Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A suspicious Python package named termncolor was discovered, which imports a malicious dependency called colorinal. This multi-stage malware operation leverages DLL sideloading to decrypt payloads, establish persistence, and conduct command-and-control communication, ultimately leading to remote code execution. The attack begins with the execution of terminate.dll, which decrypts and deploys two files: vcpktsvr.exe and libcef.dll. The malware achieves persistence through a registry entry and gathers system information. It communicates with a C2 server using Zulip traffic patterns for disguise. The threat actor's profile and activities on the Zulip platform were analyzed, revealing patterns in their tactics and behavior.

The threat involves a supply chain attack targeting the Python ecosystem through a malicious package named 'termncolor' found on PyPI, which deceptively imports another malicious dependency called 'colorinal'. This multi-stage malware campaign employs DLL sideloading techniques to execute its payloads stealthily. The attack initiates with the execution of a malicious DLL named 'terminate.dll', which decrypts and deploys two additional files: 'vcpktsvr.exe' and 'libcef.dll'. These components work together to establish persistence on the infected system by creating a registry entry, enabling the malware to survive system reboots. The malware collects system information to profile the infected environment and communicates with its command-and-control (C2) server using traffic patterns that mimic Zulip, an open-source team chat platform, to evade network detection and blend in with legitimate traffic. The use of Zulip traffic patterns for C2 communication is a sophisticated evasion technique that complicates detection by traditional network monitoring tools. The campaign leverages several tactics and techniques identified by MITRE ATT&CK, including system information discovery (T1082), command and control over application layer protocols (T1071), DLL side-loading (T1073), process injection (T1055), and persistence mechanisms (T1053). Although no known exploits are reported in the wild yet, the campaign demonstrates a high level of operational security and complexity, indicating a potentially targeted and stealthy threat actor. The malicious packages exploit the trust placed in open-source Python packages, highlighting the risks inherent in software supply chains, especially in widely used ecosystems like PyPI.

Detailed information about Supply Chain Risk in Python: Termcolor and Colorama Explained. Get real-time updates, technical details, and mitigation strategies.

Supply Chain Risk in Python: Termcolor and Colorama Explained - Live Threat Intelligence - Threat Radar | OffSeq.com

Supply Chain Risk in Python: Termcolor and Colorama Explained

Threats Tagged 't1085'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 't1085'

Lead Pen Test Professional