Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report details a campaign involving NodeJS backdoors used to distribute proxyware and monetization schemes. The attackers employ Inno setup installers to drop PowerShell scripts that download and execute NodeJS packages with malicious JavaScript. The backdoors collect system information, communicate with command and control servers, and can execute various commands including PowerShell scripts and additional Node.js code. The campaign is associated with multiple proxyware applications like Infatica, Honeygain, earnFM, and PacketLab. The attackers also use browser extensions to track user navigation and potentially redirect to malicious URLs. The infrastructure involves numerous domains and cloud services for hosting malware and command and control.

This threat involves a campaign leveraging NodeJS backdoors to distribute proxyware and monetization schemes. Attackers use Inno Setup installers to deploy PowerShell scripts that download and execute malicious NodeJS packages containing JavaScript code. These backdoors collect detailed system information and maintain communication with command and control (C2) servers, enabling remote execution of commands, including PowerShell scripts and additional NodeJS code. The campaign is linked to several proxyware applications such as Infatica, Honeygain, earnFM, and PacketLab, which are often used to monetize infected systems by routing traffic or providing proxy services without user consent. Additionally, the attackers deploy browser extensions that monitor user navigation and can redirect users to malicious URLs, increasing the risk of further compromise or fraud. The infrastructure supporting this campaign is extensive, utilizing numerous domains and cloud services to host malware and maintain resilient C2 channels. The attack techniques include persistence mechanisms (T1547.001), execution via PowerShell and NodeJS (T1059.001, T1059.003, T1059.007), masquerading (T1036.005), and data exfiltration (T1105, T1071.001). While no specific affected software versions are listed, the use of NodeJS and PowerShell indicates that systems running Windows environments with NodeJS installed are primarily targeted. The campaign does not currently have known exploits in the wild but represents a sophisticated threat combining backdoor access, proxyware monetization, and browser manipulation.

Detailed information about NodeJS backdoors delivering proxyware and monetization schemes. Get real-time updates, technical details, and mitigation strategies.

NodeJS backdoors delivering proxyware and monetization schemes - Live Threat Intelligence - Threat Radar | OffSeq.com

NodeJS backdoors delivering proxyware and monetization schemes

Threats Tagged 'monetization'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'monetization'

Lead Pen Test Professional