Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A multi-stage malware delivery campaign was uncovered, initially detected through a suspicious VBS file. The investigation revealed a complex attack infrastructure using Unicode obfuscation, PNG-based payload staging, and reflectively loaded .NET execution. The attacker utilized open directories to host multiple obfuscated VBS files, each mapping to different malware payloads including XWorm and Remcos RAT. A secondary infection vector involving a weaponized 'PDF' and batch script was also discovered. The campaign demonstrated a modular approach, allowing for payload rotation and multiple attack vectors from the same domain. This sophisticated infrastructure design enables rapid modification and expansion of available payloads without altering the initial delivery mechanism.

This multi-stage malware campaign begins with the delivery of obfuscated Visual Basic Script (VBS) files hosted in open directories accessible via the attacker-controlled domain. The VBS files employ Unicode obfuscation to evade signature-based detection and are designed to stage payloads embedded within PNG files, a technique that hides malicious code within seemingly benign image files. The campaign uses reflective loading of .NET assemblies to execute payloads in memory, reducing forensic artifacts and detection opportunities. Multiple malware families are deployed, notably XWorm and Remcos Remote Access Trojans (RATs), which provide attackers with remote control capabilities. A secondary infection vector involves weaponized PDFs combined with batch scripts, enabling additional infection routes. The modular infrastructure allows attackers to rotate and update payloads rapidly without modifying the initial VBS delivery mechanism, enhancing operational security and persistence. The campaign incorporates various advanced techniques such as User Account Control (UAC) bypass, code injection, obfuscation, and persistence mechanisms aligned with MITRE ATT&CK techniques (e.g., T1053.005 for scheduled tasks, T1218.011 for signed binary proxy execution, T1566.002 for spearphishing attachments). Despite the absence of known exploits in the wild, the campaign’s design reflects a high level of sophistication and adaptability, posing a significant challenge to traditional detection and response strategies.

Detailed information about Tracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure. Get real-time updates, technical details, and mitigation st

Tracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Tracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure

Threats Tagged 'phantomvai'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'phantomvai'

Lead Pen Test Professional