Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated FileFix attack campaign has been discovered, marking the first use of this technique beyond proof-of-concept. The attack employs a complex phishing infrastructure, including a multilingual site mimicking Facebook security. It uses steganography to conceal malicious code in images, with a multistage payload delivery system featuring layered obfuscation and evasion techniques. The final payload deploys a StealC infostealer targeting various applications and credentials. The campaign has evolved rapidly over two weeks, indicating a global targeting strategy with potential victims in multiple countries. This attack represents a significant advancement in *Fix attack sophistication, combining FileFix with advanced tradecraft to maximize both evasion and impact.

The FileFix campaign represents a sophisticated malware attack that has transitioned from proof-of-concept to active exploitation in the wild. This campaign employs a complex phishing infrastructure, including multilingual phishing websites that impersonate Facebook security pages to lure victims. A notable technical advancement in this campaign is the use of steganography to conceal malicious code within images, which helps evade traditional detection mechanisms. The attack utilizes a multistage payload delivery system characterized by layered obfuscation and evasion techniques, making it difficult for security tools to detect and analyze the malware at early stages. The final payload deployed is the StealC infostealer, which targets a broad range of applications and credentials, aiming to exfiltrate sensitive user data such as login credentials, session tokens, and potentially other personal or corporate information. The campaign has evolved rapidly over a short period (two weeks), indicating an agile threat actor employing advanced tradecraft to maximize evasion and impact. Indicators of compromise include multiple file hashes, IP addresses, and domains associated with the phishing infrastructure and malware delivery. The attack techniques align with several MITRE ATT&CK tactics and techniques, including credential dumping (T1003), phishing (T1566.002), obfuscated files or information (T1027), process injection (T1055), and use of steganography (T1001.003). The campaign's global targeting strategy suggests potential victims across multiple countries, with confirmed activity in Germany. The combination of social engineering, advanced obfuscation, and steganography marks a significant evolution in FileFix attack sophistication, posing a serious threat to organizations relying on user vigilance and traditional detection methods.

Detailed information about FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography. Get real-time updates, technical details, and 

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography - Live Threat Intelligence - Threat Radar | OffSeq.com

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

Threats Tagged 'multistage payload'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'multistage payload'

Lead Pen Test Professional