Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

In 2025, there was a significant increase in rogue ScreenConnect installations, part of a broader trend of threat actors abusing remote monitoring and management tools (RMMs). These tools were used to gain access, blend in, move laterally, and maintain persistence in target systems. Attackers employed various social engineering tactics to trick employees into downloading malicious RMMs. Common lures included fake Social Security statements, invitations, and financial documents. The Huntress Security Operations Center identified recurring patterns in lures, domains, and file hashes associated with these attacks. Some campaigns showed signs of targeting specific industries, such as accounting firms. The article provides detailed examples of attack patterns, top malicious domains, and file hashes observed throughout the year.

The threat involves the abuse of remote monitoring and management (RMM) tools, specifically rogue installations of ScreenConnect, by threat actors in 2025. These actors employ sophisticated social engineering tactics to deceive employees into installing malicious RMM clients, often using lures such as fake Social Security statements, invitations, and financial documents. Once installed, these rogue RMM tools provide attackers with remote access capabilities, allowing them to blend into legitimate administrative activities, move laterally within networks, and maintain persistence. The Huntress Security Operations Center has identified consistent patterns in the attack campaigns, including recurring malicious domains and file hashes, indicating organized and targeted operations. Some campaigns appear industry-specific, with accounting firms notably targeted, likely due to the sensitive financial data they handle. The tactics align with several MITRE ATT&CK techniques, including T1133 (External Remote Services), T1053 (Scheduled Task/Job), T1219 (Remote Access Software), T1036 (Masquerading), T1218 (Signed Binary Proxy Execution), T1059 (Command and Scripting Interpreter), T1204 (User Execution), T1566 (Phishing), T1078 (Valid Accounts), and T1105 (Ingress Tool Transfer). Although no known exploits in the wild have been reported, the threat represents a significant risk due to the combination of social engineering and the powerful capabilities of RMM tools. The lack of a CVSS score necessitates an assessment based on impact and exploitation factors, leading to a suggested severity of high. The threat is particularly relevant to organizations heavily reliant on RMM solutions and those with employees susceptible to social engineering, emphasizing the need for targeted defenses.

Detailed information about Rogue ScreenConnect: Common Social Engineering Tactics Seen in 2025. Get real-time updates, technical details, and mitigation strateg

Rogue ScreenConnect: Common Social Engineering Tactics Seen in 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

Rogue ScreenConnect: Common Social Engineering Tactics Seen in 2025

Threats Tagged 'lures'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'lures'

Lead Pen Test Professional