Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A multistage malware campaign targeting Minecraft users has been discovered, distributed through the Stargazers Ghost Network on GitHub. The malware impersonates popular Minecraft mods and cheats, using a Java-based downloader that evades detection. The infection chain includes multiple stages: a Java loader, a Java stealer, and a .NET stealer. The malware steals gaming credentials, browser data, cryptocurrency wallets, and other sensitive information. The campaign, likely of Russian origin, exploits the popularity of Minecraft mods to spread malware, highlighting the risks in gaming communities. Over 1500 potential infections have been recorded based on Pastebin hits.

This threat describes a multistage malware campaign targeting Minecraft users, distributed via the Stargazers Ghost Network on GitHub. The attackers distribute fake Minecraft mods and cheats that impersonate popular legitimate mods, leveraging the widespread popularity of Minecraft to propagate malware. The infection chain consists of multiple stages: initially, a Java-based downloader (loader) is executed, which evades detection mechanisms. This loader subsequently downloads and executes a Java stealer component, followed by a .NET stealer module. These components work together to exfiltrate sensitive user data, including gaming credentials, browser data, cryptocurrency wallets, and other personal information. The malware uses techniques such as code obfuscation and multi-stage loading to avoid detection and analysis. The campaign is attributed to a likely Russian origin and has recorded over 1500 potential infections based on Pastebin activity. Indicators of compromise include multiple file hashes and IP addresses linked to Russian and Bulgarian networks. The malware employs tactics consistent with known MITRE ATT&CK techniques such as credential dumping (T1555), input capture (T1056.001), command and scripting interpreter usage (T1059.007), data from local system (T1005), and obfuscated files or information (T1027). The campaign highlights the risks posed by malicious actors exploiting gaming communities and third-party mod distribution platforms, especially those hosted on public repositories like GitHub.

MD5 of 71dd32d338811a15f5c5cd595a84c9c21c15ef3a

SHA256 of 71dd32d338811a15f5c5cd595a84c9c21c15ef3a

Detailed information about Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data. Get real-time updates, technical details, and 

Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data - Live Threat Intelligence - Threat Radar | OffSeq.com

Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data

Threats Tagged 'minecraft mods'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'minecraft mods'

Lead Pen Test Professional