Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Chinese-speaking threat actor conducted a large-scale SEO poisoning campaign dubbed 'Operation Rewrite' using BadIIS malware to manipulate search results. The attackers compromised legitimate websites and used malicious IIS modules to intercept web traffic and serve altered content. The campaign targeted East and Southeast Asia, particularly Vietnam. Multiple variants of BadIIS were discovered, including ASP.NET handlers and PHP scripts. The threat actor is linked to previously known groups like Group 9 and possibly DragonRank. Their toolkit allowed them to inject malicious content, redirect users, and exploit compromised servers for various malicious purposes.

Operation Rewrite is a large-scale SEO poisoning campaign attributed to a Chinese-speaking threat actor group linked to previously known entities such as Group 9 and possibly DragonRank. The attackers leveraged BadIIS malware, which consists of malicious IIS modules, ASP.NET handlers, and PHP scripts, to compromise legitimate websites primarily in East and Southeast Asia, with a particular focus on Vietnam. By implanting these malicious modules into web servers running Microsoft IIS, the threat actors intercepted and manipulated web traffic to alter search engine results and redirect users to malicious or fraudulent content. This manipulation of search engine results (SEO poisoning) enables the attackers to increase the visibility of malicious sites or content, potentially leading to further exploitation such as malware distribution, credential theft, or other malicious activities. The campaign's toolkit allows injection of malicious content directly into web pages served by compromised servers, enabling stealthy and persistent manipulation without requiring user interaction beyond visiting affected sites. The use of web shells and various exploitation techniques (referenced by MITRE ATT&CK IDs T1133, T1190, T1112, T1505.003, T1078) indicates a sophisticated approach involving initial access, persistence, and credential access to maintain control over compromised infrastructure. Although no known exploits are currently reported in the wild for this specific malware, the campaign's scale and complexity demonstrate a significant threat to web infrastructure relying on IIS servers, especially those with weak patching or security controls.

Detailed information about Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign. Get real-time updates, techni

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

Threats Tagged 'operation rewrite'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'operation rewrite'

Lead Pen Test Professional