Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Check Point Research

Kaspersky Security Blog

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

BERT Ransomware, active since March 2025, has expanded its operations to target both Windows and Linux environments. The group uses phishing for initial access and communicates via the dark web and Sessions for negotiations. Victims span multiple countries, primarily affecting service and manufacturing sectors. The Windows variant employs multiple file extensions and RSA encryption, while the Linux version shares code with Sodinokibi/REvil ransomware. A weaponized PowerShell script is used to disable security features before payload execution. The ransomware's infrastructure is linked to a Russian firm, suggesting potential ties to the region.

BERT Ransomware, active since March 2025, represents a sophisticated ransomware campaign targeting both Windows and Linux environments. The threat actors behind BERT employ phishing emails as their primary initial access vector, leveraging social engineering to trick users into executing malicious payloads. Once inside a network, the ransomware uses a weaponized PowerShell script to disable security features such as antivirus and endpoint detection and response (EDR) tools, facilitating unhindered payload execution. The Windows variant of BERT ransomware encrypts victim files using RSA encryption and appends multiple file extensions to encrypted files, complicating recovery efforts. The Linux variant shares significant code overlap with the notorious Sodinokibi/REvil ransomware, indicating possible code reuse or collaboration. Communication and ransom negotiations occur via dark web portals and the Sessions encrypted messaging platform, enhancing the attackers' anonymity and operational security. The ransomware primarily targets organizations in the service and manufacturing sectors across multiple countries. The infrastructure supporting BERT ransomware is linked to a Russian firm, suggesting potential geopolitical motivations or origin. Indicators of compromise include numerous file hashes associated with the ransomware binaries and two onion domains used for command and control or negotiation purposes. Although no known exploits are reported in the wild, the campaign's use of phishing and PowerShell-based disabling of defenses indicates a high level of operational sophistication and adaptability across different operating systems.

Detailed information about BERT RANSOMWARE - THE RAVEN FILE. Get real-time updates, technical details, and mitigation strategies.

BERT RANSOMWARE - THE RAVEN FILE - Live Threat Intelligence - Threat Radar | OffSeq.com

BERT RANSOMWARE - THE RAVEN FILE

Threats Tagged 'revil'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'revil'

Lead Pen Test Professional