Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new phishing campaign targeting healthcare and IT organizations in Russia has been attributed to the Rainbow Hyena cluster. The attackers used compromised email addresses to distribute malicious attachments, including polyglot files and LNK files mimicking legitimate documents. A new custom-built backdoor called PhantomRemote was identified, capable of system information gathering and command execution. The campaign demonstrates a shift in tactics, with threat actors abandoning traditional malicious documents in favor of alternative formats. The sophistication of the tools and techniques suggests a move towards more conventional illicit activities such as espionage and financial gain.

The Rainbow Hyena threat actor cluster has launched a new phishing campaign targeting healthcare and IT organizations in Russia, employing a shift in tactics and novel malware tools. Unlike previous campaigns that relied on traditional malicious document attachments, this campaign uses compromised email addresses to distribute polyglot files and LNK shortcut files that masquerade as legitimate documents. These alternative file formats help evade detection by conventional security solutions that focus on common document exploits. The campaign delivers a newly identified custom backdoor named PhantomRemote, which provides capabilities for system information gathering and remote command execution. This backdoor enables the attackers to maintain persistence, conduct reconnaissance, and execute arbitrary commands on compromised systems. The use of polyglot and LNK files indicates a sophisticated approach to social engineering and evasion, leveraging Windows shortcut files that can execute commands when clicked, and polyglot files that can be interpreted in multiple ways to bypass security filters. The campaign’s tactics align with MITRE ATT&CK techniques such as T1566 (phishing), T1204 (user execution), T1082 (system information discovery), T1059.003 (command and scripting interpreter: Windows Command Shell), and T1105 (ingress tool transfer). The shift away from traditional malicious documents towards alternative file formats and the deployment of a custom backdoor suggest an evolution in Rainbow Hyena’s operational methods, possibly reflecting a move towards more conventional cyber espionage and financially motivated intrusions. While currently observed in Russia, the sophistication and targeting of healthcare and IT sectors highlight the potential for broader impact if the campaign expands geographically or sector-wise.

Detailed information about Rainbow Hyena strikes again: new backdoor and shift in tactics. Get real-time updates, technical details, and mitigation strategies.

Rainbow Hyena strikes again: new backdoor and shift in tactics - Live Threat Intelligence - Threat Radar | OffSeq.com

Rainbow Hyena strikes again: new backdoor and shift in tactics

Threats Tagged 'rainbow hyena'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'rainbow hyena'

Lead Pen Test Professional