Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scale of its spearphishing campaigns, especially in the second half of the year. The group also made efforts to bypass network-based blocking, hiding most of its command and control infrastructure behind Cloudflare tunnels. Notable updates include enhancements to PteroLNK for weaponizing network drives, improvements in file exfiltration techniques, and the introduction of new downloaders. Despite these advancements, Gamaredon showed signs of operational limitations, occasionally abandoning or infrequently updating certain tools.

Gamaredon is a persistent advanced threat actor that throughout 2024 has concentrated its cyber operations against Ukrainian governmental institutions. The group employs spearphishing campaigns and weaponized USB drives as primary infection vectors. In 2024, Gamaredon significantly evolved its toolset by developing six new malware tools and enhancing existing ones to improve stealth and evasion capabilities. Key technical advancements include improvements to PteroLNK, a tool used to weaponize network drives, enabling more effective lateral movement and infection spread within targeted networks. The group also refined file exfiltration techniques, making data theft more efficient and harder to detect. Additionally, Gamaredon introduced new downloader malware variants to facilitate payload delivery. To evade network-based detection and blocking, the group increasingly leveraged Cloudflare tunnels to conceal its command and control (C2) infrastructure, complicating attribution and mitigation efforts. Despite these enhancements, Gamaredon exhibited some operational constraints, occasionally abandoning or infrequently updating certain tools, which may indicate resource limitations or shifting priorities. The threat actor’s focus on Ukrainian government entities, combined with its use of sophisticated evasion techniques and multi-vector infection methods, underscores its role as a state-aligned APT group engaged in espionage and disruption activities. No known public exploits have been reported, and the threat remains primarily targeted rather than opportunistic.

Detailed information about Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset. Get real-time updates, technical det

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset - Live Threat Intelligence - Threat Radar | OffSeq.com

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

Threats Tagged 'pterobox'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'pterobox'

Lead Pen Test Professional