Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Check Point Research

Kaspersky Security Blog

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazilian electronic invoice system (NF-e) as bait, leading victims to malicious content on Dropbox. The threat actor, likely an initial access broker, abuses free trial periods of RMM tools to gain complete control of target machines. The campaign's objective is to create a network of compromised machines for potential sale to third parties, including ransomware operators and state-sponsored actors. The abuse of commercial RMM tools is increasing due to their digital signatures, full backdoor capabilities, and low cost.

This threat involves a spam campaign primarily targeting Brazilian users, with a focus on high-value targets such as C-level executives and financial or HR personnel. The attackers exploit commercial Remote Monitoring and Management (RMM) tools, specifically PDQ Connect and N-able remote access tools, to gain unauthorized access to victim machines. The campaign uses the Brazilian electronic invoice system (NF-e) as a lure, directing victims to malicious content hosted on Dropbox. The attackers leverage free trial periods of these RMM tools to establish persistent, fully backdoored access to compromised systems. These RMM tools are attractive to attackers because they are digitally signed, which helps evade detection, and provide comprehensive remote control capabilities. The ultimate goal of the campaign is to build a network of compromised machines that can be sold to third parties, including ransomware operators and state-sponsored threat actors. The campaign employs multiple tactics and techniques such as initial access brokering, social engineering via spam, and abuse of legitimate software to bypass security controls. Although the campaign is currently focused on Brazil, the abuse of RMM tools is a growing trend globally due to their stealth and effectiveness in establishing long-term access.

Detailed information about Spam campaign targeting Brazil abuses Remote Monitoring and Management tools. Get real-time updates, technical details, and mitigatio

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools - Live Threat Intelligence - Threat Radar | OffSeq.com

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

Threats Tagged 'nf-e'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'nf-e'

Lead Pen Test Professional