Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated campaign by the Chinese APT group Silver Fox is targeting Indian entities with authentic-looking Income Tax phishing lures. The attack leverages a complex kill chain involving DLL hijacking and the modular Valley RAT to ensure persistence. The campaign uses a multi-stage infection process, starting with a malicious email containing a PDF decoy. The payload is delivered through an NSIS installer, which drops a legitimate Thunder.exe binary and a malicious libexpat.dll for DLL hijacking. The final stage involves the Valley RAT, which uses a two-stage configuration loading mechanism and implements a 3-tier C2 communication loop. The RAT's modular plugin architecture allows for dynamic capability extension and persistence through registry-based storage.

This threat involves a targeted campaign by the Chinese APT group Silver Fox focusing on Indian organizations through tax-themed phishing emails. The attack chain starts with a malicious email containing a PDF decoy designed to lure victims into executing an NSIS installer. This installer drops two key files: a legitimate Thunder.exe binary and a malicious libexpat.dll, which exploits DLL hijacking (technique T1574.001) to load the malicious DLL instead of the legitimate one. This hijacking enables the attacker to execute arbitrary code stealthily. The final payload is the Valley RAT, a modular remote access trojan that supports dynamic plugin loading, allowing the attacker to extend functionality as needed. Valley RAT uses a two-stage configuration loading mechanism and a sophisticated three-tier command and control (C2) communication loop to evade detection and maintain persistence. Persistence is further ensured through registry-based storage of configuration and modules. The campaign employs multiple MITRE ATT&CK techniques including phishing (T1566.001), DLL hijacking (T1574.001), execution through NSIS installers (T1218), and obfuscation (T1027). While the campaign currently targets Indian entities, the modular and stealthy nature of the malware could enable expansion or collateral compromise. Indicators of compromise include multiple file hashes, IP addresses, and domains associated with the C2 infrastructure. No CVE or known public exploits are reported, and the campaign is rated medium severity due to its complexity and targeted nature.

Detailed information about Silver Fox Targeting India Using Tax Themed Phishing Lures. Get real-time updates, technical details, and mitigation strategies.

Silver Fox Targeting India Using Tax Themed Phishing Lures - Live Threat Intelligence - Threat Radar | OffSeq.com

Silver Fox Targeting India Using Tax Themed Phishing Lures

Threats Tagged 'tax-themed'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'tax-themed'

Lead Pen Test Professional