Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An intrusion began with a user downloading and executing a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actor used multiple malware families, including SystemBC and Betruger, and various tools for reconnaissance and lateral movement. They moved across systems using RDP and Impacket's wmiexec, maintaining persistence through local account creation and startup folder shortcuts. Data was collected using WinRAR and exfiltrated via WinSCP to an FTP server. The discovery of tools linked to Play ransomware, DragonForce ransomware, and RansomHub suggests the threat actor was likely an affiliate operating across multiple ransomware groups.

This security threat involves a sophisticated intrusion campaign initiated by a user downloading and executing a malicious file masquerading as DeskSoft's EarthTime application. This initial infection vector deployed SectopRAT malware, which is known for its capabilities in reconnaissance and persistence. The threat actor leveraged multiple malware families, including SystemBC and Betruger, to facilitate lateral movement and maintain control over compromised systems. The attackers utilized Remote Desktop Protocol (RDP) and Impacket's wmiexec tool to move laterally within the network, demonstrating advanced operational security and evasion techniques. Persistence was maintained through the creation of local user accounts and the use of startup folder shortcuts, ensuring continued access even after system reboots. Data collection was performed using WinRAR to archive sensitive information, which was then exfiltrated via WinSCP to an external FTP server. Notably, the presence of tools and indicators linked to three major ransomware groups—Play ransomware, DragonForce ransomware, and RansomHub—suggests that the threat actor is likely an affiliate operating across multiple ransomware gangs. This multi-affiliation blurs traditional lines between ransomware groups and complicates attribution and defense efforts. The campaign demonstrates a high level of operational sophistication, combining multiple malware families and tools to achieve reconnaissance, lateral movement, persistence, data exfiltration, and potential ransomware deployment.

Detailed information about Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs. Get real-time updates, technical details, and mitig

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs - Live Threat Intelligence - Threat Radar | OffSeq.com

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

Threats Tagged 'multi-group affiliation'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'multi-group affiliation'

Lead Pen Test Professional