Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

The 'Frozen in transit' campaign is an ongoing AI-powered Man-in-the-Middle (AiTM) attack attributed to the Russian advanced persistent threat (APT) group Turla. This campaign specifically targets diplomats, leveraging sophisticated network activity and payload delivery methods to intercept, manipulate, or exfiltrate sensitive communications. AiTM attacks typically involve intercepting authentication flows or communication channels to bypass multi-factor authentication and gain unauthorized access. Although no specific affected software versions or exploits are identified, the campaign's medium severity rating and lack of available patches indicate a complex threat that exploits operational or procedural weaknesses rather than software vulnerabilities. The campaign's attribution to Turla, a well-known espionage-focused actor, and its targeting of diplomats highlight its strategic intent to conduct espionage and intelligence gathering. The campaign was identified through OSINT sources with moderate confidence (50%), indicating ongoing monitoring is necessary. No direct indicators of compromise or technical signatures are provided, complicating detection efforts. The absence of known exploits in the wild suggests the campaign may rely on custom or targeted attack vectors, emphasizing the need for proactive defense measures. The campaign's focus on network activity and payload delivery suggests attackers may use phishing, compromised infrastructure, or network interception techniques to achieve their objectives. Given the geopolitical context and the targeting of diplomatic entities, this campaign represents a significant threat to the confidentiality and integrity of sensitive communications.

Actor-controlled domain that downloads the malware

kav-certificates.info: Enriched via the dns module

Detailed information about OSINT - Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats. Get real-time updates, technical details, and mitigatio

OSINT - Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

The threat involves two newly discovered Android spyware families attributed to the Russian Gamaredon APT group, as identified through OSINT by Lookout. Gamaredon is a known Russian state-sponsored threat actor group historically targeting Ukrainian entities and related interests. The spyware families are designed to operate on Android devices, likely aiming to conduct espionage by collecting sensitive information from infected mobile devices. Although specific technical details about the spyware capabilities, infection vectors, or payloads are not provided, the association with Gamaredon suggests these spyware families could be used for targeted surveillance, data exfiltration, and persistent access on compromised devices. The discovery is based on open-source intelligence with a moderate certainty level (50%), and no known exploits or patches are currently available. The campaign is categorized under network activity and payload delivery, indicating that the spyware is likely distributed through network-based vectors or social engineering. The severity is currently assessed as low, reflecting limited available details and no confirmed widespread exploitation. However, the presence of such spyware families highlights ongoing mobile threats from nation-state actors targeting Android platforms, which are widely used across Europe.

Detailed information about OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT. Get real-time updates, technical details, and miti

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT - Live Threat Intelligence - Threat Radar | OffSeq.com

AA24-249A: Russian Military Cyber Actors Target U.S.and Global Critical Infrastructure

This threat intelligence report details ongoing cyber operations attributed to Russian military cyber actors, specifically linked to the GRU (Russian Federation). These actors are targeting critical infrastructure sectors in the United States and globally, including Europe. The campaign involves a range of sophisticated attack patterns as indicated by numerous referenced STIX 2.1 attack pattern identifiers, which typically encompass tactics such as initial access, credential access, lateral movement, command and control, and impact techniques. Although the specific vulnerabilities or exploits used are not detailed, the focus on critical infrastructure suggests targeting of industrial control systems (ICS), operational technology (OT), and key network assets that support essential services. The threat is characterized by persistent and strategic cyber espionage and potential disruption activities aimed at undermining critical services. The lack of patch availability and known exploits in the wild indicates that the threat may rely on custom tools, zero-day exploits, or complex intrusion methods rather than widely known vulnerabilities. The severity is currently assessed as low by the source, but this may reflect the current observed impact rather than the potential risk. The threat actors’ use of multiple attack patterns and targeting of critical infrastructure highlights the potential for significant operational disruption, data exfiltration, or sabotage if successful. The intelligence certainty is moderate (50%), indicating some confidence in attribution and activity but with incomplete details. Overall, this represents a strategic cyber threat from a nation-state actor with significant capabilities and intent to impact critical infrastructure globally, including European organizations.

Detailed information about AA24-249A: Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Get real-time updates, technical details, an


OSINT - Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats 0 OSINT - Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats MediumCampaignGermanyFranceUnited Kingdom+4#misp-galaxy:producer="microsoft"#misp-galaxy:threat-actor="turla"#type:osint Join the discussion	CIRCL OSINT Feed	08/01/2025, 00:00:00 UTC Added: 08/01/2025, 15:47:34 UTC
OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT 0 OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT LowCampaignUkraineBelarusMoldova+7#misp-galaxy:country="russia"#misp-galaxy:threat-actor="gamaredon group"#type:osint Join the discussion	CIRCL OSINT Feed	12/16/2024, 00:00:00 UTC Added: 05/28/2025, 02:59:25 UTC
AA24-249A: Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure 0 AA24-249A: Russian Military Cyber Actors Target U.S.and Global Critical Infrastructure LowUnknownUkraineUnited KingdomGermany+8#tlp:white #misp-galaxy:stix-2.1-attack-pattern="7e6945c5-7f3b-55f6-bcb7-fa324c6bdaed"#misp-galaxy:stix-2.1-attack-pattern="cfbd0546-fbbe-50bc-9839-f5942a2351aa" Join the discussion	CIRCL OSINT Feed	09/06/2024, 00:00:00 UTC Added: 05/28/2025, 02:59:16 UTC

Threats Tagged 'misp-galaxy:country="russia"'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'misp-galaxy:country="russia"'

Lead Pen Test Professional