Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated cyber attack targeting the defense sector was identified in October 2025, utilizing a weaponized ZIP archive disguised as a military document. The multi-stage attack employs advanced evasion techniques and deploys a complex infrastructure combining OpenSSH for Windows with a customized Tor hidden service. The malware establishes persistent backdoor access, allowing anonymous remote access via SSH, RDP, SFTP, and SMB protocols. The lure document targets Belarusian Air Force drone experts, suggesting intelligence gathering on regional UAV capabilities. The attack's tactics, techniques, and procedures align with those of Sandworm (APT44), a Russian-linked APT group, although definitive attribution remains uncertain at this stage.

This threat represents a highly sophisticated cyber espionage campaign identified in October 2025, targeting the defense sector with a focus on Belarusian Air Force drone experts. The attack vector is a weaponized ZIP archive masquerading as a military document, designed to lure victims into executing malicious payloads. The malware establishes a persistent backdoor by deploying OpenSSH for Windows combined with a customized Tor hidden service infrastructure, enabling anonymous remote access. This backdoor supports multiple protocols including SSH, RDP, SFTP, and SMB, allowing attackers to conduct reconnaissance, data exfiltration, and lateral movement while evading traditional network defenses. The use of Tor obfuscates command and control communications, complicating detection and attribution. The campaign employs advanced evasion techniques such as process injection, obfuscated payloads, and scheduled task manipulation (T1053.005), consistent with known Sandworm (APT44) tactics, although definitive attribution is pending. Indicators of compromise include numerous file hashes, Tor .onion domains, and an IP address linked to the infrastructure. The attack’s complexity and targeted nature suggest a well-resourced adversary aiming at strategic intelligence gathering on UAV operations. No CVE or known exploits in the wild have been reported, indicating a potentially novel or custom toolset. The campaign’s medium severity rating reflects its targeted impact and operational sophistication.

Detailed information about Weaponized Military Documents Deliver Advanced SSH-Tor Backdoor. Get real-time updates, technical details, and mitigation strategies.

Weaponized Military Documents Deliver Advanced SSH-Tor Backdoor - Live Threat Intelligence - Threat Radar | OffSeq.com

Weaponized Military Documents Deliver Advanced SSH-Tor Backdoor

Threats Tagged 'ssh-tor backdoor'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ssh-tor backdoor'

Lead Pen Test Professional