Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

MicroWorld Technologies has confirmed that one of its update servers was breached and used to distribute a malicious update to some customers in the early hours of January 2026, reports BleepingComputer.

In January 2026, MicroWorld Technologies confirmed that one of its eScan antivirus update servers was compromised by threat actors who injected malicious code into the software update process. This breach allowed the distribution of a malicious update to some customers, effectively turning a trusted update channel into a vector for malware delivery. The attack aligns with MITRE ATT&CK technique T1553 (Create or Modify System Process), indicating manipulation of middleware or update components to maintain persistence and potentially execute backdoors. The malicious update likely contained code that could establish unauthorized access or control over infected systems. Indicators of compromise include URLs such as http://codegiant.io/dd/dd/dd.git/download/main/middleware.ts and domains like 504e1a42.host.njalla.net and vhs.delrosal.net, which were used to host or control the malicious payload. Although no widespread exploitation is currently reported, the incident highlights the risks inherent in supply chain attacks, where trusted software distribution mechanisms are subverted. The lack of a CVSS score necessitates an independent severity assessment, considering the potential impact on confidentiality, integrity, and availability, as well as the ease of exploitation via automatic updates. The attack's medium severity rating reflects the partial scope and limited known exploitation but does not diminish the criticality of supply chain compromises. The breach underscores the importance of verifying update authenticity and monitoring network traffic for anomalous connections to suspicious domains.

Detailed information about eScan confirms update server breached to push malicious update. Get real-time updates, technical details, and mitigation strategies.

eScan confirms update server breached to push malicious update - Live Threat Intelligence - Threat Radar | OffSeq.com

eScan confirms update server breached to push malicious update

Threats Tagged 'middleware'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'middleware'

Lead Pen Test Professional