Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A comprehensive analysis reveals a substantial threat posed by domains linked to Salt Typhoon and UNC4841, likely China-associated cyberespionage actors. The investigation uncovered a larger network of domain names beyond those publicly known, indicating a pattern of long-term access and sophisticated operations. A recent breach of a U.S.telecommunications provider, discovered a year after the fact, underscores the persistent nature of these threats. Organizations potentially at risk of Chinese espionage are strongly advised to scrutinize their DNS logs for the past five years, checking for requests to listed domains, subdomains, and associated IP addresses. Ongoing monitoring and information sharing are crucial in defending against this evolving threat landscape.

The threat described involves a sophisticated cyberespionage campaign attributed to the threat groups Salt Typhoon and UNC4841, which are likely associated with Chinese state-sponsored actors. This campaign is characterized by the use of an extensive network of domain names and subdomains beyond those publicly known, indicating a well-established and long-term infrastructure for persistent access. The actors employ advanced techniques to maintain covert communications and data exfiltration channels, leveraging domain infrastructure for command and control (C2) operations, as suggested by the referenced MITRE ATT&CK techniques such as T1071.004 (Application Layer Protocol: DNS), T1583.001 (Acquire Infrastructure: Domains), T1589.002 (Gather Victim Identity Information: Search Open Websites/Domains), T1568 (Dynamic Resolution), T1571 (Non-Standard Port), and T1590.001 (Gather Victim Network Information: DNS). The recent discovery of a breach in a U.S. telecommunications provider, identified only a year after the intrusion, highlights the stealth and persistence of these actors, emphasizing the difficulty in timely detection. The campaign targets telecommunications and potentially other critical infrastructure sectors, exploiting DNS logs and domain requests to maintain long-term access and espionage capabilities. Organizations at risk are advised to conduct retrospective analysis of DNS logs spanning up to five years to identify any interactions with the malicious domains or IP addresses linked to these actors. Continuous monitoring, threat intelligence sharing, and proactive defense measures are critical to mitigating the evolving threat landscape posed by these adversaries.

Detailed information about Significant Risk and Proactive Defense. Get real-time updates, technical details, and mitigation strategies.

Significant Risk and Proactive Defense - Live Threat Intelligence - Threat Radar | OffSeq.com

Significant Risk and Proactive Defense

Threats Tagged 'long-term access'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'long-term access'

Lead Pen Test Professional