Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Cavalry Werewolf, a malicious actor group, targeted Russian state agencies and enterprises in the energy, mining, and manufacturing sectors from May to August 2025. The attackers used targeted phishing emails, posing as Kyrgyz government officials, to gain initial access. They employed custom malware, including FoalShell reverse shells and StallionRAT, controlled via Telegram. The group impersonated or compromised real email accounts from Kyrgyz agencies. Their arsenal includes various versions of FoalShell (Go, C++, C#) and StallionRAT (Go, PowerShell, Python). The attackers executed commands for system reconnaissance, file uploads, and SOCKS5 proxying. Evidence suggests potential expansion to targets in Tajikistan and Middle Eastern countries.

The threat actor group known as Cavalry Werewolf conducted a targeted cyber espionage campaign against Russian public sector entities, specifically focusing on state agencies and enterprises within the energy, mining, and manufacturing sectors from May to August 2025. The attackers leveraged trusted relationship attacks by impersonating Kyrgyz government officials in spear-phishing campaigns to gain initial access. This social engineering tactic involved sending highly targeted phishing emails that appeared to originate from legitimate Kyrgyz agencies, sometimes by compromising real email accounts, thereby increasing the likelihood of successful compromise. Once inside the network, the attackers deployed custom malware tools, primarily FoalShell and StallionRAT, which are remote access trojans (RATs) with multiple language variants (Go, C++, C#, PowerShell, Python). FoalShell functions as a reverse shell, enabling the attackers to execute arbitrary commands, perform system reconnaissance, upload files, and establish SOCKS5 proxy tunnels to pivot within the network. StallionRAT complements these capabilities with additional remote control features and is controlled via Telegram, indicating the use of a popular messaging platform for command and control (C2) communications, which can help evade traditional detection mechanisms. The attackers executed a range of tactics consistent with MITRE ATT&CK techniques such as T1566 (phishing), T1082 (system information discovery), T1049 (network reconnaissance), T1071.001 (application layer protocol: Web protocols), and T1547.001 (boot or logon autostart execution). Although the campaign primarily targeted Russian entities, there is evidence suggesting potential expansion to neighboring countries like Tajikistan and some Middle Eastern nations. No known exploits in the wild or specific vulnerable software versions were identified, indicating the attack relies heavily on social engineering and custom malware rather than exploiting publicly disclosed vulnerabilities.

Detailed information about Werewolf raids Russia's public sector with trusted relationship attacks. Get real-time updates, technical details, and mitigation str

Werewolf raids Russia's public sector with trusted relationship attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

Werewolf raids Russia's public sector with trusted relationship attacks

Threats Tagged 'stallionrat'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'stallionrat'

Lead Pen Test Professional