Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The provided information references Ryuk ransomware and associated threat activity but explicitly states that the specific IOC mentioned is a false positive with no valid detection on VirusTotal. Ryuk ransomware is a known threat linked to the UNC1878 adversary group and often associated with other malware like TrickBot and Cobalt Strike. Despite the false positive IOC, Ryuk remains a significant ransomware threat targeting organizations globally, including in Europe. It typically involves rapid encryption of critical systems and demands high ransom payments, severely impacting confidentiality, integrity, and availability. The threat is medium severity here due to the false positive nature of the IOC, but Ryuk itself is considered high severity in real-world contexts. European organizations, especially in countries with high digital infrastructure and critical industries, are at risk. Mitigation involves advanced detection of Ryuk-related activity, network segmentation, and incident response readiness. Countries like Germany, France, the UK, Italy, and the Netherlands are most likely affected due to their economic profiles and past ransomware targeting. Given the false positive IOC, the suggested severity for this specific report is medium, but vigilance against Ryuk ransomware remains critical.

Ryuk ransomware is a sophisticated and highly impactful ransomware strain attributed to the UNC1878 threat actor group. It is often deployed following initial access via malware such as TrickBot or through the use of Cobalt Strike for lateral movement and payload delivery. Ryuk encrypts critical files on infected systems, demanding substantial ransom payments in cryptocurrency. The provided report, however, clarifies that the specific IOC referenced is a false positive, with a 0 KB file size and a hash corresponding to a simple string, thus not representing a real threat indicator. Despite this, Ryuk remains a persistent threat with documented cases of rapid encryption campaigns that can complete within hours, severely disrupting organizational operations. The threat is well-documented by multiple cybersecurity entities, including US-CERT and Palo Alto Networks Unit 42, highlighting its use in targeted attacks against healthcare, government, and enterprise sectors. The ransomware's association with other malware like TrickBot and Kegtap indicates a multi-stage attack process involving initial compromise, lateral movement, and final payload deployment. The lack of known exploits in the wild for this specific IOC and the false positive nature reduce the immediate risk from this report, but the overall Ryuk threat landscape remains critical for defenders to monitor.

Detailed information about Ryuk Ransomware and Associated Threat Activity. Get real-time updates, technical details, and mitigation strategies.

Ryuk Ransomware and Associated Threat Activity - Live Threat Intelligence - Threat Radar | OffSeq.com

Ryuk Ransomware and Associated Threat Activity

Threats Tagged 'kegtap'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'kegtap'

Lead Pen Test Professional