Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

GrayCharlie, a threat actor active since mid-2023, compromises WordPress sites to inject links redirecting visitors to NetSupport RAT payloads via fake browser updates or ClickFix mechanisms. These infections often lead to Stealc and SectopRAT deployments. The group's infrastructure is primarily linked to MivoCloud and HZ Hosting Ltd. A cluster of US law firm sites was compromised around November 2025, possibly through a supply-chain attack. GrayCharlie uses two main attack chains: one involving fake browser updates and another using ClickFix-style lures. The group's objectives appear to focus on data theft and financial gain, with potential access selling to other threat actors.

GrayCharlie is a cybercriminal group active since mid-2023 that targets WordPress websites, with a focus on law firm sites, through suspected supply-chain attacks. The group compromises legitimate WordPress sites by injecting malicious links that redirect visitors to payloads of the NetSupport Remote Access Trojan (RAT). These payloads are delivered via social engineering lures such as fake browser update prompts or ClickFix-style notifications, which trick users into executing malware. Once infected, victims may also be compromised by additional malware including Stealc, a credential and data stealer, and SectopRAT, a remote access tool. The attack infrastructure is tied to hosting providers MivoCloud and HZ Hosting Ltd, indicating a possible use of cloud-based resources to host malicious payloads and command-and-control servers. The group employs multiple attack chains leveraging techniques such as exploitation of WordPress vulnerabilities (T1190), use of remote services (T1021), persistence mechanisms (T1547), and credential access (T1078). The primary objectives appear to be data theft and financial gain, with indications that access to compromised environments may be sold to other threat actors. The November 2025 compromise of a cluster of US law firm sites highlights the potential for supply-chain style attacks targeting trusted websites to distribute malware. Although no CVSS score is assigned, the threat’s complexity, use of social engineering, and targeting of sensitive legal sector data underscore its significance. The attack requires user interaction to execute the fake updates but does not require prior authentication, increasing the attack surface. The lack of known exploits in the wild suggests the threat is currently limited but evolving.

Detailed information about Law Firm Sites Hijacked in Suspected Supply-Chain Attack. Get real-time updates, technical details, and mitigation strategies.

Law Firm Sites Hijacked in Suspected Supply-Chain Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

Law Firm Sites Hijacked in Suspected Supply-Chain Attack

Threats Tagged 'mivocloud'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'mivocloud'

Lead Pen Test Professional