Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A recent leak from I-SOON, a Chinese IT and cybersecurity company, has revealed connections to several state-sponsored cyber groups including RedAlpha, RedHotel, and Poison Carp. The leak exposes a sophisticated espionage network involving the theft of communications data for individual tracking. Analysis confirms operational and organizational ties between I-SOON and these groups, highlighting I-SOON's role as a digital quartermaster providing shared cyber capabilities in China's aggressive cyber ecosystem. Despite the leak, I-SOON is expected to continue operations with minor adjustments. The revelation enhances understanding of Chinese cyber espionage and may impact future US legal actions against I-SOON operatives.

The threat involves the exposure of I-SOON, a Chinese IT and cybersecurity private contractor, which has been linked to multiple Chinese state-sponsored cyber espionage groups including RedAlpha, RedHotel, and Poison Carp. A recent leak from I-SOON revealed its operational and organizational ties to these groups, confirming its role as a digital quartermaster within China's cyber ecosystem. I-SOON provides shared cyber capabilities, facilitating sophisticated espionage campaigns primarily focused on the theft of communications data to enable individual tracking and intelligence gathering. The leak sheds light on the infrastructure and coordination behind these state-sponsored campaigns, which leverage advanced techniques and tools to infiltrate targets, maintain persistence, and exfiltrate sensitive information. Despite the leak, I-SOON is expected to continue its operations with minor adjustments, indicating resilience and adaptability. The campaign is characterized by the use of multiple tactics and techniques mapped to MITRE ATT&CK IDs such as T1583 (Acquire Infrastructure), T1592 (Gather Victim Host Information), T1589 (Gather Victim Network Information), T1596 (Search Open Technical Databases), T1102 (Web Service), T1608 (Stage Capabilities), T1590 (Gather Victim Identity Information), T1598 (Phishing for Information), T1588 (Obtain Capabilities), and T1587 (Develop Capabilities). These techniques highlight a comprehensive approach to cyber espionage, including infrastructure setup, reconnaissance, capability development, and data exfiltration. No known exploits are currently reported in the wild related to this leak, but the intelligence gained from the exposure could enable defenders to better understand and potentially disrupt these espionage operations. The leak also has implications for legal and geopolitical actions, particularly by the US, against I-SOON operatives and affiliated groups.

Detailed information about Private Contractor Linked to Multiple Chinese State-Sponsored Groups. Get real-time updates, technical details, and mitigation strate

Private Contractor Linked to Multiple Chinese State-Sponsored Groups - Live Threat Intelligence - Threat Radar | OffSeq.com

Private Contractor Linked to Multiple Chinese State-Sponsored Groups

Threats Tagged 'redalpha'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'redalpha'

Lead Pen Test Professional