Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors, and uses a driver with a compromised certificate to terminate processes and services. The report details the tool's characteristics, its connection to ransomware attacks, and provides examples of its use in specific ransomware families. Notably, the report highlights evidence of tool sharing and technical knowledge transfer among competing ransomware groups, suggesting a more complex ecosystem than previously thought.

The threat described, known as AVKiller, is a sophisticated malware tool specifically designed to disable Endpoint Detection and Response (EDR) systems on compromised hosts. AVKiller has been observed in multiple ransomware campaigns since 2022, indicating its active use in the wild by various ransomware groups. The tool operates by leveraging a malicious driver signed with a compromised certificate, allowing it to terminate critical security processes and services stealthily. This capability effectively neutralizes endpoint security defenses, enabling ransomware payloads to execute with reduced risk of detection or interruption. AVKiller targets a broad range of security vendors, demonstrating a high level of adaptability and technical sophistication. The malware is heavily protected, likely employing obfuscation and anti-analysis techniques to evade detection and reverse engineering. The report also highlights an ecosystem of threat sharing and technical knowledge transfer among competing ransomware groups, suggesting that AVKiller or its components are shared or sold within underground markets, increasing its proliferation and complicating attribution. The tactics employed by AVKiller align with multiple MITRE ATT&CK techniques, including process injection, masquerading, disabling security tools, and use of signed drivers to bypass security controls. Although no specific affected software versions or patches are listed, the presence of a compromised certificate and driver-based approach indicates a high level of sophistication and persistence. The lack of known exploits in the wild for this tool suggests it is primarily deployed post-compromise as part of the ransomware kill chain rather than as an initial attack vector.

Detailed information about Shared secret: EDR killer in the kill chain. Get real-time updates, technical details, and mitigation strategies.

Shared secret: EDR killer in the kill chain - Live Threat Intelligence - Threat Radar | OffSeq.com

Shared secret: EDR killer in the kill chain

Threats Tagged 'threat-sharing'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'threat-sharing'

Lead Pen Test Professional