Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report analyzes the activities of two threat actor clusters: TA829 and UNK_GreenSec. TA829 conducts both espionage and cybercrime operations using tools like SingleCamper and DustyHammock. UNK_GreenSec deploys TransferLoader malware leading to ransomware infections. The actors share similarities in infrastructure, delivery tactics, and lure themes, raising questions about their relationship. Four hypotheses are presented regarding their potential connection, ranging from shared third-party services to being the same actor. The report highlights the increasing overlap between cybercrime and espionage activities, making attribution more challenging in the current threat landscape.

This report examines the activities of two distinct but potentially related threat actor clusters: TA829 and UNK_GreenSec. TA829 is known for conducting both espionage and cybercrime operations, utilizing malware families such as SingleCamper and DustyHammock. UNK_GreenSec is associated with the deployment of TransferLoader malware, which serves as a loader for ransomware infections. The analysis highlights overlapping infrastructure, delivery tactics, and lure themes between these two actors, complicating attribution efforts. Four hypotheses are proposed regarding their relationship, ranging from the use of shared third-party services to the possibility that they are the same actor operating under different aliases. This convergence of espionage and cybercrime activities reflects a broader trend in the threat landscape, where traditional distinctions between state-sponsored and financially motivated attacks are increasingly blurred. The technical details include references to multiple MITRE ATT&CK techniques such as T1218.011 (signed binary proxy execution), T1587.001 (initial access via spearphishing), T1082 (system information discovery), and others, indicating sophisticated tactics for persistence, evasion, and lateral movement. Despite the lack of known exploits in the wild, the presence of ransomware deployment via TransferLoader underscores a significant risk to targeted organizations.

Detailed information about 10 Things I Hate About Attribution: RomCom vs. TransferLoader. Get real-time updates, technical details, and mitigation strategies.

10 Things I Hate About Attribution: RomCom vs. TransferLoader - Live Threat Intelligence - Threat Radar | OffSeq.com

10 Things I Hate About Attribution: RomCom vs. TransferLoader

Threats Tagged 'shadyhammock'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'shadyhammock'

Lead Pen Test Professional