government, manufacturing, and software development sectors. The attackers' selective targeting and use of advanced malware tools indicate a high level of operational capability and intent to maintain stealth and persistence. The lack of a CVSS score notwithstanding, the attack's exploitation of a trusted software update mechanism and deployment of sophisticated malware poses significant risks to confidentiality, integrity, and availability of affected systems. The campaign underscores the critical importance of securing software supply chains and implementing robust update verification processes.

Detailed information about Nation-State Actors Exploit Notepad++ Supply Chain. Get real-time updates, technical details, and mitigation strategies.

Nation-State Actors Exploit Notepad++ Supply Chain - Live Threat Intelligence - Threat Radar | OffSeq.com

Nation-State Actors Exploit Notepad++ Supply Chain

Threats Tagged 'infrastructure hijacking'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'infrastructure hijacking'

Lead Pen Test Professional