Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated malware campaign is targeting financial services in Hong Kong with SquidLoader, a highly evasive malware that deploys Cobalt Strike Beacon for remote access. The malware exhibits advanced anti-analysis, anti-sandbox, and anti-debugging techniques, achieving near-zero detection rates on VirusTotal. The attack chain is complex and poses a significant threat to targeted organizations. The analysis provides detailed technical insights into SquidLoader's features and indicators of compromise, including SHA256 hashes for samples found in Hong Kong, Singapore, China, and Australia. The campaign utilizes multiple command and control servers, primarily mimicking Kubernetes API endpoints.

The SquidLoader malware campaign represents a sophisticated and targeted threat primarily aimed at financial institutions in Hong Kong, with observed samples also in Singapore, China, and Australia. SquidLoader is a highly evasive malware strain that deploys the Cobalt Strike Beacon payload to establish remote access and command-and-control (C2) capabilities. This malware employs advanced anti-analysis, anti-sandbox, and anti-debugging techniques to evade detection, achieving near-zero detection rates on VirusTotal, which indicates its stealth and sophistication. The attack chain is complex, leveraging multiple C2 servers that mimic Kubernetes API endpoints, a tactic designed to blend malicious traffic with legitimate cloud-native infrastructure communications, thereby complicating detection efforts. Indicators of compromise include multiple IP addresses and SHA256 hashes associated with the malware samples. The malware leverages various MITRE ATT&CK techniques such as system information discovery (T1082), file deletion (T1140), process injection (T1055), command execution (T1059), file and directory discovery (T1083), indicator removal on host (T1497), network traffic proxy (T1588.002), obfuscated files or information (T1027), and encrypted communication (T1573). The campaign's focus on financial services highlights its intent to infiltrate high-value targets, potentially for espionage, data theft, or financial fraud. Although no known exploits in the wild are reported, the complexity and stealth of SquidLoader pose a significant threat to organizations that may be unprepared for such advanced persistent threats.

Detailed information about New Wave of SquidLoader Malware Targeting Financial Institutions. Get real-time updates, technical details, and mitigation strategies

New Wave of SquidLoader Malware Targeting Financial Institutions - Live Threat Intelligence - Threat Radar | OffSeq.com

New Wave of SquidLoader Malware Targeting Financial Institutions

Threats Tagged 'squidloader'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'squidloader'

Lead Pen Test Professional