Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, BlackBasta, and Qilin groups. CountLoader was recently employed in a phishing campaign targeting Ukrainian citizens, impersonating the Ukrainian police. The loader attempts to connect to multiple C2 servers, downloads and executes various malware payloads, and uses advanced techniques to evade detection. It has been observed dropping CobaltStrike and AdaptixC2, among other malicious tools. The malware's functionality includes system information gathering, persistence mechanisms, and multiple download methods.

CountLoader is a newly identified malware loader associated with Russian ransomware groups, notably linked to affiliates of LockBit, BlackBasta, and Qilin ransomware operations. It is distributed in three distinct versions: .NET, PowerShell, and JScript, allowing it to adapt to different target environments and evade detection. The loader is primarily used as an initial access tool, either by Initial Access Brokers (IABs) or ransomware affiliates, to establish footholds in victim networks. CountLoader has been observed in phishing campaigns targeting Ukrainian citizens, masquerading as official Ukrainian police communications to increase the likelihood of user interaction and infection. Once executed, CountLoader attempts to connect to multiple command and control (C2) servers to download and execute additional malicious payloads, including CobaltStrike and AdaptixC2, which are known for their capabilities in post-exploitation, lateral movement, and persistence. The loader incorporates advanced evasion techniques such as obfuscation, use of multiple download methods, and system information gathering to tailor its payload delivery and maintain persistence. It also employs various persistence mechanisms consistent with MITRE ATT&CK techniques like scheduled tasks (T1053.005) and registry run keys (T1547.001). The malware’s multi-language implementation (.NET, PowerShell, JScript) increases its versatility and complicates detection by traditional antivirus and endpoint detection systems. Although no known exploits are currently reported in the wild, the threat’s association with high-profile ransomware groups and its use in targeted phishing campaigns underscore its potential for significant operational impact.

CC=US ASN=AS61272 informacines sistemos ir technologijos  uab

MD5 of 4cb6ec9522d8c1315cd3a2985d2204c634edc579b08a1b132254bd7dd5df72d8

SHA1 of 4cb6ec9522d8c1315cd3a2985d2204c634edc579b08a1b132254bd7dd5df72d8

MD5 of d34ca886266b7ce5f75f4caaa6e48f61e194bb55605c2bc4032ba8af5580b2e7

MD5 of 233c777937f3b0f83b1f6ae47403e03d1c3f72f650b4c6ae3facec7f2e5da4b5

SHA1 of d34ca886266b7ce5f75f4caaa6e48f61e194bb55605c2bc4032ba8af5580b2e7

SHA1 of 233c777937f3b0f83b1f6ae47403e03d1c3f72f650b4c6ae3facec7f2e5da4b5

CC=US ASN=AS21769 colocation america corporation

CC=US ASN=AS61317 digital energy technologies ltd.

Detailed information about CountLoader: New Malware Loader Being Served in 3 Different Versions. Get real-time updates, technical details, and mitigation strate

Threats Tagged 'jscript'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'jscript'

Lead Pen Test Professional