Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated ClickFix campaign has been uncovered, compromising legitimate websites to deliver a multi-stage malware chain. The attack culminates in MIMICRAT, a custom remote access trojan with advanced capabilities. The campaign uses compromised sites across industries and geographies for delivery, employing a five-stage PowerShell chain that bypasses security measures before deploying a Lua-scripted shellcode loader. MIMICRAT, the final payload, is a native C++ RAT featuring malleable C2 profiles, Windows token theft, and SOCKS5 proxy functionality. The attack chain involves multiple compromised websites, obfuscated scripts, and sophisticated evasion techniques, demonstrating a high level of operational sophistication.

The MIMICRAT ClickFix campaign represents a highly sophisticated cyberattack that compromises legitimate websites across various industries and regions to serve as infection vectors. The attack unfolds through a multi-stage process beginning with a five-stage PowerShell chain designed to bypass security controls and evade detection. This chain ultimately deploys a Lua-scripted shellcode loader, which then loads MIMICRAT, a custom-built native C++ remote access trojan. MIMICRAT is engineered with advanced capabilities including malleable C2 profiles that allow flexible command-and-control communication, Windows token theft to escalate privileges and impersonate users, and SOCKS5 proxy functionality enabling attackers to route traffic through infected hosts for stealth and lateral movement. The campaign leverages obfuscated scripts and multiple compromised websites, complicating detection and attribution. The use of legitimate websites for delivery increases the likelihood of successful infection as users and security tools may trust these sites. The campaign’s indicators include specific domains such as xmri.network, investonline.in, and wexmri.cc, along with numerous file hashes and an IP address (45.13.212.250). The attack techniques align with MITRE ATT&CK tactics including process injection (T1055), scheduled task execution (T1053), obfuscated files or information (T1562), and user execution (T1204). Despite no known exploits in the wild or CVSS score, the campaign’s operational sophistication and multi-stage evasion techniques mark it as a significant threat.

MD5 of a508d0bb583dc6e5f97b6094f8f910b5b6f2b9d5528c04e4dee62c343fce6f4b

SHA1 of a508d0bb583dc6e5f97b6094f8f910b5b6f2b9d5528c04e4dee62c343fce6f4b

Detailed information about MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites. Get real-time updates, technical details, and mi

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites - Live Threat Intelligence - Threat Radar | OffSeq.com

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

Threats Tagged 'mimicrat'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'mimicrat'

Lead Pen Test Professional