Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism leveraging signal handlers and deploys AppleScripts as beacons and backdoors. The attack chain begins with social engineering via Telegram, leading to the execution of malicious scripts and binaries. The malware exfiltrates browser data, Keychain credentials, and Telegram user information. The use of Nim introduces new levels of complexity for analysts, blending complex behavior into binaries with less obvious control flow.

The macOS NimDoor malware represents a sophisticated threat attributed to North Korean (DPRK) threat actors targeting Web3 and cryptocurrency-related businesses. This malware is notable for its use of Nim-compiled binaries, which complicates analysis due to Nim's less common use and its ability to produce binaries with obfuscated control flow. NimDoor employs advanced techniques uncommon in macOS malware, including process injection to stealthily execute code within legitimate processes, and encrypted WebSocket communications to securely exfiltrate data and maintain command and control (C2) channels. The malware also uses a novel persistence mechanism leveraging signal handlers, which is an uncommon method to maintain foothold on infected systems. Additionally, NimDoor deploys AppleScripts acting as beacons and backdoors, enabling further control and data exfiltration. The infection chain begins with social engineering via Telegram, where victims are lured into executing malicious scripts and binaries. Once active, NimDoor targets sensitive data including browser data, macOS Keychain credentials, and Telegram user information, enabling attackers to harvest authentication tokens, private keys, and other credentials critical for Web3 and crypto platforms. The combination of these techniques reflects a highly targeted campaign aimed at compromising the confidentiality and integrity of cryptocurrency assets and related infrastructure on macOS systems. The use of Nim as a development language and the complex multi-stage attack chain indicate a high level of sophistication and intent to evade detection and analysis.

Detailed information about macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware. Get real-time updates, technical 

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Threats Tagged 'nimdoor'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'nimdoor'

Lead Pen Test Professional