Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A South Asian APT group has been consistently targeting Sri Lanka, Bangladesh, Pakistan, and Turkey. The operation involves phishing campaigns using military-themed lures to compromise phones of military personnel. The attackers employ various tactics, including PDF phishing documents, fake login pages for government and military organizations, and malicious Android apps. The Android malware, based on the Rafel Rat, steals information and provides remote access. Victims are primarily from South Asian countries, with stolen data including SMS messages, contact lists, and documents. The operation also uses Windows malware with the same command and control infrastructure.

The UNC Cluster represents a persistent threat actor group identified as a South Asian Advanced Persistent Threat (APT) targeting primarily military personnel in South Asian countries including Sri Lanka, Bangladesh, Pakistan, and Turkey. The group employs sophisticated phishing campaigns leveraging military-themed lures to compromise mobile devices, particularly Android phones. The attack vectors include PDF phishing documents and fake login pages impersonating government and military organizations, designed to deceive victims into divulging credentials or installing malicious applications. The Android malware used is based on the Rafel RAT (Remote Access Trojan), which enables attackers to steal sensitive information such as SMS messages, contact lists, and documents, and maintain persistent remote access to compromised devices. In addition to Android malware, the threat actor also deploys Windows malware that shares the same command and control (C2) infrastructure, indicating a coordinated multi-platform campaign. The phishing techniques correspond to MITRE ATT&CK techniques T1566 (Phishing), T1566.001 (Spearphishing Attachment), and T1566.002 (Spearphishing Link). Although no known exploits are reported in the wild, the operation's use of credential theft and information stealing malware poses significant risks to confidentiality and operational security of targeted military personnel. The campaign's focus on military-themed lures and targeting of military personnel suggests a strategic intelligence-gathering objective, consistent with APT behavior. The lack of affected software versions and patch links indicates this is a social engineering and malware-based threat rather than a software vulnerability exploitation. The threat is assessed as medium severity based on the information provided.

Detailed information about UNC Cluster Targeting South Asian Countries. Get real-time updates, technical details, and mitigation strategies.

UNC Cluster Targeting South Asian Countries - Live Threat Intelligence - Threat Radar | OffSeq.com

UNC Cluster Targeting South Asian Countries

Threats Tagged 'south asian apt'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'south asian apt'

Lead Pen Test Professional