Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Leek Likho group (also known as SkyCloak or Vortex Werewolf) was first described by researchers in 2025, when a series of targeted attacks on public sector organizations in Russia and Belarus became known. This campaign was called Operation SkyCloak. We observed the continuation of its activity during February-April 2026, and also discovered a new technique that attackers use to filter files.

The Leek Likho group is a threat actor first described in 2025 for targeted attacks on public sector entities in Russia and Belarus under Operation SkyCloak. Their ongoing campaign in early 2026, dubbed Spring harvest, focuses on document theft using new file filtering methods. The group leverages communication platforms like Telegram and Dropbox and employs techniques including persistence (T1547), remote access (T1090), and command execution (T1059). No known exploits in the wild or affected software versions are specified.

SHA256 of f4d05a5cb783f1cdd179795125d23139

SHA256 of ffefe836255e742abc3dc692d1dda3a4

SHA256 of 873480ab887de3a9cbbcccb982747637

SHA256 of 0b6f7356919b9632c1158681ee0462f3

SHA256 of 4d5074d6e0722ceec45a083fa8444164

SHA256 of f1bc5841f6d6be1820848a7718bf4cce

SHA256 of f2b470dc3fcd8a2fd7860851a81f3eb0

SHA256 of 8dbeb747aab3d3814bcee52c3b0f6ee5

SHA256 of 3e3c5471c69e933fcffa4f497ca936b8

SHA256 of 99dc0dbaf5bd3918803391ec8d6d802c

SHA256 of 44652be9dc36c33ef0a35d4422523f7c

SHA256 of ac60971512c77f845cc4ec47400368a6

SHA256 of ab24e08da9e205ee3d3a5a2a05345cb9

SHA256 of 6a72ad3c06a29e12e668e8701daee00e

SHA256 of 57dbf8c275fa56b9a84e9c4b9a35399e

SHA256 of 99732e49668e56527963742922277459

SHA256 of 2156c270ffe8e4b23b67efed191b9737

SHA256 of a6d095dc0e01f97db7e74cb5bed402dc

SHA256 of 53ac08488544ad1fefd6363db44549cf

SHA256 of 6616717dfb2a795113b47d862c5412e2

SHA256 of 227b3fa386cad73f0f388d801060e2c8

SHA256 of 63426f624c930a756faf7ce3e7b4789f

SHA256 of 4b94efa49fb59a43ac4a9fdf04c87ef6

SHA256 of dea287ef5916eced7808ca3704ae67a6

SHA256 of 1ec5607bd9c37d6aabc43066fcb87ca6

Detailed information about Spring harvest - Leek Likho group's campaign to hunt for documents. Get real-time updates, technical details, and mitigation strategi

Threats Tagged 'skycloak'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'skycloak'

Lead Pen Test Professional