Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Russian government organization was targeted by the Cavalry Werewolf hacker group, aiming to collect confidential information and network data. The attack began with phishing emails containing malware disguised as documents. The group utilized various tools including backdoors, trojans, and modified legitimate programs. They employed open-source software, reverse-shell backdoors, and Telegram API for control. The attackers focused on information gathering, network configuration, and establishing persistence in compromised systems. Their tactics included using Windows built-in tools, modifying the registry, and exploiting public directories for malware deployment. The group's sophisticated approach and diverse toolset highlight the evolving threat landscape for government institutions.

The Cavalry Werewolf hacker group conducted a targeted cyberattack against a Russian government organization aiming to exfiltrate confidential information and network data. The initial attack vector was phishing emails containing malicious documents designed to deploy malware. The group’s toolset is diverse and sophisticated, including various backdoors (reverse-shell, tunnel, proxy), trojans, and modified legitimate programs, many leveraging open-source software components. Command and control communications were conducted via the Telegram API, allowing covert control of compromised systems. The attackers utilized Windows built-in tools and techniques such as registry modifications to establish persistence and evade detection. They exploited public directories for malware deployment, indicating a focus on stealth and lateral movement within the network. The tactics align with MITRE ATT&CK techniques such as T1566.001 (phishing), T1547.001 (registry run keys), T1090.002 (proxy), and T1059 (command-line interface). The attack’s primary goal was information gathering and network infiltration rather than immediate disruption. No known public exploits are currently associated with this campaign, suggesting a custom or targeted approach. The medium severity rating reflects the moderate impact potential and the requirement for user interaction via phishing. The evolving sophistication of the group’s methods underscores the increasing threat to government institutions and critical infrastructure, with potential implications for similar organizations in Europe that share comparable technology stacks or geopolitical profiles.

Detailed information about Cavalry Werewolf hacker group attacks Russian state institutions. Get real-time updates, technical details, and mitigation strategies

Cavalry Werewolf hacker group attacks Russian state institutions - Live Threat Intelligence - Threat Radar | OffSeq.com

Cavalry Werewolf hacker group attacks Russian state institutions

Threats Tagged 'network infiltration'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'network infiltration'

Lead Pen Test Professional