Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious activities. The campaign targeted over 100 victims, primarily in Taiwan, Japan, South Korea, and Hong Kong. The threat actors also deployed Ghost RAT, a remote access trojan, for further system compromise. The attack methodology and victimology suggest a China-nexus threat actor, highlighting the need for improved security measures and vigilance against emerging threats.

This threat involves a sophisticated cyber intrusion campaign attributed to China-nexus threat actors, who exploit a vulnerable phpMyAdmin interface to gain initial access. The attackers deploy a web shell, commonly associated with tools like China Chopper and AntSword, enabling remote command execution on compromised servers. Subsequently, they install Nezha, an open-source server monitoring tool that has been repurposed for malicious activities, allowing attackers to maintain persistence, monitor system status, and execute further commands stealthily. The campaign also involves log poisoning techniques to evade detection by corrupting or manipulating log files, complicating forensic analysis. Additionally, the attackers deploy Ghost RAT, a remote access trojan, to facilitate deeper system compromise and data exfiltration. The attack chain includes multiple tactics and techniques mapped to MITRE ATT&CK IDs such as T1190 (Exploit Public-Facing Application), T1543.003 (Create or Modify System Process: Windows Service), T1059 (Command and Scripting Interpreter), and T1105 (Ingress Tool Transfer), indicating a multi-stage, persistent attack. Over 100 victims have been targeted, primarily in Taiwan, Japan, South Korea, and Hong Kong, focusing on organizations running vulnerable phpMyAdmin instances. Indicators of compromise include specific IP addresses, domains, and file hashes linked to the campaign. While no known exploits in the wild have been reported for this specific vulnerability, the use of publicly available tools and open-source software repurposed for malicious use increases the attack surface. The campaign highlights the evolving threat landscape where legitimate tools are weaponized by advanced persistent threat actors to evade detection and maintain long-term access.

Detailed information about The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors. Get real-time updates, technical details, and mitigation st

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors - Live Threat Intelligence - Threat Radar | OffSeq.com

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors

Threats Tagged 'server monitoring'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'server monitoring'

Lead Pen Test Professional