Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

XCTDH Crypto Heist Part 4 - Nick Smart and Andrii Sovershennyi

The XCTDH Crypto Heist Part 4 represents a sophisticated cyber threat attributed to North Korean threat actors, specifically involving the compromise of software supply chains and development tools. The attack techniques correspond to MITRE ATT&CK patterns T1195.001 (compromise software dependencies and development tools) and T1195.002 (compromise software supply chain), suggesting that attackers infiltrate trusted software components or development environments to insert malicious code or backdoors. This approach allows attackers to bypass traditional perimeter defenses by exploiting the trust placed in software dependencies and build pipelines. The use of application layer protocols (T1071) indicates that the attackers employ legitimate network protocols to communicate with compromised systems, facilitating stealthy command and control or data exfiltration. The threat is tagged with references to North Korea, implying state-sponsored activity with potential geopolitical motivations. No specific affected software versions or patches are currently identified, and no known exploits have been observed in the wild, indicating either a newly discovered campaign or ongoing reconnaissance. The lack of patch availability underscores the difficulty in mitigating supply chain attacks once the compromised components are integrated into production environments. The threat's medium severity rating likely reflects the current stage of exploitation and the complexity of the attack vector. However, the potential impact on confidentiality, integrity, and availability of affected systems is significant, especially for organizations relying heavily on third-party software components and development tools. The technical details provided are minimal, but the association with supply chain compromise highlights the need for rigorous software integrity checks and enhanced monitoring of development environments.

Detailed information about XCTDH Crypto Heist Part 4 - Nick Smart and Andrii Sovershennyi. Get real-time updates, technical details, and mitigation strategies.

XCTDH Crypto Heist Part 4 - Nick Smart and Andrii Sovershennyi - Live Threat Intelligence - Threat Radar | OffSeq.com

Sha1-Hulud is a newly identified cyber threat involving supply chain compromise and covert command and control (C2) communications using application layer protocols. Attackers exploit link-local IP addresses such as 169. 254. 169. 254 and 169. 254. 170. 2, commonly associated with cloud metadata services, to bypass perimeter defenses and blend malicious traffic with legitimate communications. A JavaScript component named bun_environment. js has been identified as part of the attack chain.

Sha1-Hulud represents a sophisticated cyber threat primarily characterized by supply chain compromise (MITRE ATT&CK T1195) and covert command and control (C2) communications leveraging application layer protocols (T1071). The threat actors exploit link-local IP addresses such as 169.254.169.254 and 169.254.170.2, which are typically reserved for cloud metadata services in environments like AWS. By abusing these IPs, attackers can circumvent traditional network perimeter defenses and blend malicious traffic with legitimate application layer communications, thereby evading detection. The attack chain includes a JavaScript component identified as bun_environment.js (hash 2711e7496f9943ad1fac508ef5665867), indicating the use of script-based methods for initial compromise or persistence. Currently, there are no specific affected product versions or patches, and no CVEs have been assigned, suggesting the threat is either newly discovered or under active investigation. The moderate certainty level (50%) and absence of known exploits in the wild imply limited current impact but highlight the need for vigilance. The supply chain compromise vector is particularly concerning as it can introduce malicious code into trusted software or services, potentially affecting a wide range of organizations. The use of application layer protocols for C2 communication complicates detection and response, allowing attackers to maintain prolonged presence and conduct further malicious activities. Overall, Sha1-Hulud combines stealth, supply chain infiltration, and cloud metadata service abuse, posing a credible threat to organizations reliant on cloud infrastructure and third-party software.

Detailed information about Sha1-Hulud - November 2025. Get real-time updates, technical details, and mitigation strategies.

Sha1-Hulud - November 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

Sha1-Hulud - November 2025

HardBit 4. 0 is a ransomware-related threat characterized by data encryption for impact, data compression, and exfiltration over command and control (C2) channels using application layer protocols. The investigation by Reyben Cortes highlights its use of sophisticated techniques to encrypt and compress data, then exfiltrate it stealthily. No specific affected versions or exploits in the wild are currently known, and no patches are available. The threat is assessed with medium severity due to its potential to disrupt data availability and confidentiality. European organizations, especially those with critical infrastructure or high-value data, could face significant operational and financial impacts if targeted. Mitigation requires enhanced network monitoring for anomalous encrypted traffic, strict segmentation of critical systems, and robust data backup strategies. Countries with advanced digital economies and critical infrastructure, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the lack of authentication or user interaction details, and the medium severity rating, organizations should prioritize detection and response capabilities to mitigate potential impacts.

HardBit 4.0 appears to be a ransomware or data-impacting malware variant investigated by Reyben Cortes, characterized by multiple MITRE ATT&CK techniques. It employs data encryption for impact (T1486), compresses data (T1002), and encrypts data (T1022) to hinder recovery and analysis. The malware uses application layer protocols (T1071) for communication, enabling command and control (C2) operations and exfiltration of data over these channels (T1041). This combination suggests a sophisticated threat capable of encrypting victim data to demand ransom while simultaneously compressing and exfiltrating sensitive information stealthily. The lack of identified affected versions or known exploits in the wild indicates it may be a newly discovered or emerging threat. No patches are available, implying that mitigation relies on detection and response rather than vulnerability remediation. The technical details provided are minimal, with no specific indicators of compromise (IOCs) or attack vectors disclosed. The medium severity rating reflects the potential for significant impact on data confidentiality and availability, balanced against the current absence of widespread exploitation evidence.

Detailed information about HardBit 4.0 Investigation by Reyben Cortes. Get real-time updates, technical details, and mitigation strategies.

HardBit 4.0 Investigation by Reyben Cortes - Live Threat Intelligence - Threat Radar | OffSeq.com

HardBit 4.0 Investigation by Reyben Cortes

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

The APT36 malware campaign is a targeted threat operation that utilizes a combination of social engineering and technical evasion techniques to infiltrate victim networks. The primary infection vector is phishing (MITRE T1566), where malicious desktop entry files are delivered to victims, often via Google Drive links, to bypass traditional email filtering and security controls. These desktop entry files act as a launcher for malicious scripts (T1064) that execute payloads on the victim’s system. The malware employs masquerading (T1036) and hides files and directories (T1564.001) to evade detection. Persistence is achieved through the creation or manipulation of Windows services (T1543.003), allowing the malware to survive reboots and maintain control. The attackers use binary padding (T1027.001) to obfuscate payloads and avoid signature-based detection. Brute force techniques (T1110) are used to gain access to additional systems or escalate privileges. The campaign also involves software discovery (T1518) to map the environment and identify valuable targets. Communication with command and control servers occurs over both application layer protocols (T1071) and non-application layer protocols (T1095), often utilizing non-standard ports (T1571) to evade network monitoring. Tools and additional payloads are transferred using ingress tool transfer techniques (T1105). The campaign is linked to the threat actor group Operation C-Major, known for targeting South Asian and European entities. No patches or direct fixes exist for this campaign, as it relies on social engineering and custom malware rather than exploiting software vulnerabilities. The campaign’s complexity and use of multiple evasion techniques make it a persistent threat requiring layered defense strategies.

seemysitelive.store: Enriched via the dns module

Detailed information about Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery. Get real-time updates, tech

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

The CERT-FR report details an ongoing cyber espionage campaign attributed to the Sandworm intrusion set, a threat actor group known for sophisticated and persistent attacks. This campaign specifically targets Centreon systems, which are widely used IT infrastructure monitoring solutions. The attackers exploit public-facing Centreon applications (MITRE ATT&CK T1190) to gain initial access, leveraging vulnerabilities or misconfigurations in these web-facing components. Once inside, the adversaries deploy server software components (T1505) and create or modify system processes (T1543) to establish persistence. They also schedule tasks or jobs (T1053) to maintain footholds and execute malicious payloads. The attackers use command and scripting interpreters (T1059) to execute arbitrary commands and abuse elevation control mechanisms (T1548) to escalate privileges. They perform file and directory discovery (T1083) to map the environment and deobfuscate or decode files (T1140) to analyze or prepare payloads. Communications with command and control (C2) servers are conducted over encrypted channels (T1573) using application layer protocols (T1071), enabling stealthy data exfiltration (T1041). The campaign is highly targeted, with a focus on French organizations, reflecting the strategic interest of the Sandworm group in this region. No patches are currently available for the exploited vulnerabilities, and no known exploits are publicly documented, indicating a potentially zero-day or custom exploit scenario. The campaign's sophistication and persistence suggest a high level of attacker capability and intent to maintain long-term access for espionage or sabotage purposes.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems. Get real-time updates, technical details, and m

CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems - Live Threat Intelligence - Threat Radar | OffSeq.com

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

The 3CX software supply chain compromise represents a sophisticated and multi-stage attack attributed to a suspected North Korean threat actor. This attack leverages a prior software supply chain compromise to infiltrate the 3CX software ecosystem, a widely used unified communications platform. The adversary employed advanced techniques including hijacking execution flow via DLL side-loading, process injection, and obfuscation to maintain persistence and evade detection. The attack chain involved the installation of fraudulent digital certificates to masquerade malicious payloads as legitimate software components, thereby bypassing security controls that rely on code signing verification. The threat actor also engaged in indicator removal tactics such as clearing Windows event logs and deleting files to hinder forensic investigations. Additionally, the attacker conducted extensive system reconnaissance activities including querying the registry, system information discovery, and environment profiling (system location and language discovery) to tailor their operations and avoid sandbox or debugger detection. Communication with command and control infrastructure was conducted over encrypted channels using application layer protocols, facilitating stealthy ingress tool transfers and data exfiltration. The malware families and tools associated with this compromise include PoolRat, IconicStealer, DaveShell, SigFlip, VeiledSignal, ColdCat, and TaxHaul, indicating a broad toolkit designed for espionage, credential theft, and lateral movement within compromised networks. Despite the absence of known exploits in the wild at the time of reporting, the complexity and depth of this supply chain attack pose a significant threat to organizations relying on the 3CX platform, especially given the supply chain vector which inherently undermines trust in software updates and distribution mechanisms.

Detailed information about 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible 

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - Live Threat Intelligence - Threat Radar | OffSeq.com

Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities

Prynt Stealer is a recently identified information-stealing malware campaign observed in the wild, primarily designed to perform clipper and keylogger activities. This malware targets user credentials and sensitive information by capturing keystrokes and manipulating clipboard data to intercept cryptocurrency wallet addresses or other copied sensitive data. The stealer leverages multiple MITRE ATT&CK techniques, including user execution (T1204), system and process discovery (T1497.001, T1057), account discovery (T1087), software discovery (T1518), and system service and location discovery (T1007, T1614). It also performs credential theft from password stores (T1555), steals web session cookies (T1539), and application access tokens (T1528), indicating a broad scope of data exfiltration. The malware captures screen content (T1113) and exfiltrates data over command and control (C2) channels and web services (T1041, T1567). Prynt Stealer’s infection vector relies on user execution, meaning it requires victims to run malicious files or scripts, often delivered via phishing or social engineering. Although no known exploits are currently reported in the wild, the malware’s capabilities to harvest credentials, session tokens, and clipboard data pose significant risks to confidentiality and integrity of user data. The campaign’s perpetual lifetime and moderate certainty level (50%) suggest ongoing monitoring is necessary. The absence of affected versions implies it targets general Windows environments rather than specific software vulnerabilities.

Detailed information about Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities. Get real-time updates, technical 

Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities - Live Threat Intelligence - Threat Radar | OffSeq.com

The CERT-FR report highlights an extended campaign by the Sandworm intrusion set targeting Centreon systems. Centreon is an IT infrastructure monitoring software widely used to oversee network, server, and application performance. The Sandworm group, known for its sophisticated cyber-espionage and sabotage operations, exploits public-facing Centreon applications to gain unauthorized access. The attack techniques align with MITRE ATT&CK patterns such as exploiting public-facing applications (T1190), leveraging server software components (T1505), and creating or modifying system processes (T1543) to establish persistence. The adversaries also use scheduled tasks or jobs (T1053) and command and scripting interpreters (T1059) to execute malicious payloads. They abuse elevation control mechanisms (T1548) to gain higher privileges and employ deobfuscation techniques (T1140) to evade detection. Post-compromise activities include file and directory discovery (T1083), establishing encrypted command and control channels (T1573), using application layer protocols for communication (T1071), and exfiltrating data over these channels (T1041). Although no specific affected versions or patches are listed, the campaign's high confidence and almost-certain likelihood suggest active targeting of Centreon deployments, particularly in France. The threat level is moderate (4), and no known exploits in the wild have been reported yet, indicating a potential for future exploitation if mitigations are not applied.

Detailed information about CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems affecting misp-galaxy target-information. Get re

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="application layer protocol - t1071"'

Stop chasing alerts. Route them.

Filter Threats