Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A highly targeted destructive wiper campaign dubbed 'Lotus Wiper' was discovered targeting the energy and utilities sector in Venezuela during late 2025 and early 2026. The attack begins with batch scripts coordinating execution across networks using domain shares as trigger mechanisms. These scripts disable security services, lock out users, and prepare the environment for the final payload. The Lotus Wiper systematically destroys data by wiping physical drives with zeros, deleting restore points, clearing USN journals, and recursively deleting files. Unlike ransomware, this wiper has no financial motivation or ransom demands, designed purely for data destruction. Evidence suggests attackers maintained long-term domain access prior to the attack, with the wiper compiled months before deployment. The malware targets older Windows systems and uses legitimate system tools like diskpart, robocopy, and fsutil.

Lotus Wiper is a destructive malware campaign targeting the energy and utilities sector in Venezuela, discovered in late 2025 and early 2026. It employs batch scripts that use domain shares as triggers to coordinate execution across networks. These scripts disable security services and lock out users to prepare the environment for the wiper payload. The malware systematically destroys data by zeroing physical drives, deleting system restore points, clearing USN journals, and recursively deleting files. It targets older Windows operating systems and uses legitimate Windows system tools such as diskpart, robocopy, and fsutil to carry out destructive actions. The campaign shows evidence of long-term domain access prior to the attack, with the malware compiled months before deployment. There are no ransom demands or financial motivations, indicating a purely destructive intent. No patches or official remediation guidance are available, and no known exploits in the wild have been reported.

Detailed information about Highly destructive Lotus Wiper used in a targeted attack. Get real-time updates, technical details, and mitigation strategies.

Highly destructive Lotus Wiper used in a targeted attack - Live Threat Intelligence - Threat Radar | OffSeq.com

Highly destructive Lotus Wiper used in a targeted attack

A sophisticated malware campaign delivering PureLog Stealer has been identified, targeting healthcare, government, hospitality, and education sectors in multiple countries. The attack uses localized copyright violation lures to trick victims into executing a multi-stage infection chain. The malware employs encrypted payloads, remote key retrieval, and fileless execution techniques to evade detection. It utilizes a Python-based loader and dual .NET loaders to run PureLog Stealer entirely in memory. The campaign incorporates AMSI bypass, registry persistence, screenshot capture, and victim fingerprinting for stealth and intelligence gathering. Evidence confirms communication with PureLog-associated infrastructure.

This threat involves a multi-stage malware campaign distributing the PureLog Stealer, a sophisticated information-stealing malware designed to target key industries such as healthcare, government, hospitality, and education. The attack begins with localized copyright violation-themed lures that trick victims into executing malicious payloads. The infection chain is complex, involving encrypted payloads and remote retrieval of keys to decrypt components, enhancing stealth. The malware employs fileless execution techniques, running entirely in memory via a Python-based loader and two .NET loaders, which helps evade traditional antivirus and endpoint detection systems. It incorporates an AMSI (Antimalware Scan Interface) bypass to avoid detection by Windows security features. Persistence is maintained through registry modifications, allowing the malware to survive reboots. The stealer captures screenshots and fingerprints the victim system to gather intelligence and tailor further attacks. Communication with command and control infrastructure associated with PureLog confirms active data exfiltration. Indicators of compromise include multiple file hashes, IP addresses, domains, and URLs used in the campaign. The campaign's use of multi-layered evasion and targeted lures indicates a high level of sophistication aimed at stealing sensitive information from critical sectors. Although no public exploits are currently known, the threat poses a significant risk due to its stealth and targeted nature.

Detailed information about Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries. Get real-time updates, technical details, and mitigation

Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries

		Threat	Source
Unrated	–	Highly destructive Lotus Wiper used in a targeted attack Unrated2026-04-21	AlienVault OTX General	2026-04-21
Unrated	–	Copyright Lures Mask a Multi-Stage PureLog Stealer Attack on Key Industries Unrated2026-03-20	AlienVault OTX General	2026-03-20

Threats Tagged 'targeted campaign'