Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Cisco Talos has identified new cyber attacks targeting Turkey, the Arabian peninsula and other Asian countries from an Iranian-linked group known as MuddyWater, which is believed to be operating under the same umbrella of threat actors.

The threat actor group known as MuddyWater, linked to Iran, has been identified by Cisco Talos as conducting cyber attacks primarily targeting Turkey, the Arabian Peninsula, and other Asian countries. MuddyWater is considered an advanced persistent threat (APT) group operating under a conglomerate of regionally focused subgroups. Their operations involve the use of malware and various tactics, techniques, and procedures (TTPs) associated with espionage and cyber intrusion campaigns. The group employs multiple attack vectors including malicious documents (maldocs), PowerShell and Windows Script File (WSF) based payloads, and leverages techniques such as command execution (T1059), privilege escalation (T1134), spear-phishing (T1566), persistence mechanisms (T1547), remote access (T1102), system service exploitation (T1047), and exploitation of software vulnerabilities (T1203). These TTPs indicate a sophisticated approach to infiltrate targeted networks, maintain persistence, and exfiltrate sensitive data. Although no specific affected software versions or known exploits in the wild have been reported, the group's activity is consistent with espionage campaigns aimed at gathering intelligence and potentially disrupting critical infrastructure or government operations. The threat is categorized as medium severity, reflecting the moderate but significant risk posed by the group’s capabilities and regional focus.

MD5 of 4b2862a1665a62706f88304406b071a5c9a6b3093daadc073e174ac6d493f26c

MD5 of ef385ed64f795e106d17c0a53dfb398f774a555a9e287714d327bf3987364c1b

MD5 of 026868713d60e6790f41dc7046deb4e6795825faa903113d2f22b644f0d21141

MD5 of f10471e15c6b971092377c524a0622edf4525acee42f4b61e732f342ea7c0df0

MD5 of 6e50e65114131d6529e8a799ff660be0fc5e88ec882a116f5a60a2279883e9c4

MD5 of c2badcdfa9b7ece00f245990bb85fb6645c05b155b77deaf2bb7a2a0aacbe49e

SHA1 of ef385ed64f795e106d17c0a53dfb398f774a555a9e287714d327bf3987364c1b

SHA1 of 6e50e65114131d6529e8a799ff660be0fc5e88ec882a116f5a60a2279883e9c4

SHA1 of c2badcdfa9b7ece00f245990bb85fb6645c05b155b77deaf2bb7a2a0aacbe49e

SHA1 of 026868713d60e6790f41dc7046deb4e6795825faa903113d2f22b644f0d21141

SHA1 of f10471e15c6b971092377c524a0622edf4525acee42f4b61e732f342ea7c0df0

SHA1 of 4b2862a1665a62706f88304406b071a5c9a6b3093daadc073e174ac6d493f26c

48e75909520f1a19a8a2cfc34ed5938c69750af7966f40bdf3a2d340a0ca98ad

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detailed information about Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups. Get real-time updates, technical details, and mitig

Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups - Live Threat Intelligence - Threat Radar | OffSeq.com

Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups

The IRS Doc Malware is a low-severity malware threat primarily delivered via spearphishing attachments, specifically malicious documents (maldocs). The attack chain begins with a targeted spearphishing email containing a weaponized document designed to exploit user trust and induce execution. Upon opening the document, the malware leverages scripting techniques, including PowerShell commands and command-line interface execution, to run malicious payloads. Persistence is achieved through modification of registry run keys or placing scripts in startup folders, ensuring the malware executes on system reboot. The malware also utilizes Background Intelligent Transfer Service (BITS) jobs to facilitate stealthy and reliable data transfer or command execution. Network communication is conducted over commonly used ports and employs standard cryptographic protocols to evade detection and secure command and control (C2) communications. The malware's tactics align with several MITRE ATT&CK techniques such as T1193 (spearphishing attachment), T1059 (command-line interface), T1086 (PowerShell), T1064 (scripting), T1060 (registry run keys/startup folder), T1197 (BITS jobs), T1043 (commonly used port), and T1032 (standard cryptographic protocol). No specific affected software versions are identified, and no patches are available, indicating the malware exploits social engineering and scripting rather than software vulnerabilities. There are no known exploits in the wild beyond the spearphishing vector, and no detailed indicators of compromise (IOCs) are provided. The overall impact is limited by the low severity rating, but the malware's use of multiple persistence and evasion techniques makes it a credible threat in targeted environments.

Detailed information about IRS Doc Malware. Get real-time updates, technical details, and mitigation strategies.


Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups 0 Cisco Talos has identified new cyber attacks targeting Turkey, the Arabian peninsula and other Asian countries from an Iranian-linked group known as MuddyWater, which is believed to be operating under the same umbrella of threat actors. MediumMalwareTurkeyUnited KingdomGermany+3#apt #muddywater #iran Join the discussion	AlienVault OTX General	03/10/2022, 15:49:08 UTC Added: 09/26/2025, 12:45:01 UTC
IRS Doc Malware 0 IRS Doc Malware LowMalwareGermanyFranceUnited Kingdom+6#misp-galaxy:mitre-attack-pattern="spearphishing attachment - t1193"#misp-galaxy:mitre-attack-pattern="command-line interface - t1059"#misp-galaxy:mitre-attack-pattern="powershell - t1086" Join the discussion	CIRCL OSINT Feed	02/16/2020, 00:00:00 UTC Added: 05/28/2025, 02:59:44 UTC

Threats Tagged 'maldoc'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'maldoc'

Lead Pen Test Professional