Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign using the domain 'telegrampremium[.]app' is distributing a new variant of Lumma Stealer malware. The fake site mimics the official Telegram Premium platform and automatically downloads an executable file 'start.exe' upon access. This sophisticated information-stealing trojan can exfiltrate browser credentials, cryptocurrency wallet details, and system information. The malware employs various techniques for persistence, defense evasion, and data theft, including file system manipulation, registry modification, and clipboard operations. The campaign highlights the ongoing use of brand impersonation and social engineering for large-scale malware distribution, emphasizing the need for robust security measures and user awareness.

This threat involves a malicious campaign leveraging a fake website impersonating the official Telegram Premium platform, hosted at the domain 'telegrampremium.app'. Upon visiting the site, users are subjected to a drive-by download of an executable file named 'start.exe', which is a new variant of the Lumma Stealer malware. Lumma Stealer is an information-stealing trojan designed primarily for Windows systems. This malware is capable of exfiltrating sensitive data such as browser credentials, cryptocurrency wallet information, and detailed system information. The malware employs multiple advanced techniques to maintain persistence on infected systems, evade detection, and facilitate data theft. These techniques include manipulation of the file system, modification of Windows registry keys, clipboard data interception, and potentially process injection or obfuscation methods as indicated by the MITRE ATT&CK tags (e.g., T1055 - Process Injection, T1027 - Obfuscated Files or Information). The campaign exploits brand impersonation and social engineering tactics to lure victims into downloading the malware, highlighting the ongoing threat posed by fake websites mimicking trusted brands. Indicators of compromise include multiple file hashes, suspicious domains, and an IP address linked to the campaign. Although no known exploits in the wild are reported, the malware’s capability to steal credentials and cryptocurrency wallets poses a significant risk to affected users and organizations. The campaign underscores the importance of vigilance against phishing and drive-by download attacks, especially those exploiting popular platforms like Telegram.

Detailed information about FAKE TELEGRAM PREMIUM SITE DISTRIBUTES NEW LUMMA STEALER VARIANT. Get real-time updates, technical details, and mitigation strategies

FAKE TELEGRAM PREMIUM SITE DISTRIBUTES NEW LUMMA STEALER VARIANT - Live Threat Intelligence - Threat Radar | OffSeq.com

FAKE TELEGRAM PREMIUM SITE DISTRIBUTES NEW LUMMA STEALER VARIANT

Threats Tagged 't1198'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 't1198'

Lead Pen Test Professional