Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

MuddyWater, an Iranian cyber espionage group linked to Iran's Ministry of Intelligence and Security, is deploying DCHSpy, an Android surveillanceware, amid the Israel-Iran conflict. DCHSpy is distributed via malicious VPN apps promoted on Telegram channels and is capable of extensive data collection including WhatsApp data, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have enhanced capabilities for exfiltrating data from specific files and WhatsApp. The malware's targeting appears to leverage StarLink-related lures, exploiting Iran's internet outages. DCHSpy shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This threat poses significant espionage risks to individuals in conflict zones and those using Android devices in targeted regions.

The Iranian cyber espionage group MuddyWater is actively leveraging DCHSpy, a sophisticated Android surveillanceware tool, in the context of the ongoing Israel-Iran conflict. DCHSpy is designed to infiltrate Android devices primarily through malicious VPN applications advertised on Telegram channels, a popular communication platform in the region. Once installed, DCHSpy collects a broad spectrum of sensitive data including WhatsApp messages and metadata, user accounts, contact lists, SMS messages, files stored on the device, geolocation data, and call logs. It also has capabilities to record audio and capture photos covertly, enabling comprehensive surveillance of the victim. Recent samples indicate that DCHSpy has evolved to exfiltrate data from specific files and WhatsApp more effectively, increasing its espionage potential. The malware’s distribution strategy includes leveraging StarLink-related lures, which exploit the disruption of internet services in Iran, making users more susceptible to installing malicious VPNs to regain connectivity. Additionally, DCHSpy shares command and control infrastructure with SandStrike, another Android malware linked to targeting Bahá’í practitioners, suggesting a broader campaign of targeted surveillance by Iranian threat actors. The use of Telegram for distribution and the focus on Android devices highlight the attackers’ adaptation to regional communication habits and device usage patterns. This campaign aligns with MuddyWater’s known tactics, techniques, and procedures (TTPs), including the use of social engineering (T1204.002), data from local system sources (T1596), and exploitation of network infrastructure (T1583.001). The threat is significant given its potential to compromise personal privacy, gather intelligence, and support geopolitical objectives in a highly volatile conflict zone.

Detailed information about MuddyWater Leveraging DCHSpy For Israel-Iran Conflict. Get real-time updates, technical details, and mitigation strategies.

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict - Live Threat Intelligence - Threat Radar | OffSeq.com

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

Threats Tagged 'sandstrike'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'sandstrike'

Lead Pen Test Professional