Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

ThreatFox MISP Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A targeted campaign has been observed since November 2024, primarily affecting organizations in France and Luxembourg. The attackers use socially engineered emails to deliver PDF documents containing embedded links to Remote Monitoring and Management (RMM) tool installers. This method bypasses many email and malware defenses. The PDFs are tailored to the victim's industry and often disguised as invoices, contracts, or property listings. The activity focuses on high-value sectors such as energy, government, banking, and construction. Various RMM tools are used, including FleetDeck, Atera, and Bluetrait. The attackers leverage direct download links and tools that require minimal setup, streamlining the infection process. This approach allows threat actors to gain initial access, disable security features, and potentially deploy subsequent malware using trusted tools.

This threat involves a targeted phishing campaign observed since November 2024, primarily impacting organizations in France and Luxembourg. Attackers send socially engineered emails containing PDF attachments that embed links to installers for Remote Monitoring and Management (RMM) tools such as FleetDeck, Atera, and Bluetrait. These PDFs are carefully crafted to appear as legitimate business documents—such as invoices, contracts, or property listings—tailored to the victim's industry to increase the likelihood of interaction. Upon opening the PDF, victims are encouraged to click embedded links that initiate the download and installation of RMM software. This method bypasses many traditional email and malware defenses because the initial payload is delivered via a trusted document format and the subsequent tools are legitimate RMM applications, which are often whitelisted or trusted by endpoint security solutions. The attackers leverage direct download links and minimal setup requirements of these RMM tools to streamline infection and reduce detection risk. Once installed, the RMM tools provide the attackers with remote access capabilities, enabling them to disable security features and deploy additional malware or conduct further malicious activities. The campaign targets high-value sectors including energy, government, banking, and construction, which are critical infrastructure and economically significant industries. The use of legitimate RMM tools for initial access reflects a sophisticated approach that blends social engineering with abuse of trusted software to evade detection and maintain persistence.

Detailed information about Email-Delivered RMM: Abusing PDFs for Silent Initial Access. Get real-time updates, technical details, and mitigation strategies.

Email-Delivered RMM: Abusing PDFs for Silent Initial Access - Live Threat Intelligence - Threat Radar | OffSeq.com

Email-Delivered RMM: Abusing PDFs for Silent Initial Access

Threats Tagged 'luxembourg'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'luxembourg'

Lead Pen Test Professional