Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report details the analysis of RapperBot, a sophisticated botnet targeting IoT devices, particularly Network Video Recorders (NVRs). The malware exploits vulnerabilities in these devices to create a large-scale DDoS infrastructure. The analysis covers the botnet's infection process, command and control mechanisms, and its evolution over time. Key features include the use of NFS for malware distribution, encrypted DNS TXT records for C2 communication, and a wide range of supported device architectures. The report also discusses recent law enforcement actions against the botnet and provides recommendations for protection against such threats.

RapperBot is a sophisticated IoT-focused botnet primarily targeting Network Video Recorders (NVRs). It exploits vulnerabilities in these devices to compromise them and conscript them into a large-scale distributed denial-of-service (DDoS) infrastructure. The infection process involves leveraging known exploits against vulnerable NVRs, enabling the malware to gain persistence and control. Notably, RapperBot employs Network File System (NFS) protocols for malware distribution, which is uncommon and allows efficient propagation within local networks or across exposed devices. For command and control (C2) communication, the botnet uses encrypted DNS TXT records, a stealthy technique that helps evade traditional network detection mechanisms by blending C2 traffic with legitimate DNS queries. The botnet supports a wide range of device architectures, increasing its potential reach across diverse IoT environments. The report also highlights the botnet's evolution, including enhancements in its infection vectors and command capabilities, as well as recent law enforcement efforts to disrupt its infrastructure. Although no known exploits are currently reported in the wild beyond the botnet’s own activity, the threat remains active and capable of launching significant DDoS attacks using hijacked IoT devices. The malware’s use of advanced techniques such as encrypted DNS communication and NFS-based distribution underscores its sophistication and resilience against detection and takedown efforts.

Detailed information about Dissecting RapperBot Botnet: From Infection to DDoS & More. Get real-time updates, technical details, and mitigation strategies.

Dissecting RapperBot Botnet: From Infection to DDoS & More - Live Threat Intelligence - Threat Radar | OffSeq.com

Dissecting RapperBot Botnet: From Infection to DDoS & More

Threats Tagged 'nvr'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'nvr'

Lead Pen Test Professional