Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The CL-CRI-1171 cybercrime campaign has operated undetected for at least two years, distributing multiple malware families via a pay-per-install marketplace. It primarily targeted young gamers through popular YouTube channels and used SEO poisoning to compromise corporate and critical infrastructure endpoints. The campaign employed a custom loader called OfferLoader to deliver payloads including Insomnia RAT, ARKTunnel, and Docro Hijacker. Over 10,000 loader samples indicate a large-scale operation affecting numerous organizations globally.

CL-CRI-1171 is a long-running cybercrime campaign that leverages a pay-per-install marketplace to distribute multiple malware families. It targets young gamers via YouTube channels with large followings and uses SEO poisoning techniques to infect corporate endpoints, including critical infrastructure and government entities. The campaign uses OfferLoader, a custom loader with sophisticated gating mechanisms, to deliver unique payload combinations. Identified malware includes Insomnia RAT (a cross-platform backdoor for Windows and macOS), ARKTunnel (a WebSocket tunneling tool hidden via steganography), and Docro Hijacker (a Chrome browser hijacker). The discovery of over 10,000 distinct loader samples suggests a widespread deployment.

Detailed information about Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure. Get real-time updates, technical details, and mitigation st

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Threats Tagged 'offerloader'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'offerloader'

Lead Pen Test Professional

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility