Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A newly identified threat actor, Water Curse, is exploiting GitHub to deliver weaponized repositories containing multistage malware. The group has been linked to at least 76 GitHub accounts, targeting cybersecurity professionals, game developers, and DevOps teams. Their malware enables data exfiltration, remote access, and long-term persistence on infected systems. The attack begins with trojanized open-source tools, progresses through complex infection chains using obfuscated scripts, and culminates in extensive system reconnaissance and data theft. Water Curse employs anti-debugging techniques, privilege escalation methods, and persistence mechanisms to maintain control over affected systems. The campaign poses a significant supply chain risk, especially to those relying on open-source tooling from GitHub.

The threat actor known as Water Curse has been identified exploiting the GitHub platform to distribute weaponized open-source repositories containing multistage malware. This campaign involves at least 76 GitHub accounts that have been used to target cybersecurity professionals, game developers, and DevOps teams. The attack vector begins with trojanized open-source tools, which appear legitimate but contain malicious payloads. Once a victim clones or downloads these repositories, the infection chain activates through obfuscated scripts that evade detection and analysis. The malware employs advanced anti-debugging techniques to hinder reverse engineering and forensic efforts. It also uses privilege escalation exploits to gain higher system permissions, enabling the attacker to establish persistence mechanisms that maintain long-term access to compromised systems. The malware conducts extensive system reconnaissance to gather detailed information about the environment and exfiltrates sensitive data back to the attacker. The campaign represents a significant supply chain risk, as it leverages the trust and widespread use of open-source tooling on GitHub, potentially impacting a broad range of organizations that rely on these resources. The malware's capabilities include remote access, data theft, and stealthy persistence, making it a sophisticated threat that can compromise confidentiality, integrity, and availability of targeted systems. Indicators of compromise include multiple malicious URLs, domains, and file hashes associated with the campaign. The attack techniques correspond to numerous MITRE ATT&CK tactics and techniques such as scheduled task execution (T1053.005), data from local system (T1005), credential dumping (T1003), and obfuscated files or information (T1027), among others. No known exploits in the wild have been reported yet, but the complexity and stealth of the malware suggest a high potential for future exploitation.

Detailed information about Clone, Compile, Compromise: Open-Source Malware Trap on GitHub. Get real-time updates, technical details, and mitigation strategies.

Clone, Compile, Compromise: Open-Source Malware Trap on GitHub - Live Threat Intelligence - Threat Radar | OffSeq.com

Clone, Compile, Compromise: Open-Source Malware Trap on GitHub

Threats Tagged 't1089'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 't1089'

Lead Pen Test Professional