Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Censys researchers uncovered a spear‑phishing campaign where threat actors leveraged a cluster of 16 open directories hosting heavily obfuscated Visual Basic Script (VBS) files. The study analyzes how attackers set up these public-accessible directories to store malicious scripts, the obfuscation techniques employed, and the infrastructure's lifecycle.

Researchers from Censys have uncovered a spear-phishing campaign infrastructure that relies on a cluster of 16 publicly accessible open directories hosting heavily obfuscated Visual Basic Script (VBS) files. These directories serve as the storage and distribution points for malicious scripts used in the campaign. The attackers employ advanced obfuscation techniques to conceal the true nature and functionality of the VBS payloads, complicating detection and analysis efforts. The campaign infrastructure lifecycle includes setting up these open directories, uploading obfuscated malicious scripts, and leveraging them in targeted spear-phishing attacks. The tags associated with this campaign indicate the use of multiple Remote Access Trojans (RATs) such as Remcos, LimeRAT, DCrat, and AsyncRAT, which are known for their capabilities in remote control, data exfiltration, and persistence. The campaign also involves techniques mapped to MITRE ATT&CK tactics and techniques like T1113 (Screen Capture), T1571 (Non-Standard Port), T1027.003 (Obfuscated Files or Information - Visual Basic), T1059.005 (Command and Scripting Interpreter - Visual Basic), T1566.001 (Spearphishing Attachment), and T1590 (Gather Victim Network Information). Although no known exploits in the wild have been reported, the infrastructure's public accessibility and use of obfuscated scripts pose a significant risk of enabling targeted attacks. The absence of affected software versions suggests this is an infrastructure and technique-based threat rather than a vulnerability in a specific product. The campaign's reliance on spear-phishing attachments and obfuscated VBS scripts highlights the importance of user awareness and robust email security controls. Overall, this threat represents a sophisticated spear-phishing operation leveraging publicly exposed infrastructure to distribute obfuscated malware payloads capable of remote access and data theft.

MD5 of 657e021f0dfdd8c628a428a824da278d14d674aefd248f86a58f5bbe4472f0dc

MD5 of b7d205a1560b07a92d744053744c29823064e2c415a71887fccd8524a3cad3fb

MD5 of d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5

MD5 of 4297de28d569560bf2cd287e1a44771ec4f8deac993cb69b54b36fa497af52d3

SHA1 of d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5

SHA1 of b7d205a1560b07a92d744053744c29823064e2c415a71887fccd8524a3cad3fb

SHA1 of 4297de28d569560bf2cd287e1a44771ec4f8deac993cb69b54b36fa497af52d3

SHA1 of 657e021f0dfdd8c628a428a824da278d14d674aefd248f86a58f5bbe4472f0dc

CC=US ASN=AS141995 contabo asia private limited

CC=CO ASN=AS3816 colombia telecomunicaciones s.a. esp

CC=TR ASN=AS39144 redes digitales de telecomunicacion en internet sl

CC=US ASN=AS396073 majestic hosting solutions  llc

Detailed information about Unmasking the Infrastructure of a Spear‑phishing Campaign. Get real-time updates, technical details, and mitigation strategies.

Threats Tagged 'opendir'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'opendir'

Lead Pen Test Professional