Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A coordinated action led by Microsoft's Digital Crimes Unit, with participation from Bitsight and other partners, has successfully dismantled the operational capabilities of Lumma Stealer (LummaC2), a prominent information stealer operating since late 2022. The operation involved seizing over 1,000 domains and shutting down more than 90 Telegram channels and Steam profiles associated with the malware's infrastructure. LummaC2, which gained popularity after the takedown of Redline and Meta stealers, targeted Windows systems to extract sensitive data from various applications. The malware employed a complex, multi-tiered command and control infrastructure, using multiple domains, Steam profiles, and Telegram channels for resilience. This disruptive action is expected to significantly impact the threat landscape and hinder criminal activities in the malware scene.

Lumma Stealer (LummaC2) was a sophisticated information-stealing malware that emerged in late 2022, gaining prominence after the takedown of other stealers such as Redline and Meta. It primarily targeted Windows systems, aiming to extract sensitive data from a variety of applications. The malware utilized a complex, multi-tiered command and control (C2) infrastructure that leveraged over 1,000 domains, Steam profiles, and Telegram channels to maintain resilience and operational continuity. This infrastructure allowed attackers to manage and update the malware remotely, exfiltrate stolen data, and evade takedown attempts. The malware's capabilities included credential theft, data exfiltration, and potentially lateral movement within compromised networks, employing techniques aligned with MITRE ATT&CK tactics such as T1071 (Application Layer Protocol), T1005 (Data from Local System), T1140 (Deobfuscate/Decode Files or Information), T1555 (Credentials from Password Stores), T1555.003 (Credentials from Web Browsers), T1059 (Command and Scripting Interpreter), T1102 (Web Service), T1573 (Encrypted Channel), T1056 (Input Capture), and T1132 (Data Encoding). The recent coordinated takedown led by Microsoft's Digital Crimes Unit, with support from Bitsight and other partners, successfully dismantled Lumma Stealer's infrastructure by seizing domains and shutting down associated Telegram channels and Steam profiles. This action disrupts the malware's operational capabilities and is expected to significantly reduce its threat presence in the wild.

Detailed information about Lumma Stealer is Out... of business!. Get real-time updates, technical details, and mitigation strategies.

Lumma Stealer is Out... of business! - Live Threat Intelligence - Threat Radar | OffSeq.com

Lumma Stealer is Out... of business!

Threats Tagged 'multi-tiered c2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'multi-tiered c2'

Lead Pen Test Professional