Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Salesforce Gainsight Security Advisory - Nov 2025

This advisory concerns a malware threat associated with the ransomware group Scattered Lapsus$ Hunters targeting Salesforce Gainsight environments. The threat leverages multiple MITRE ATT&CK techniques including active scanning (T1595) to identify vulnerable targets, abuse of application access tokens (T1527) to gain unauthorized access, and compromise of cloud accounts (T1078.004) and valid accounts (T1078) to escalate privileges and maintain persistence. The attack chain likely begins with reconnaissance via active scanning to identify exposed services or misconfigurations, followed by leveraging stolen or weakly protected application access tokens to infiltrate cloud environments. Once inside, attackers use valid credentials to move laterally and deploy ransomware payloads, encrypting data and demanding ransom. The advisory notes no available patches or confirmed exploits in the wild, indicating the threat is emerging or under observation. The 50% certainty rating reflects moderate confidence in the intelligence. The threat is particularly relevant to organizations heavily reliant on Salesforce Gainsight and cloud infrastructure, where token and account security are critical. The ransomware group’s tactics suggest a focus on cloud SaaS environments, emphasizing the need for robust identity and access management controls. The advisory’s tagging and categorization align with known ransomware behaviors and cloud attack vectors, underscoring the importance of monitoring for suspicious scanning and token misuse activities.

Detailed information about Salesforce Gainsight Security Advisory - Nov 2025. Get real-time updates, technical details, and mitigation strategies.

Salesforce Gainsight Security Advisory - Nov 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

DragonForce, a ransomware-as-a-service group active since 2023, has rebranded as a cartel and formed alliances with groups like Scattered Spider, LAPSUS$, and ShinyHunters. The group uses Conti-derived code and employs BYOVD attacks to terminate processes. DragonForce has expanded its affiliate program, allowing partners to white-label payloads and create variants. The group has exposed over 200 victims on its leak site, targeting various sectors. DragonForce's partnership with Scattered Spider, known for sophisticated social engineering techniques, has led to high-profile breaches. The group's ransomware samples show significant overlap with Conti's leaked source files and use ChaCha20 encryption.

DragonForce is a ransomware-as-a-service cartel that emerged in 2023, evolving from a traditional ransomware group into a more complex organization by forming alliances with other cybercriminal groups like Scattered Spider, LAPSUS$, and ShinyHunters. This coalition enhances their capabilities, particularly in social engineering and initial access techniques. DragonForce ransomware is based on Conti's leaked source code, sharing significant code overlap and using ChaCha20 encryption to secure victim data, making decryption without keys extremely difficult. The group employs BYOVD attacks, which involve loading vulnerable drivers to disable or terminate security software processes, thereby evading detection and increasing the success rate of their ransomware deployment. Their affiliate program allows partners to white-label ransomware payloads and create customized variants, increasing the diversity and reach of attacks. DragonForce has publicly exposed over 200 victims on their leak site, targeting a broad range of sectors globally, indicating a widespread and persistent threat. The partnership with Scattered Spider, known for sophisticated social engineering and credential theft techniques, has led to high-profile breaches, demonstrating the cartel's ability to combine technical and human attack vectors effectively. Although there are no known exploits in the wild specifically tied to this ransomware, the group's tactics, techniques, and procedures (TTPs) align with advanced persistent threat behaviors, including credential dumping, lateral movement, and process termination to disable defenses. The threat is ongoing and dynamic, with continuous evolution in payload variants and attack methods.

Detailed information about The DragonForce Cartel: Scattered Spider at the gate. Get real-time updates, technical details, and mitigation strategies.

The DragonForce Cartel: Scattered Spider at the gate - Live Threat Intelligence - Threat Radar | OffSeq.com

The DragonForce Cartel: Scattered Spider at the gate


Salesforce Gainsight Security Advisory - Nov 2025 0 Salesforce Gainsight Security Advisory - Nov 2025 MediumMalwareUnited KingdomGermanyFrance+3#recorded-future:threat-actor=scattered lapsus$ hunters #ransomware #scattered spider Join the discussion	CIRCL OSINT Feed	11/26/2025, 00:00:00 UTC Added: 11/29/2025, 08:19:38 UTC
The DragonForce Cartel: Scattered Spider at the gate 0 DragonForce, a ransomware-as-a-service group active since 2023, has rebranded as a cartel and formed alliances with groups like Scattered Spider, LAPSUS$, and ShinyHunters. The group uses Conti-derived code and employs BYOVD attacks to terminate processes. DragonForce has expanded its affiliate program, allowing partners to white-label payloads and create variants. The group has exposed over 200 victims on its leak site, targeting various sectors. DragonForce's partnership with Scattered Spider, known for sophisticated social engineering techniques, has led to high-profile breaches. The group's ransomware samples show significant overlap with Conti's leaked source files and use ChaCha20 encryption. MediumMalwareGermanyFranceUnited Kingdom+5#conti #dragonforce #social engineering Join the discussion	AlienVault OTX General	11/05/2025, 09:36:15 UTC Added: 11/07/2025, 09:22:45 UTC

Threats Tagged 'scattered spider'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'scattered spider'

Lead Pen Test Professional