Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TA585 is a sophisticated cybercriminal threat actor that operates its entire attack chain, from infrastructure to email delivery and malware installation. The actor demonstrates innovation in the evolving cybercrime landscape, using unique web injection campaigns and complex filtering techniques. TA585 frequently delivers MonsterV2, a versatile malware with remote access trojan, loader, and stealer capabilities. MonsterV2 is used by multiple threat actors and avoids infecting computers in Commonwealth of Independent States countries. The malware is actively maintained and updated, with pricing ranging from $800 to $2,000 per month. TA585's campaigns often involve compromised websites, fake CAPTCHAs, and GitHub-themed attacks to deliver various payloads.

TA585 is a cybercriminal threat actor known for operating a full-spectrum attack chain, encompassing infrastructure management, email delivery, and malware installation. The group is notable for its innovation in cybercrime tactics, including unique web injection campaigns that manipulate web content to facilitate malware delivery. TA585’s primary malware, MonsterV2, is a versatile tool combining remote access trojan (RAT) functionalities, loader capabilities to deploy additional payloads, and stealer modules to exfiltrate credentials and sensitive data. The malware avoids infecting systems in Commonwealth of Independent States (CIS) countries, indicating a targeted geographic focus. TA585’s campaigns often leverage compromised legitimate websites, fake CAPTCHA challenges, and GitHub-themed social engineering to trick victims into executing malicious payloads. MonsterV2 is actively maintained and updated, reflecting a malware-as-a-service model with monthly pricing between $800 and $2,000, and is used by multiple threat actors, increasing its distribution footprint. The threat actor employs complex filtering techniques to evade detection and prevent infection in certain regions, demonstrating operational sophistication. While no specific CVEs or exploits are linked to this malware, its modularity and stealth features pose a significant risk to organizations. The tactics, techniques, and procedures (TTPs) align with several MITRE ATT&CK techniques such as web injection (T1185), credential dumping (T1003), and persistence mechanisms (T1547.001). The absence of a CVSS score necessitates a severity assessment based on impact and exploitability factors.

Detailed information about When the monster bytes: tracking TA585 and its arsenal. Get real-time updates, technical details, and mitigation strategies.

When the monster bytes: tracking TA585 and its arsenal - Live Threat Intelligence - Threat Radar | OffSeq.com

When the monster bytes: tracking TA585 and its arsenal

Threats Tagged 'monsterv2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'monsterv2'

Lead Pen Test Professional