Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The LevelBlue Managed Detection and Response team handled incidents related to a malvertising campaign distributing trojanized versions of the PuTTY terminal emulator. The malicious software, masquerading as legitimate PuTTY, was downloaded by privileged users and exhibited behaviors such as Kerberoasting, suspicious PowerShell execution, and persistence via scheduled tasks. The threat actors used sponsored ads on search engines to deliver the malware, which was signed by various entities and utilized multiple domains for distribution. The campaign highlights the importance of following security best practices across all organizational levels and emphasizes the need for robust verification mechanisms in advertising networks to prevent abuse.

This threat involves a malvertising campaign distributing trojanized versions of the PuTTY terminal emulator, a widely used SSH and telnet client favored by system administrators and IT professionals. The malicious PuTTY binaries are delivered via sponsored ads on search engines, tricking privileged users into downloading and executing compromised software. Once installed, the malware exhibits advanced behaviors including Kerberoasting—an attack technique targeting Kerberos tickets to escalate privileges or move laterally within Active Directory environments. It also performs suspicious PowerShell executions, which are often used to execute scripts or commands stealthily, and establishes persistence through scheduled tasks, ensuring the malware remains active after system reboots. The malware is signed by various entities to appear legitimate and uses multiple domains for distribution, complicating detection and takedown efforts. This campaign underscores the risks posed by supply chain attacks and the exploitation of advertising networks to deliver malware to high-value targets. The use of trojanized administrative tools like PuTTY is particularly dangerous because it leverages the trust and privileges associated with these tools, enabling attackers to gain deep access to enterprise networks. The campaign highlights the necessity for organizations to implement strict software verification processes, monitor for anomalous PowerShell activity, and scrutinize advertising sources to prevent similar infections.

Detailed information about Like PuTTY in Admin's Hands. Get real-time updates, technical details, and mitigation strategies.

Like PuTTY in Admin's Hands - Live Threat Intelligence - Threat Radar | OffSeq.com

Like PuTTY in Admin's Hands

Threats Tagged 'kerberoasting'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'kerberoasting'

Lead Pen Test Professional