Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Over the course of three months, Volexity observed UTA0388 using various themes and fictional identities across dozens of spear phishing campaigns. As time passed, Volexity observed UTA0388 broaden their targeting and send emails in a variety of different languages, including English, Chinese, Japanese, French, and German. In most cases, the initial email sent by UTA0388 contained a link to phishing content hosted on a cloud-based service that would lead to malware.

The UTA0388 threat actor has been observed conducting targeted spear phishing campaigns over a three-month period, utilizing large language models (LLMs) to generate convincing and diverse phishing emails. These emails employ various fictional identities and themes, sent in multiple languages including English, Chinese, Japanese, French, and German, to broaden their reach and evade detection. The initial phishing emails typically contain links to cloud-hosted phishing sites that serve malware payloads. The malware uses PowerShell scripts and achieves persistence through scheduled tasks and hijacking execution flows. Command and control communications leverage advanced techniques such as WebSocket-based Govershell C2 channels, enabling stealthy and resilient remote control. The malware delivery often involves archive files (ZIP, RAR) to bypass security controls. The threat actor employs a wide range of MITRE ATT&CK techniques including T1071 (Application Layer Protocol), T1102 (Web Service), T1123 (Audio Capture), T1134 (Access Token Manipulation), T1036 (Masquerading), T1105 (Ingress Tool Transfer), T1059 (Command and Scripting Interpreter), T1574 (Hijack Execution Flow), T1053 (Scheduled Task), and T1566 (Phishing). Although no known exploits are currently in the wild, the campaign demonstrates a sophisticated blend of social engineering and technical exploitation, leveraging LLMs to enhance phishing effectiveness and evade traditional detection methods. The use of multiple languages and cloud infrastructure indicates a broad targeting strategy, likely aiming at high-value organizations globally, including Europe.

MD5 of fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861

SHA1 of fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861

Detailed information about APT Meets GPT: Targeted Operations with Untamed LLMs. Get real-time updates, technical details, and mitigation strategies.

APT Meets GPT: Targeted Operations with Untamed LLMs - Live Threat Intelligence - Threat Radar | OffSeq.com

APT Meets GPT: Targeted Operations with Untamed LLMs

Threats Tagged 'randomdir8char'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'randomdir8char'

Lead Pen Test Professional