Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Android banking trojan named RatOn has emerged, combining NFC relay attacks with remote access and automated transfer capabilities. Discovered by analysts monitoring the NFSkate threat group, RatOn targets cryptocurrency wallets and banking applications, particularly in the Czech Republic and Slovakia. The malware is distributed through adult-themed websites and employs a multi-stage infection process. RatOn features overlay attacks, automated money transfers, and cryptocurrency wallet takeovers. It demonstrates sophisticated capabilities, including screen casting, PIN interception, and extensive bot commands. The trojan's evolution from a basic NFC relay tool to a complex RAT with ATS functionality makes it a significant threat in the mobile malware landscape.

RatOn is a newly identified Android banking trojan that represents a significant evolution in mobile malware capabilities. Initially emerging as a tool focused on NFC relay attacks, RatOn has developed into a sophisticated Remote Access Trojan (RAT) with Automated Transfer System (ATS) functionalities. The malware is primarily distributed through adult-themed websites, employing a multi-stage infection process to evade detection and maximize infection success. Once installed, RatOn targets cryptocurrency wallets and banking applications, with a particular focus on users in the Czech Republic and Slovakia. Its capabilities include overlay attacks that deceive users by displaying fake login screens, automated money transfers that facilitate stealthy theft without user intervention, and cryptocurrency wallet takeovers. Additionally, RatOn can intercept PIN codes, perform screen casting to monitor user activity in real-time, and execute a wide range of bot commands, allowing attackers extensive control over infected devices. The malware’s evolution from a simple NFC relay tool to a complex RAT with ATS features highlights its adaptability and the increasing sophistication of mobile banking threats. The involvement of the NFSkate threat group, known for targeting financial assets, underscores the targeted and strategic nature of this campaign. Although no known exploits in the wild have been reported beyond the infection vector, the threat posed by RatOn is considerable due to its multi-faceted attack techniques and focus on high-value financial targets.

Detailed information about The Rise of RatOn: From NFC heists to remote control and ATS. Get real-time updates, technical details, and mitigation strategies.

The Rise of RatOn: From NFC heists to remote control and ATS - Live Threat Intelligence - Threat Radar | OffSeq.com

The Rise of RatOn: From NFC heists to remote control and ATS

Threats Tagged 'ta0027'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ta0027'

Lead Pen Test Professional