Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

RedNovember, a Chinese state-sponsored threat group, has expanded its cyber-espionage activities globally. The group targets high-profile government, intergovernmental, and private sector organizations, focusing on defense, aerospace, and technology sectors. It uses the Go-based backdoor Pantegana and Cobalt Strike for intrusions, exploiting vulnerabilities in perimeter appliances. RedNovember's tactics include combining weaponized proof-of-concept exploits with open-source tools, allowing for scalable operations and attribution obfuscation. The group has shown particular interest in targets across the US, Taiwan, South Korea, and Panama, often aligning its activities with geopolitical events and Chinese strategic interests.

RedNovember is a Chinese state-sponsored cyber-espionage threat group that has expanded its operations globally, targeting high-profile government, intergovernmental, and private sector organizations. Their primary focus is on sectors critical to national security and technological advancement, including defense, aerospace, and technology industries. The group employs sophisticated tactics involving the exploitation of vulnerabilities in perimeter appliances—network devices such as firewalls, VPN gateways, and other edge security hardware—to gain initial access. RedNovember leverages a Go-based backdoor known as Pantegana, which facilitates stealthy persistence and command-and-control communications. Additionally, they utilize Cobalt Strike, a legitimate penetration testing tool frequently abused by threat actors for post-exploitation activities such as lateral movement, privilege escalation, and data exfiltration. Their operational approach combines weaponized proof-of-concept exploits with open-source tools, enabling scalable and flexible intrusion campaigns while complicating attribution efforts. The group’s targeting aligns with geopolitical interests, focusing on countries like the United States, Taiwan, South Korea, and Panama, often coinciding with strategic events. Indicators of compromise include multiple malware hashes and an IP address associated with command-and-control infrastructure. Although no known exploits are currently widespread in the wild, the medium severity rating reflects the potential for significant espionage impact if successful. The tactics used correspond to MITRE ATT&CK techniques such as spearphishing (T1566.001), exploitation of public-facing applications (T1190), use of remote services (T1571), and command and control over web protocols (T1071.001). The campaign’s reliance on perimeter appliance vulnerabilities highlights the critical need for securing edge devices that serve as gateways to organizational networks.

Detailed information about Targets Government, Defense, and Technology Organizations. Get real-time updates, technical details, and mitigation strategies.

Targets Government, Defense, and Technology Organizations - Live Threat Intelligence - Threat Radar | OffSeq.com

Targets Government, Defense, and Technology Organizations

Threats Tagged 'pantegana'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'pantegana'

Lead Pen Test Professional