Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

GOLD BLADE, a threat group previously focused on cyberespionage, has evolved into a hybrid operation combining data theft with selective ransomware deployment. The group has refined its intrusion methods, shifting from traditional phishing to abusing recruitment platforms for delivering weaponized resumes. Their operations follow cycles of dormancy and sudden activity bursts, introducing new tradecraft in each wave. GOLD BLADE has modified its RedLoader infection chain multiple times, implemented a Bring Your Own Vulnerable Driver approach, and developed a custom ransomware called QWCrypt. The group's targeting has narrowed to focus primarily on Canadian organizations across various sectors. Their sophisticated tactics and continual refinement demonstrate a level of operational maturity uncommon among financially motivated actors.

GOLD BLADE is a sophisticated cyber threat group that has strategically evolved from a focus on cyberespionage to a hybrid model combining data theft and selective ransomware deployment. Their latest operations utilize a custom ransomware variant named QWCrypt, which is deployed selectively to maximize impact. The group has refined its intrusion tactics by moving away from traditional phishing campaigns to abusing recruitment platforms, delivering weaponized resumes as a novel infection vector. This shift allows them to bypass some conventional email security controls and target victims through trusted channels. The infection chain prominently features multiple modifications of the RedLoader malware, which is known for its loader capabilities, and the use of a Bring Your Own Vulnerable Driver (BYOVD) technique. BYOVD involves leveraging vulnerable legitimate drivers to bypass security controls such as kernel-mode code signing and endpoint detection systems, increasing stealth and persistence. GOLD BLADE operates in cycles of dormancy and sudden bursts of activity, each wave introducing new tradecraft and techniques, indicating a high level of operational maturity and adaptability. Their targeting is currently focused primarily on Canadian organizations across various sectors, suggesting a strategic or geopolitical motive. The group employs a wide range of tactics, techniques, and procedures (TTPs) including credential dumping, lateral movement, persistence mechanisms, and data exfiltration, as indicated by the referenced MITRE ATT&CK techniques (e.g., T1059 command execution, T1569 system services, T1486 ransomware). Despite the absence of known exploits in the wild and no CVSS score, the complexity and targeted nature of the threat underscore its potential risk. The group's use of recruitment platforms as an attack vector is particularly concerning as it exploits trust and complicates detection. This evolution reflects a trend where espionage-focused actors adopt financially motivated ransomware tactics, increasing the threat landscape complexity.

Detailed information about Sharpening the knife: strategic evolution of GOLD BLADE. Get real-time updates, technical details, and mitigation strategies.

Sharpening the knife: strategic evolution of GOLD BLADE - Live Threat Intelligence - Threat Radar | OffSeq.com

Sharpening the knife: strategic evolution of GOLD BLADE

Threats Tagged 'qwcrypt'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'qwcrypt'

Lead Pen Test Professional