Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis reveals connections between three seemingly distinct malicious programs: AppSuite, OneStart, and ManualFinder. The investigation uncovers shared server infrastructure and similar installation patterns, indicating that these programs are likely created by the same threat actor. OneStart, initially a browser based on Chromium, evolved from earlier versions that used node.exe to run malicious JavaScript. The actors behind these programs have been active for years, distributing malware disguised as various utilities such as games, recipe finders, and manual finders. The report highlights the adaptability of these threat actors, who easily morph their software to take new forms and evade detection.

The threat analysis focuses on three interconnected malicious programs: AppSuite, OneStart, and ManualFinder. These malware variants share common server infrastructure and exhibit similar installation and operational patterns, strongly indicating they originate from the same threat actor. OneStart initially masqueraded as a Chromium-based browser but evolved from earlier versions that leveraged node.exe to execute malicious JavaScript code. The threat actors behind these programs have demonstrated significant adaptability and longevity, distributing malware disguised as benign utilities including games, recipe finders, and manual finders to evade detection. The malware employs various techniques such as PowerShell execution, persistence mechanisms (T1547.001), and living-off-the-land binaries (T1218.011) to maintain footholds and execute code stealthily. The use of browser extensions and desktop assistant-like applications further aids in deception and persistence. The infrastructure includes domains like onestart.io and securebrowser.io, and the malware is associated with multiple hashes and domains, indicating a broad and evolving campaign. Although no known exploits in the wild have been reported, the threat actors’ ability to morph their software and evade detection poses a persistent risk. The tags referencing techniques such as command-line interface execution (T1059 variants), user execution (T1204.002), and remote file copy (T1105) suggest a multi-stage infection chain that can be triggered by user interaction and leverages legitimate system tools to avoid raising suspicion.

Detailed information about AppSuite, OneStart & ManualFinder: The Nexus of Deception. Get real-time updates, technical details, and mitigation strategies.

AppSuite, OneStart & ManualFinder: The Nexus of Deception - Live Threat Intelligence - Threat Radar | OffSeq.com

AppSuite, OneStart & ManualFinder: The Nexus of Deception

Threats Tagged 'onestart'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'onestart'

Lead Pen Test Professional