Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The IRS Doc Malware is a low-severity malware threat primarily delivered via spearphishing attachments, specifically malicious documents (maldocs). The attack chain begins with a targeted spearphishing email containing a weaponized document designed to exploit user trust and induce execution. Upon opening the document, the malware leverages scripting techniques, including PowerShell commands and command-line interface execution, to run malicious payloads. Persistence is achieved through modification of registry run keys or placing scripts in startup folders, ensuring the malware executes on system reboot. The malware also utilizes Background Intelligent Transfer Service (BITS) jobs to facilitate stealthy and reliable data transfer or command execution. Network communication is conducted over commonly used ports and employs standard cryptographic protocols to evade detection and secure command and control (C2) communications. The malware's tactics align with several MITRE ATT&CK techniques such as T1193 (spearphishing attachment), T1059 (command-line interface), T1086 (PowerShell), T1064 (scripting), T1060 (registry run keys/startup folder), T1197 (BITS jobs), T1043 (commonly used port), and T1032 (standard cryptographic protocol). No specific affected software versions are identified, and no patches are available, indicating the malware exploits social engineering and scripting rather than software vulnerabilities. There are no known exploits in the wild beyond the spearphishing vector, and no detailed indicators of compromise (IOCs) are provided. The overall impact is limited by the low severity rating, but the malware's use of multiple persistence and evasion techniques makes it a credible threat in targeted environments.

Detailed information about IRS Doc Malware. Get real-time updates, technical details, and mitigation strategies.

IRS Doc Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

IRS Doc Malware

Threats Tagged 'misp-galaxy:mitre-attack-pattern="registry run keys / startup folder - t1060"'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'misp-galaxy:mitre-attack-pattern="registry run keys / startup folder - t1060"'

Lead Pen Test Professional