Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Today we are introducing the second actor in this series, Prolific Puma. For four years, maybe longer, Prolific Puma has operated in the shadows, unrecognized by defenders. While we don’t know their origin story, we can detect Prolific Puma through DNS and get a glimpse into their character via their domain name registration choices. What’s in the name? Prolific comes from the simple fact that this is a network that is continually expanding, with new domains registered almost daily. As for Puma, well… we’ll share more about the inspiration later in this paper.

Prolific Puma is an emerging cybercrime actor identified through its use of a shadowy link shortening service that has operated undetected for over four years. The actor continuously registers new domains, leveraging DNS infrastructure to facilitate malicious campaigns. This link shortening service is abused to mask malicious URLs, enabling phishing, malware delivery, and social engineering attacks. The campaign tactics align with MITRE ATT&CK techniques such as T1199 (Trusted Relationship), T1204 (User Execution), T1056 (Input Capture), and T1566 (Phishing). By exploiting user trust in shortened links, Prolific Puma can redirect victims to credential harvesting sites or malware payloads. The actor’s domain registration patterns and DNS behaviors provide detection opportunities, although the network’s continual expansion complicates defense. No direct software vulnerabilities or exploits have been reported, indicating the threat relies on social engineering and infrastructure abuse rather than technical exploits. The stealthy nature and persistent domain registration activity suggest a well-resourced and adaptive adversary. This campaign represents a significant risk vector for organizations relying on DNS and URL filtering for security, as the dynamic domain landscape challenges traditional detection methods.

Detailed information about Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime. Get real-time updates, technical details, and mitigation strategie

Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime - Live Threat Intelligence - Threat Radar | OffSeq.com

Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime

Threats Tagged 'link shortener'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'link shortener'

Lead Pen Test Professional