Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This research explores the challenges posed by LLM-enabled malware, which can generate malicious logic at runtime. The study identifies characteristics of such malware, including embedded API keys and specific prompt structures. Notable cases like PromptLock and APT28's LameHug are examined. The researchers developed hunting strategies based on API key detection and prompt analysis, leading to the discovery of new samples, including 'MalTerminal'. The implications for defenders are discussed, highlighting both the adaptability and potential brittleness of LLM-enabled malware. The research also uncovered various offensive tools leveraging LLMs for operational capabilities.

This threat concerns the emergence of LLM-enabled malware, a novel class of malicious software that leverages large language models (LLMs) to dynamically generate malicious logic at runtime. Unlike traditional malware with static payloads, LLM-enabled malware can adapt its behavior by generating code or commands on the fly based on embedded prompts and API keys. The research highlights specific malware families and campaigns such as PromptLock and APT28's LameHug, which utilize these techniques. These malware samples embed API keys within their code to interact with external LLM services, enabling them to craft sophisticated attack logic dynamically. The study also uncovered new samples like 'MalTerminal' that demonstrate the operational capabilities of LLM-powered offensive tools. The malware uses prompt engineering to control the LLM's output, effectively turning prompts into executable code segments. This approach increases malware adaptability and complexity, making detection and mitigation more challenging. The research team developed hunting strategies focusing on detecting embedded API keys and analyzing prompt structures to identify these threats. The findings underscore both the potential brittleness of LLM-enabled malware—due to reliance on external APIs and prompt design—and their adaptability, which can evade traditional signature-based defenses. The threat also involves tactics and techniques mapped to MITRE ATT&CK IDs such as T1071 (Application Layer Protocol), T1219 (Remote Access Software), T1059 (Command and Scripting Interpreter), T1083 (File and Directory Discovery), T1027 (Obfuscated Files or Information), T1486 (Data Encrypted for Impact), T1573 (Encrypted Channel), and T1588 (Obtain Capabilities), indicating a broad and sophisticated attack surface.

Detailed information about Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware. Get real-time updates, technical details, and mitigation strategi

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware

Threats Tagged 'malterminal'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'malterminal'

Lead Pen Test Professional