Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

APT36, a Pakistan-linked threat group, has expanded its operations to target Indian government and civilian infrastructure, including railways, oil & gas, and the Ministry of External Affairs. The group employs sophisticated phishing techniques and novel payload strategies, using .desktop files disguised as PDF documents to execute malicious scripts. Two attack variants were identified, utilizing single and redundant command and control server setups. The Poseidon backdoor, built on the Mythic framework, is deployed for persistent access and lateral movement. Over 100 phishing domains impersonating Indian government organizations were discovered, primarily hosted by AlexHost. The campaign, active since early July 2025, poses a significant threat to Indian public sector and critical infrastructure.

The threat involves APT36, a Pakistan-linked advanced persistent threat group, targeting Indian government and civilian infrastructure sectors such as railways, oil & gas, and the Ministry of External Affairs. The group employs sophisticated phishing campaigns using deceptive .desktop files disguised as PDF documents to execute malicious scripts on victim machines. These files exploit user trust and social engineering to bypass security controls and initiate payload execution. Two variants of the attack have been identified, differing in their command and control (C2) server architecture—one using a single C2 server and another employing redundant C2 servers to enhance resilience and persistence. The primary malware deployed is the Poseidon backdoor, which is built on the Mythic framework, a modular and flexible post-exploitation toolset. Poseidon enables persistent access, lateral movement within networks, credential theft, and data exfiltration. The campaign also involves over 100 phishing domains impersonating Indian government organizations, primarily hosted by AlexHost, to increase the credibility of phishing lures and facilitate credential harvesting or malware delivery. The campaign has been active since early July 2025 and represents a significant threat to Indian public sector entities and critical infrastructure. The attack techniques align with multiple MITRE ATT&CK tactics and techniques including phishing (T1566), execution via user execution (T1204), persistence (T1547), lateral movement (T1071), and defense evasion (T1070, T1027). The use of .desktop files as lures is novel and leverages Linux desktop environments, indicating targeting of systems running Linux or Unix-like OSes, which are common in infrastructure environments. The absence of known exploits in the wild suggests the threat relies heavily on social engineering and custom malware deployment rather than exploiting publicly known vulnerabilities.

Detailed information about Indian Infrastructure Targeted with Desktop Lures and Poseidon Backdoor. Get real-time updates, technical details, and mitigation str

Indian Infrastructure Targeted with Desktop Lures and Poseidon Backdoor - Live Threat Intelligence - Threat Radar | OffSeq.com

Indian Infrastructure Targeted with Desktop Lures and Poseidon Backdoor

Threats Tagged 'mythic framework'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'mythic framework'

Lead Pen Test Professional