Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Gunra Ransomware is a double extortion group targeting global victims, excluding the US. They primarily attack Windows systems, recently expanding to Linux. The group uses phishing as their main vector and negotiates through a WhatsApp-themed chat panel. They can encrypt large files quickly using advanced stream ciphers. The Data Leak Site has undergone several changes, including a brief clearweb presence. Victims span multiple countries and industries, with South Korea, Brazil, and Japan topping the list. The ransomware shares code similarities with Conti and Akira, but newer versions appear unique. Negotiations reveal ambitious ransom demands, sometimes unrealistic. The group employs various evasion techniques and uses multiple MITRE ATT&CK tactics.

Gunra ransomware is a double extortion malware family actively targeting global victims outside the United States, with a primary focus on Windows systems and a recent expansion to Linux environments. The group behind Gunra employs phishing campaigns as their main initial infection vector, leveraging social engineering to deliver payloads. Once inside a network, Gunra ransomware rapidly encrypts large files using advanced stream cipher algorithms, enabling swift and effective data encryption. The ransomware exhibits code similarities with known families such as Conti and Akira, although recent variants show unique characteristics, indicating ongoing development and evasion efforts. The threat actors operate a data leak site that has undergone multiple changes, including a brief presence on the clear web, to pressure victims into ransom payment by threatening data exposure. Negotiations are conducted via a WhatsApp-themed chat panel, with ransom demands that can be ambitious or unrealistic. The group uses multiple evasion techniques and employs a broad range of MITRE ATT&CK tactics and techniques, including credential dumping (T1003), process injection (T1055), obfuscated files or information (T1027), lateral movement (T1071), and defense evasion (T1562), among others. The ransomware is associated with additional malware such as Lumma stealer and Donot loader, suggesting a multi-stage infection chain. Victims span multiple industries and countries, with South Korea, Brazil, and Japan being the most affected, highlighting the global reach and adaptability of the threat. No known exploits in the wild have been reported, and no specific affected software versions are identified, indicating that the threat relies heavily on social engineering and post-compromise techniques rather than exploiting software vulnerabilities directly.

Detailed information about GUNRA RANSOMWARE: What You Don't Know!. Get real-time updates, technical details, and mitigation strategies.

GUNRA RANSOMWARE: What You Don't Know! - Live Threat Intelligence - Threat Radar | OffSeq.com

GUNRA RANSOMWARE: What You Don't Know!

Threats Tagged 'ta0004'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ta0004'

Lead Pen Test Professional