Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

UNG0002, an espionage-focused threat group, has been conducting campaigns across Asian jurisdictions including China, Hong Kong, and Pakistan. The group employs sophisticated multi-stage attacks using LNK files, VBScript, and custom RAT implants. Their operations span two major campaigns: Operation Cobalt Whisper and Operation AmberMist, targeting various sectors such as defense, aviation, gaming, and academia. UNG0002 utilizes social engineering techniques like ClickFix and abuses DLL sideloading to evade detection. The group demonstrates high adaptability, evolving from using Cobalt Strike to developing custom implants like Shadow RAT and INET RAT. Attribution challenges persist, but the group is assessed to originate from South-East Asia with a focus on espionage activities.

UNG0002 (Unknown Group 0002) is an espionage-focused threat actor group conducting sophisticated multi-stage cyber campaigns primarily across Asian jurisdictions such as China, Hong Kong, and Pakistan. The group employs advanced social engineering tactics and technical methods to infiltrate target networks. Their attack vectors include the use of malicious LNK shortcut files and VBScript to initiate payload execution. They leverage DLL sideloading techniques, abusing legitimate Windows functionality to load malicious DLLs stealthily, thereby evading traditional detection mechanisms. UNG0002 has evolved from using publicly available tools like Cobalt Strike to deploying custom remote access trojans (RATs) such as Shadow RAT and INET RAT, indicating a high level of technical capability and adaptability. The campaigns, named Operation Cobalt Whisper and Operation AmberMist, target diverse sectors including defense, aviation, gaming, and academia, reflecting a broad espionage interest. The group also uses social engineering frameworks like ClickFix to trick users into executing malicious content. Despite attribution challenges, intelligence assesses the group’s origin as South-East Asia, with a clear focus on espionage activities. Indicators of compromise include numerous file hashes and a suspicious domain (moma.islamabadpk.site). The group’s tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as T1566.001 (Spearphishing), T1574.001 (DLL Side-loading), and T1059 (Command and Scripting Interpreter), among others. No known exploits in the wild or CVEs are associated with this campaign, but the threat remains active and evolving.

Detailed information about UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered. Get real-time updates, technical details, and mitigation strategies.

UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered - Live Threat Intelligence - Threat Radar | OffSeq.com

UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered

Threats Tagged 'rat implants'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'rat implants'

Lead Pen Test Professional