Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This multi-stage fileless Remcos RAT attack leverages a phishing-delivered JavaScript dropper to trigger a reflective PowerShell loader that executes payloads entirely in memory. The infection chain utilizes obfuscation techniques like rotational XOR and Base64 encoding to reconstruct .NET payloads, significantly reducing the disk-based detection footprint. Stealth is maintained by using aspnet_compiler.exe as a LOLBin to proxy malicious execution and dynamically retrieving the final payload from a remote C2 server.

The analyzed threat is a multi-stage, fileless attack leveraging the Remcos Remote Access Trojan (RAT), delivered via phishing emails containing a JavaScript dropper. Upon execution, the dropper triggers a reflective PowerShell loader that runs entirely in memory, avoiding writing malicious files to disk and thus evading traditional antivirus and endpoint detection systems. The attack chain uses obfuscation methods including rotational XOR and Base64 encoding to reconstruct .NET payloads dynamically, further complicating detection. A notable stealth technique involves abusing the legitimate Windows executable aspnet_compiler.exe as a Living Off the Land Binary (LOLBin) to proxy malicious execution, which helps bypass application whitelisting and monitoring tools. The final payload is not embedded locally but is dynamically fetched from a remote command and control (C2) server, enabling attackers to update or change payloads post-compromise. This approach allows attackers to maintain persistence, execute arbitrary commands, and potentially move laterally within the network. Indicators of compromise include multiple file hashes and domains/IPs linked to the C2 infrastructure. Although no active exploits in the wild have been reported, the use of phishing and fileless techniques is consistent with current attacker trends aiming for stealth and persistence. The attack targets Windows environments where PowerShell and .NET frameworks are present, and where aspnet_compiler.exe is available, typically in enterprise or development systems.

Detailed information about From Inbox to Intrusion: Multi‑Stage Remcos RAT and C2‑Delivered Payloads in Network. Get real-time updates, technical details, and m

From Inbox to Intrusion: Multi‑Stage Remcos RAT and C2‑Delivered Payloads in Network - Live Threat Intelligence - Threat Radar | OffSeq.com

From Inbox to Intrusion: Multi‑Stage Remcos RAT and C2‑Delivered Payloads in Network

Threats Tagged 'js dropper'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'js dropper'

Lead Pen Test Professional