Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines the latest attack flow of the KimJongRAT variant, attributed to the North Korean threat actor Kimsuky. The malware has evolved to include both PE-based and PowerShell-based attack chains, which have been merged into a single workflow. The attackers use phishing emails for initial access, leveraging GitHub and Google Drive for malware distribution. The malware exfiltrates sensitive data including browser credentials, system information, and keystrokes. Additional activities by the same actor include credential theft through phishing sites and spear-phishing campaigns targeting South Korean users. The analysis provides evidence supporting the attribution to Kimsuky and highlights the ongoing development of variants and infrastructure, indicating successful attacks.

KimJongRAT is a remote access trojan (RAT) linked to the North Korean cyber espionage group Kimsuky. The latest evolution merges two previously separate attack chains—one based on Portable Executable (PE) files and the other on PowerShell scripts—into a single streamlined workflow, enhancing operational efficiency and evasion. Initial infection vectors rely heavily on spear-phishing emails that distribute malware payloads via reputable platforms such as GitHub and Google Drive, which helps bypass traditional security controls. Upon execution, KimJongRAT performs comprehensive reconnaissance and data theft activities, including harvesting browser credentials, capturing keystrokes, and collecting detailed system information. These capabilities enable attackers to maintain persistence, escalate privileges, and exfiltrate sensitive data stealthily. Additionally, Kimsuky conducts credential theft through phishing sites and targeted spear-phishing campaigns, primarily against South Korean users, but the infrastructure and tactics could be adapted to other regions. The malware employs various techniques mapped to MITRE ATT&CK tactics such as T1056.001 (keylogging), T1566.002 (spear-phishing), T1059.001/003/005 (PowerShell and command execution), and T1041 (data exfiltration), demonstrating a sophisticated multi-stage attack. Despite no known public exploits, the ongoing development and use of legitimate cloud services for distribution complicate detection and mitigation. This continuous evolution underscores Kimsuky's intent to maintain long-term espionage capabilities and adapt to defensive measures.

Detailed information about Kimsuky's Ongoing Evolution of KimJongRAT and Expanding Threats. Get real-time updates, technical details, and mitigation strategies.

Kimsuky's Ongoing Evolution of KimJongRAT and Expanding Threats - Live Threat Intelligence - Threat Radar | OffSeq.com

Kimsuky's Ongoing Evolution of KimJongRAT and Expanding Threats

Threats Tagged 'pe executable'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'pe executable'

Lead Pen Test Professional