Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Water Saci campaign is a sophisticated malware operation primarily targeting Brazilian banking and cryptocurrency platforms via WhatsApp. It employs multi-format malware delivery using various scripting languages, including a shift from PowerShell to Python, likely enhanced by AI tools to evade detection and complicate analysis. The malware features aggressive anti-sandbox techniques, extensive backdoor capabilities, and persistence mechanisms. Although currently focused on Brazil, the use of WhatsApp as a propagation vector and targeting financial applications poses a potential risk to European organizations with ties to Brazilian markets or users. The campaign’s complexity and AI-enhanced development pipeline indicate a medium severity threat with significant evasion and persistence capabilities. Defenders should prioritize monitoring WhatsApp-based phishing attempts, scrutinize multi-format file attachments, and implement advanced behavioral detection to mitigate risks. Countries with strong economic or diaspora links to Brazil and high WhatsApp usage are more likely to be affected.

The Water Saci campaign represents an advanced malware operation that leverages WhatsApp as its primary propagation vector to deliver banking trojans targeting Brazilian financial institutions and cryptocurrency platforms. The attackers utilize a multi-format delivery approach, employing various file types and scripting languages to evade traditional signature-based detection. Notably, the campaign has evolved from using PowerShell scripts to Python-based propagation routines, suggesting an accelerated and sophisticated development process possibly augmented by AI tools such as large language models (LLMs) to automate or enhance malware script generation and conversion. This AI-enhanced approach increases the complexity and variability of the malware, making detection and analysis more challenging. The malware incorporates aggressive anti-sandbox techniques to detect and evade automated analysis environments, ensuring persistence and stealth within infected systems. It also establishes extensive backdoor capabilities, allowing attackers to maintain long-term access and control. The campaign’s focus on Brazilian banking and cryptocurrency applications indicates a targeted financial motivation. While no known exploits in the wild have been reported outside Brazil, the use of WhatsApp—a globally popular messaging platform—raises concerns about potential spread to other regions, including Europe, especially among users connected to Brazilian networks or financial services. The campaign’s tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as T1113 (screen capture), T1056.001 (keylogging), T1204.002 (malicious file execution), and T1547.001 (registry run keys for persistence), highlighting its comprehensive and multi-layered attack strategy.

Detailed information about Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp. Get real-time updates, technical details, and 

Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp - Live Threat Intelligence - Threat Radar | OffSeq.com

Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp

Threats Tagged 'multi-format attacks'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'multi-format attacks'

Lead Pen Test Professional