Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines a multi-stage Windows malware campaign called SHADOW#REACTOR. The infection chain uses obfuscated VBS, PowerShell downloaders, and text-based payloads to deliver a Remcos RAT backdoor. Key features include fragmented text staging, .NET Reactor protection, reflective loading, and MSBuild abuse as a living-off-the-land binary. The campaign leverages complex obfuscation and in-memory execution to evade detection while establishing persistent remote access. Defensive recommendations focus on script execution monitoring, LOLBin abuse detection, and enhanced PowerShell logging to counter the sophisticated evasion techniques employed.

The SHADOW#REACTOR campaign represents a complex Windows malware infection chain that delivers the Remcos Remote Access Trojan (RAT) through multiple sophisticated stages. Initial infection vectors involve obfuscated Visual Basic Script (VBS) and PowerShell downloaders that retrieve fragmented, text-only payloads from remote servers. These payloads are staged in a fragmented manner to evade signature-based detection. The campaign employs .NET Reactor, a commercial obfuscation and protection tool, to shield its components from reverse engineering and static analysis. Reflective loading techniques are used to execute code directly in memory, avoiding writing malicious binaries to disk and thus evading traditional antivirus and endpoint detection systems. A notable living-off-the-land technique is the abuse of MSBuild.exe, a legitimate Microsoft build tool, to execute malicious code without raising immediate suspicion. This abuse aligns with MITRE ATT&CK techniques T1219 (Signed Binary Proxy Execution) and T1047 (Windows Management Instrumentation). The Remcos RAT deployed provides attackers with persistent remote access, enabling data exfiltration, system control, and further lateral movement. The campaign’s obfuscation and in-memory execution complicate detection and forensic analysis. Indicators of compromise include multiple file hashes, IP addresses, and URLs linked to the malware’s infrastructure. Defensive recommendations emphasize enhanced PowerShell logging (to capture script execution details), monitoring for living-off-the-land binary (LOLBin) abuse such as MSBuild, and vigilant script execution monitoring to detect anomalous behaviors. Although no CVE or known exploits are currently associated, the campaign’s complexity and stealth techniques pose a significant threat to Windows-based environments.

Detailed information about SHADOW#REACTOR – Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployments. Get real-time updates, technical details, and

SHADOW#REACTOR – Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployments - Live Threat Intelligence - Threat Radar | OffSeq.com

SHADOW#REACTOR – Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployments

Threats Tagged 'msbuild abuse'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'msbuild abuse'

Lead Pen Test Professional