Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Multiple phishing campaigns were identified using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The attacks used digitally signed executables masquerading as legitimate software to install remote monitoring and management (RMM) tools like ScreenConnect, Tactical RMM, and Mesh Agent. These tools enabled attackers to establish persistence and move laterally within compromised environments. The malware was signed using an Extended Validation certificate issued to TrustConnect Software PTY LTD. The campaigns demonstrate how familiar branding and trusted digital signatures can be exploited to bypass user suspicion and gain an initial foothold in enterprise networks.

This threat involves multiple phishing campaigns that distribute malware digitally signed with an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD. The signed malware masquerades as legitimate workplace meeting applications, leveraging trusted digital signatures to evade detection and user suspicion. The attackers use phishing emails containing workplace meeting lures and PDF attachments to deliver the payload. The malware installs remote monitoring and management (RMM) tools such as ScreenConnect, Tactical RMM, and Mesh Agent, which are legitimate software often used by IT administrators. By abusing these tools, attackers establish persistence mechanisms and enable lateral movement within compromised enterprise networks. The use of EV certificates is particularly notable because it increases the likelihood that security controls and users will trust the executables. The campaigns also abuse legitimate binaries to execute malicious code, further complicating detection. The tactics align with MITRE ATT&CK techniques including T1543.003 (Create or Modify System Process: Windows Service), T1553.002 (Code Signing), T1566 (Phishing), and others related to persistence, lateral movement, and defense evasion. Although no known exploits are reported in the wild, the threat demonstrates a sophisticated attack chain that combines social engineering, trusted code signing, and abuse of legitimate RMM tools to maintain access and control over targeted environments.

Detailed information about Signed malware impersonating workplace apps deploys RMM backdoors. Get real-time updates, technical details, and mitigation strategie

Signed malware impersonating workplace apps deploys RMM backdoors - Live Threat Intelligence - Threat Radar | OffSeq.com

Signed malware impersonating workplace apps deploys RMM backdoors

Threats Tagged 'tactical rmm'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'tactical rmm'

Lead Pen Test Professional