Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Arctic Wolf Labs discovered a new campaign by Venom Spider targeting corporate HR departments with fake resumes containing the More_eggs backdoor. The financially motivated threat group uses spear-phishing emails and abuses legitimate job platforms to apply for real jobs. The backdoor can steal credentials, customer data, and intellectual property. Several upgrades were found, including server-side polymorphism and evasion techniques. The attack chain involves obfuscated JavaScript, LNK files, and a dropper that generates polymorphic code. Organizations are advised to train employees on phishing awareness, especially those in HR who regularly open attachments from unknown senders.

The Venom Spider threat group has launched a new campaign targeting corporate Human Resources (HR) departments by leveraging spear-phishing emails containing fake resumes embedded with the More_eggs backdoor malware. This campaign abuses legitimate job application platforms to submit these malicious resumes, increasing the likelihood of bypassing initial suspicion. The attack chain is sophisticated, involving obfuscated JavaScript, LNK (Windows shortcut) files, and a dropper that generates polymorphic code on the server side. Server-side polymorphism means that the malware payload dynamically changes its code structure with each infection attempt, making traditional signature-based detection ineffective. The More_eggs backdoor enables attackers to steal sensitive information such as user credentials, customer data, and intellectual property. The campaign also incorporates evasion techniques to avoid detection by security tools. The use of spear-phishing specifically targeting HR personnel is strategic, as these employees frequently handle attachments from unknown senders during recruitment processes, increasing the risk of successful compromise. The malware leverages multiple MITRE ATT&CK techniques including command and scripting interpreter abuse (T1059.007), remote system discovery (T1016.001), user execution (T1204.002), and persistence mechanisms (T1547.001), among others. Although no known exploits in the wild have been reported yet, the campaign's complexity and targeted nature pose a significant threat to organizations, especially those with active recruitment processes and large HR departments.

Detailed information about Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims. Get real-time updates, technical details, and mitigation st

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims - Live Threat Intelligence - Threat Radar | OffSeq.com

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Threats Tagged 'polymorphism'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'polymorphism'

Lead Pen Test Professional