Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Russian espionage group Swallowtail targeted defense-related organizations in two NATO countries, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer. The attackers used malicious Word documents to deploy the Hookedge backdoor and conducted hands-on-keyboard operations. They stole credentials using SSH private keys for persistent tunnels and PowerShell scripts to capture NTLM handshakes. Additionally, they deployed a previously undocumented reflective loader (ld.exe) that decrypts payloads in memory with runtime-supplied keys. The campaign aligns with intelligence collection efforts against European government and defense sectors.

Swallowtail, a Russian espionage group, conducted targeted intrusions against organizations in two NATO member states, focusing on defense and law enforcement sectors. The attackers used malicious Word documents to deliver the Hookedge backdoor. They performed hands-on-keyboard activities, stealing credentials through two methods: deploying SSH private keys to maintain persistent network tunnels and executing PowerShell scripts to capture NTLM authentication handshakes. A novel reflective loader (ld.exe) was used to decrypt payloads in memory dynamically, complicating detection. The operation reflects a broad intelligence-gathering campaign targeting sensitive defense-related information in Europe.

The Russian espionage group Swallowtail targeted defense-related organizations in two NATO countries, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer. The attackers used malicious Word documents to deploy the Hookedge backdoor and conducted hands-

Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries

Threats Tagged 'naval shipbuilder'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'naval shipbuilder'

Lead Pen Test Professional