Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An APT group named Earth Kurma is actively targeting government and telecommunications organizations in Southeast Asia, particularly in the Philippines, Vietnam, Thailand, and Malaysia. The campaign, which dates back to November 2020, employs advanced custom malware, rootkits, and cloud storage services for data exfiltration. Earth Kurma utilizes sophisticated tools like TESDAT, SIMPOBOXSPY, KRNRAT, and MORIYA, demonstrating adaptive malware toolsets and complex evasion techniques. The attackers focus on lateral movement, persistence, and data collection, using various utilities to scan infrastructures and deploy malware. They also employ rootkits to maintain stealth and bypass detection. The group's primary objective appears to be cyberespionage, with a high risk of sensitive data compromise and prolonged, undetected network access.

The Earth Kurma APT campaign is a sophisticated cyberespionage operation targeting government and telecommunications sectors primarily in Southeast Asia, including the Philippines, Vietnam, Thailand, and Malaysia. Active since November 2020, this threat actor employs a range of advanced custom malware tools such as TESDAT, SIMPOBOXSPY, KRNRAT, and MORIYA. These tools enable the group to conduct stealthy operations including lateral movement within networks, persistence through rootkits, and extensive data collection and exfiltration. The use of rootkits allows Earth Kurma to maintain long-term undetected access by evading traditional detection mechanisms. The attackers leverage cloud storage services to exfiltrate sensitive data, complicating attribution and detection. Their tactics include scanning infrastructure to identify valuable targets, deploying malware payloads, and exploiting various techniques mapped to MITRE ATT&CK tactics such as credential access (T1078), persistence (T1547), privilege escalation (T1055), and command and control (T1071). The campaign’s complexity and adaptive toolset indicate a well-resourced and skilled adversary focused on intelligence gathering rather than immediate disruption. Although no known public exploits are reported, the campaign’s longevity and stealth capabilities pose a significant threat to the confidentiality and integrity of targeted organizations’ data.

MD5 of 8414136128f73fa7e29032df7b8115bc89832c57e2602d81de1e520cc2d7958d

MD5 of b26e8e0be066ee0b86f8fb2b0a703717ebbf34c8a33ef9a6f8f164ad012f1746

MD5 of 66edb72f6f7c8cad23c6659a81fa023f57c1a86c7d7b7022f1453b177f2b3670

MD5 of 1ab42121bb45028a17a3438b65a3634adb7d673a4e1291efeabf227a4e016cfb

SHA1 of 66edb72f6f7c8cad23c6659a81fa023f57c1a86c7d7b7022f1453b177f2b3670

SHA1 of 1ab42121bb45028a17a3438b65a3634adb7d673a4e1291efeabf227a4e016cfb

SHA1 of b26e8e0be066ee0b86f8fb2b0a703717ebbf34c8a33ef9a6f8f164ad012f1746

SHA1 of 8414136128f73fa7e29032df7b8115bc89832c57e2602d81de1e520cc2d7958d

Detailed information about Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors. Get real-time updates, technical details, and mitigatio

Threats Tagged 'krnrat'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'krnrat'

Lead Pen Test Professional