Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new campaign has been identified utilizing a valid digital signature from a Chinese technology company that remains unrevoked. The attack chain employs a dropper that retrieves an extension-based module list from command and control infrastructure. The malicious payloads exploit DLL Side-Loading techniques through a legitimate Tencent-signed executable to achieve code execution. The infrastructure includes Google Cloud Storage and a dedicated domain for command and control operations. Multiple components have been identified including an EXE dropper, DLL loader, DAT payload, and the legitimate Tencent executable used for side-loading purposes.

This campaign involves a sophisticated attack chain where a valid digital signature from a Chinese technology company is exploited to bypass security controls. The attacker uses a dropper to retrieve an extension-based module list from command and control servers hosted on Google Cloud Storage and a dedicated domain (api.keensie.com). The malicious payloads achieve code execution by abusing DLL side-loading techniques via a legitimate Tencent-signed executable. Multiple components such as an EXE dropper, DLL loader, and DAT payload are involved. The campaign is attributed to the APT-Q-27 threat actor group. No CVE or patch information is provided, and no known exploits in the wild are reported.

Detailed information about New APT-Q-27 sample spotted. Get real-time updates, technical details, and mitigation strategies.

New APT-Q-27 sample spotted - Live Threat Intelligence - Threat Radar | OffSeq.com

New APT-Q-27 sample spotted

In April 2026, Cato CTRL identified and blocked an attempted intrusion against a global manufacturing customer involving TencShell, a previously undocumented, Go-based implant derived from the open-source Rshell C2 framework. The activity appeared in traffic associated with a third-party user connected to the customer environment.

This threat involves TencShell, a newly identified malware implant written in Go and derived from the Rshell open-source command and control framework. It was used in an attempted intrusion against a global manufacturing organization, detected and blocked by Cato CTRL in April 2026. The activity was associated with a third-party user connected to the victim environment and is suspected to be linked to a China-based threat actor. There are no known public exploits or patches related to this malware, and it is not a cloud service. The malware's capabilities are implied by the associated MITRE ATT&CK techniques tags but are not explicitly detailed in the provided data.

MD5 of 01dc3e7e673b4f2682f29b19ecabf9a6ec9c3042c9b1cfb39dbdddf1dda680ab

MD5 of 12c6d0e603386b81751d95b32d1698d794c99343abb06d066b0f6060e8690aca

MD5 of 5d19c07e3fb7ac4ff56a23f6e658d691f381442b1db2f8c5f345563c1cdc8998

MD5 of cdb9d76093d0938f30d93bcce4f58b13b4b21c9188eea387c6d9ec6f4cb4aad4

MD5 of 3ffe3a6f328a6459624bd93edd206e2256b2753e17137cbc1530b91fa325ecac

MD5 of 065f5a605ac04d5f443089b65aa1393414ee38c4ee8f780e7d78c06b46504ae4

MD5 of 2a010bd1061e11da6f5cf951a3ebd23503916e159e3d486cc722b4b8b4a099c9

MD5 of ed6058f0b0735ba56b781dea39353625fcb56bc3e77bf2d26a648511d754d216

MD5 of 5eff99959683480d2280c931e433af836adf6a8b7a8489b1af17cddcf480cf63

MD5 of 7abc129482ccdf787b35b92b7d5b7ff2478e72fe516f4ceca0c02e23a1d34314

SHA1 of 3ffe3a6f328a6459624bd93edd206e2256b2753e17137cbc1530b91fa325ecac

SHA1 of 01dc3e7e673b4f2682f29b19ecabf9a6ec9c3042c9b1cfb39dbdddf1dda680ab

SHA1 of 065f5a605ac04d5f443089b65aa1393414ee38c4ee8f780e7d78c06b46504ae4

SHA1 of 12c6d0e603386b81751d95b32d1698d794c99343abb06d066b0f6060e8690aca

SHA1 of cdb9d76093d0938f30d93bcce4f58b13b4b21c9188eea387c6d9ec6f4cb4aad4

SHA1 of 5d19c07e3fb7ac4ff56a23f6e658d691f381442b1db2f8c5f345563c1cdc8998

SHA1 of 5eff99959683480d2280c931e433af836adf6a8b7a8489b1af17cddcf480cf63

SHA1 of 2a010bd1061e11da6f5cf951a3ebd23503916e159e3d486cc722b4b8b4a099c9

SHA1 of ed6058f0b0735ba56b781dea39353625fcb56bc3e77bf2d26a648511d754d216

SHA1 of 7abc129482ccdf787b35b92b7d5b7ff2478e72fe516f4ceca0c02e23a1d34314

Detailed information about Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware. Get r

Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware - Live Threat Intelligence - Threat Radar | OffSeq.com


New APT-Q-27 sample spotted 0 A new campaign has been identified utilizing a valid digital signature from a Chinese technology company that remains unrevoked. The attack chain employs a dropper that retrieves an extension-based module list from command and control infrastructure. The malicious payloads exploit DLL Side-Loading techniques through a legitimate Tencent-signed executable to achieve code execution. The infrastructure includes Google Cloud Storage and a dedicated domain for command and control operations. Multiple components have been identified including an EXE dropper, DLL loader, DAT payload, and the legitimate Tencent executable used for side-loading purposes. MediumCampaign#dropper #dll side-loading #chinese threat actor Join the discussion	AlienVault OTX General	06/17/2026, 08:46:02 UTC Added: 06/17/2026, 09:01:46 UTC
Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware 0 In April 2026, Cato CTRL identified and blocked an attempted intrusion against a global manufacturing customer involving TencShell, a previously undocumented, Go-based implant derived from the open-source Rshell C2 framework. The activity appeared in traffic associated with a third-party user connected to the customer environment. MediumMalware#cato ctrl #china-linked #tencshell Join the discussion	AlienVault OTX General	05/18/2026, 19:23:51 UTC Added: 05/18/2026, 19:36:38 UTC

Threats Tagged 'tencent'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'tencent'

Lead Pen Test Professional