Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The provided threat intelligence pertains to a malware-related entry titled "ThreatFox IOCs for 2025-06-15," sourced from the ThreatFox MISP feed. The threat is categorized primarily under OSINT (Open Source Intelligence), network activity, and payload delivery. The absence of specific affected versions or products suggests this intelligence is focused on indicators of compromise (IOCs) rather than a vulnerability in a particular software product. The technical details indicate a moderate threat level (threatLevel: 2 on an unspecified scale), with some analysis performed (analysis: 1) and a moderate distribution level (distribution: 3), implying that the threat or its indicators are somewhat widespread but not pervasive. No known exploits are currently in the wild, and no patches are available or applicable, which aligns with the nature of OSINT-related malware indicators rather than a software vulnerability. The lack of CWEs (Common Weakness Enumerations) further supports that this is not a software flaw but rather a threat intelligence feed entry highlighting malicious network activity or payload delivery mechanisms. The threat is tagged with "tlp:white," indicating that the information is intended for unrestricted sharing, which is typical for OSINT data. Overall, this entry appears to be a collection or update of IOCs related to malware activities observed or anticipated around mid-June 2025, intended to aid detection and response efforts rather than describing a novel or exploitable vulnerability.

Cobalt Strike botnet C2 server (confidence level: 75%)

Unknown malware payload delivery domain (confidence level: 100%)

Unknown malware payload delivery URL (confidence level: 100%)

Cobalt Strike botnet C2 server (confidence level: 100%)

Remcos botnet C2 server (confidence level: 100%)

Sliver botnet C2 server (confidence level: 100%)

AsyncRAT botnet C2 server (confidence level: 100%)

Unknown malware botnet C2 server (confidence level: 100%)

Venom RAT botnet C2 server (confidence level: 100%)

NetSupportManager RAT botnet C2 server (confidence level: 100%)

MimiKatz botnet C2 server (confidence level: 100%)

Latrodectus botnet C2 server (confidence level: 90%)

NjRAT botnet C2 server (confidence level: 100%)

Cobalt Strike botnet C2 domain (confidence level: 75%)

Cobalt Strike botnet C2 domain (confidence level: 100%)

Ghost RAT botnet C2 server (confidence level: 75%)

Havoc botnet C2 server (confidence level: 100%)

Nimplant botnet C2 domain (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-06-15. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-15 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-15

The provided threat information pertains to a malware-related intelligence report titled "ThreatFox IOCs for 2025-06-14," sourced from the ThreatFox MISP Feed. This report focuses on indicators of compromise (IOCs) related to OSINT (Open Source Intelligence) activities, network activity, and payload delivery mechanisms. The threat is categorized primarily under OSINT and network activity, suggesting that it involves the collection or exploitation of publicly available information combined with network-based delivery of malicious payloads. No specific affected product versions are listed, indicating that this threat is not tied to a particular software vulnerability but rather to tactics, techniques, and procedures (TTPs) that leverage OSINT for reconnaissance or initial access. The absence of known exploits in the wild and lack of available patches further imply that this threat may be emerging or primarily focused on information gathering and delivery rather than exploiting a specific software flaw. The technical details indicate a moderate threat level (threatLevel: 2) with a distribution score of 3, suggesting a moderate spread or targeting scope. The analysis score of 1 may reflect limited detailed technical dissection or early-stage intelligence. The lack of concrete indicators (IOCs) in the report limits the ability to pinpoint exact attack vectors or payload specifics. Overall, this threat appears to be a medium-severity malware campaign or activity leveraging OSINT techniques to facilitate network-based payload delivery, potentially serving as a precursor to more targeted attacks or data exfiltration efforts.

Unknown malware botnet C2 (confidence level: 50%)

Unknown malware botnet C2 (confidence level: 100%)

ShadowPad botnet C2 domain (confidence level: 95%)

Hook botnet C2 server (confidence level: 100%)

Quasar RAT botnet C2 server (confidence level: 100%)

DCRat botnet C2 server (confidence level: 100%)

BianLian botnet C2 server (confidence level: 100%)

AdaptixC2 botnet C2 server (confidence level: 100%)

ValleyRAT botnet C2 server (confidence level: 100%)

Havoc botnet C2 domain (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-06-14. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-14 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-14

The provided threat intelligence pertains to a malware-related report titled "ThreatFox IOCs for 2025-06-13," sourced from the ThreatFox MISP Feed. The threat is categorized primarily under OSINT (Open Source Intelligence), network activity, and payload delivery, indicating that it involves the collection and dissemination of indicators of compromise (IOCs) related to malware campaigns or network-based threats. The absence of specific affected versions or products suggests that this intelligence is more focused on threat detection and monitoring rather than a vulnerability in a particular software product. The technical details include a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, which collectively imply a moderate presence and dissemination of the threat indicators. No known exploits in the wild or patches are available, and no specific CWEs (Common Weakness Enumerations) are associated, reinforcing that this is an intelligence feed rather than a direct vulnerability or exploit. The lack of indicators in the provided data limits the granularity of technical analysis, but the classification under OSINT and payload delivery suggests that the threat involves the delivery of malicious payloads possibly through network vectors, with an emphasis on monitoring and detection rather than active exploitation. The TLP (Traffic Light Protocol) white tag indicates that the information is intended for unrestricted sharing, which is typical for OSINT feeds designed to enhance collective situational awareness among cybersecurity professionals.

Unknown malware botnet C2 domain (confidence level: 50%)

ACR Stealer botnet C2 domain (confidence level: 75%)

Unknown malware botnet C2 (confidence level: 75%)

Unknown Stealer payload delivery server (confidence level: 75%)

Rhadamanthys botnet C2 server (confidence level: 100%)

Sliver botnet C2 server (confidence level: 50%)

Detailed information about ThreatFox IOCs for 2025-06-13. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-13 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-13

The provided threat intelligence relates to a malware threat categorized under OSINT (Open Source Intelligence) and payload delivery with associated network activity. The data originates from the ThreatFox MISP Feed, dated June 12, 2025. The threat is tagged as 'type:osint' and 'tlp:white', indicating it is publicly shareable without restriction. No specific affected product versions are listed, and no patches or known exploits in the wild have been reported. The technical details assign a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, suggesting moderate dissemination potential but limited analytical depth. The absence of CWEs and indicators implies that the malware's technical specifics, such as vulnerabilities exploited or signatures, are not detailed in this report. The classification under OSINT and payload delivery suggests the malware may be used to gather intelligence or deliver malicious payloads via network vectors, but without explicit details on infection vectors, payload behavior, or persistence mechanisms. Overall, this threat appears to be a medium-severity malware campaign with limited technical detail, primarily focused on network-based payload delivery and intelligence gathering activities.

Lumma Stealer botnet C2 domain (confidence level: 75%)

N-W0rm botnet C2 server (confidence level: 100%)

Sliver botnet C2 server (confidence level: 90%)

Detailed information about ThreatFox IOCs for 2025-06-12. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-12 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-12

The provided threat intelligence pertains to a malware-related entry titled "ThreatFox IOCs for 2025-06-11," sourced from the ThreatFox MISP Feed. The threat is categorized primarily under OSINT (Open Source Intelligence), network activity, and payload delivery. The absence of specific affected product versions and lack of detailed indicators of compromise (IOCs) suggest this entry serves as a general alert or a collection of IOCs rather than a detailed vulnerability or exploit report. The technical details indicate a moderate threat level (threatLevel: 2) with some analysis and distribution activity, but no known exploits in the wild or available patches. The malware type and its association with OSINT imply that the threat may involve the use of publicly available information to facilitate network-based payload delivery, potentially targeting systems through reconnaissance and subsequent exploitation phases. Given the lack of concrete technical specifics such as attack vectors, payload characteristics, or targeted vulnerabilities, the threat appears to be in an early or observational stage, possibly highlighting emerging malware trends or campaign indicators rather than an active, widespread attack. The medium severity rating aligns with this assessment, indicating a moderate risk that requires attention but does not currently pose an immediate critical threat. Overall, this threat intelligence entry serves as a situational awareness tool for cybersecurity teams to monitor evolving malware activities and prepare defensive measures accordingly.

FAKEUPDATES botnet C2 server (confidence level: 100%)

Nimplant botnet C2 server (confidence level: 100%)

Kaiji botnet C2 server (confidence level: 100%)

MooBot botnet C2 server (confidence level: 100%)

RMS botnet C2 server (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-06-11. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-11 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-11

Gorilla DDoS is a Distributed Denial of Service (DDoS) attack service identified by the National Cyber Security Centre of Switzerland (NCSC) as increasingly targeting critical infrastructure since September 2024. The threat actor operates under the name "Gorilla Services" and offers DDoS-as-a-service via Telegram channels, with plans starting at a few dollars per day. The service utilizes a Mirai-like botnet called "GorillaBot," composed of compromised Linux/Unix devices, and also provides 10 Gbit/s hosting with spoofed uplinks to amplify attacks. The attacks are primarily UDP-based amplification attacks, notably leveraging open DNS resolvers to overwhelm targets. The volume of attacks surged to over 300,000 in September 2024, earning GorillaBot the label "The New King of DDoS Attacks" by NSFOCUS.

Technical analysis reveals that GorillaBot is a Mirai variant malware with multiple binaries targeting various CPU architectures (ARM, MIPS, x86, PowerPC, SH4, SPARC, etc.), indicating a broad capability to infect diverse IoT and network devices. The malware is distributed via URLs hosted on IP addresses and domains associated with the .su TLD, including gorillacnc.su, gorillabin.su, gorillaservices.su, gorillafirewall.su, gorillaproxy.su, and gorilla-api.su. The threat actor maintains presence on Telegram and Signal, with Telegram channels having been taken down but quickly replaced.

The attacks focus on network and endpoint denial of service (MITRE ATT&CK patterns T1464, T1499, T1642), aiming to disrupt availability rather than compromise confidentiality or integrity. The NCSC has shared threat intelligence with Swiss critical infrastructure operators and international partners to mitigate impact. No patches are available as this is a service and malware-based threat rather than a vulnerability in a specific product. No known exploits in the wild beyond the DDoS activity itself have been reported. The threat actor's infrastructure includes multiple IPs on ports 80, 7070, and high ephemeral ports, serving malware binaries and command and control.

Overall, Gorilla DDoS represents a significant and growing DDoS threat leveraging a Mirai-like botnet with multi-architecture support, low-cost access, and high attack volume, primarily impacting service availability of targeted organizations.

Detailed information about OSINT - Gorilla DDoS. Get real-time updates, technical details, and mitigation strategies.

OSINT - Gorilla DDoS - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Gorilla DDoS

OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware

The Kronos banking Trojan, historically known as a credential-stealing malware targeting online banking users, has evolved to serve as a loader for a new Point-of-Sale (POS) malware variant named ScanPOS. This threat was observed in large-scale email campaigns distributing Kronos primarily through phishing emails containing malicious attachments or links. The initial infection vector involves social engineering tactics where victims receive emails with links to seemingly legitimate SharePoint-like domains hosting malicious documents (e.g., EmployeeID-847267.doc) or executables (e.g., officeup.exe). Once the Kronos Trojan is executed, it establishes command and control (C&C) communications with attacker-controlled infrastructure (e.g., networkupdate.online, intranet.excel-sharepoint.com) to download and deploy the ScanPOS malware payload. ScanPOS is designed to scrape payment card data from POS systems, which are critical in retail and hospitality sectors. The malware campaign also involves additional malware families such as ZeuS and SmokeLoader, indicating a multi-stage infection process and potential for further payload delivery. The threat actors leverage compromised or spoofed domains mimicking legitimate corporate SharePoint services to increase the likelihood of user interaction and successful infection. Indicators of compromise include specific URLs, file hashes, and phishing email patterns. No patches are available for this malware as it exploits social engineering rather than software vulnerabilities. The campaign dates back to 2016 but demonstrates ongoing evolution in banking trojan usage, shifting focus from direct banking credential theft to POS data exfiltration via secondary payloads.

EmployeeID-847267.doc downloading payload (Kronos) on Nov 10

EmployeeID-6283.doc downloading payload (Kronos) on Nov 14

Detailed information about OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware. Get real-time updates, technical details, and mitigation str

OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided threat intelligence report from the ThreatFox MISP feed dated 2025-06-04 details a broad and complex malware campaign involving multiple botnets and Remote Access Trojans (RATs) with associated command and control (C2) infrastructure. The threat is categorized primarily as malware with a focus on OSINT, network activity, and payload delivery. Notably, the report identifies several well-known malware families and RATs including FAKEUPDATES, Interlock RAT, BeaverTail, Cobalt Strike, Ghost RAT, Sliver, AsyncRAT, Hook, Havoc, NetSupportManager RAT, Stealc, MimiKatz, Lumma Stealer, Amadey, DarkComet, NjRAT, ValleyRAT, Crocodilus, RedLine Stealer, Venom RAT, BianLian, XWorm, DCRat, QakBot, Azorult, Poison Ivy, SectopRAT, and others. These malware families are associated with various malicious activities such as credential theft, espionage, lateral movement, and payload delivery.

The technical details reveal a distributed network of C2 servers and domains used for botnet control and payload distribution. The C2 infrastructure spans numerous IP addresses and domains with varying confidence levels, indicating active and ongoing operations. The presence of Cobalt Strike and Sliver frameworks suggests use of advanced post-exploitation tools commonly employed by sophisticated threat actors. The payload delivery mechanisms include URLs hosting malicious MSI installers and other payloads, often masquerading as legitimate services or updates (e.g., fake update domains).

No specific affected software versions are listed, indicating this is a campaign leveraging multiple malware families rather than exploiting a single software vulnerability. The threat level is medium, with no patches available and no known exploits in the wild, suggesting that the threat relies on social engineering, phishing, or other delivery methods rather than zero-day exploits. The campaign's indicators of compromise (IOCs) include numerous domains, URLs, IP addresses, and file hashes, which can be used for detection and blocking.

Overall, this threat represents a widespread, multi-faceted malware ecosystem leveraging various RATs and botnets to conduct malicious activities, emphasizing the importance of network monitoring, IOC detection, and endpoint security.

FAKEUPDATES botnet C2 domain (confidence level: 100%)

FAKEUPDATES payload delivery server (confidence level: 100%)

Interlock RAT botnet C2 server (confidence level: 75%)

Interlock RAT payload (confidence level: 75%)

BeaverTail botnet C2 server (confidence level: 75%)

Ghost RAT botnet C2 server (confidence level: 100%)

Stealc botnet C2 server (confidence level: 100%)

Lumma Stealer botnet C2 (confidence level: 75%)

Detailed information about ThreatFox IOCs for 2025-06-04. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-04 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-04

The provided threat intelligence report from the ThreatFox MISP Feed dated 2025-06-05 details a broad and complex malware campaign involving multiple botnets and Remote Access Trojans (RATs) with associated Command and Control (C2) infrastructure. The threat is categorized primarily as malware with a focus on OSINT, payload delivery, and network activity. The report lists numerous Indicators of Compromise (IOCs), including domains, URLs, IP addresses, and file hashes linked to various malware families such as Crocodilus, FAKEUPDATES, Cobalt Strike, Remcos, Sliver, AsyncRAT, DCRat, NjRAT, NetSupportManager RAT, XWorm, Ghost RAT, Quasar RAT, Vidar, Havoc, Amadey, Lumma Stealer, RedLine Stealer, PlugX, BianLian, AdaptixC2, QakBot, Nanocore RAT, SectopRAT, ValleyRAT, Aurotun Stealer, N-W0rm, Pony, and others. 

The technical details indicate a medium severity threat with no available patches and no known exploits in the wild, suggesting this is an intelligence collection and monitoring report rather than a newly discovered zero-day vulnerability. The malware payloads are delivered primarily through suspicious domains and URLs, some masquerading as fake update sites or legitimate services, indicating social engineering and drive-by download tactics. The presence of multiple C2 servers and domains with high confidence levels suggests active botnet operations capable of remote control, data exfiltration, and lateral movement within compromised networks.

The diversity of malware families and C2 infrastructure points to a widespread and multifaceted threat landscape, with attackers leveraging various RATs and loaders to maintain persistence and control over infected hosts. The use of popular penetration testing tools like Cobalt Strike also indicates that threat actors may be employing advanced post-exploitation frameworks to expand their foothold. The report's TLP:white classification implies that the information is intended for broad sharing and awareness.

Overall, this threat represents a significant ongoing malware campaign with extensive infrastructure supporting payload delivery and botnet management, posing risks to organizations that may be targeted via phishing, malicious downloads, or compromised websites.

FAKEUPDATES payload delivery domain (confidence level: 100%)

Crocodilus botnet C2 domain (confidence level: 100%)

Crocodilus payload (confidence level: 100%)

Brute Ratel C4 botnet C2 domain (confidence level: 100%)

Unknown malware botnet C2 domain (confidence level: 100%)

XWorm botnet C2 server (confidence level: 100%)

Unknown malware payload (confidence level: 50%)

AsyncRAT botnet C2 domain (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-06-05. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-06-05 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-06-05

The provided threat intelligence report from ThreatFox MISP Feed dated 2025-06-07 details a broad and complex malware campaign involving multiple botnets and Remote Access Trojans (RATs). The campaign is characterized by extensive use of command and control (C2) infrastructure across numerous domains, IP addresses, and URLs associated with various malware families including NetSupportManager RAT, Cobalt Strike, AsyncRAT, Sliver, Havoc, Chaos, BianLian, Rhadamanthys, ValleyRAT, RedLine Stealer, Pupy, Hook, ERMAC, DCRat, Formbook, XWorm, Quasar RAT, Mirai, Meterpreter, NjRAT, Lumma Stealer, and others. The indicators include domains and URLs used for payload delivery, C2 servers, and webinject domains linked to credit card skimming. The campaign leverages payload delivery via URLs hosting malicious MSI and ZIP files, and botnet C2 servers operating on a variety of ports, often standard web ports (80, 443) and other high ports (e.g., 4444, 8888). The threat level is medium with no patches available and no known exploits in the wild, indicating this is an active but not yet fully weaponized or widely exploited threat. The campaign's scope is broad, involving multiple malware families and botnets, suggesting a multi-faceted threat landscape targeting network activity and payload delivery. The presence of webinject credit card skimming domains indicates financial theft objectives, while RATs and botnets suggest espionage, data exfiltration, and potential lateral movement within compromised networks. The threat actors likely use these infrastructures to maintain persistence, control infected hosts, and harvest sensitive information. The campaign requires user interaction for initial infection (e.g., downloading and executing payloads), but once established, the malware can operate autonomously. The lack of patches implies mitigation relies on detection and prevention rather than vulnerability remediation. The extensive list of C2 servers and domains with high confidence levels indicates well-established infrastructure supporting these malware operations.

Unknown RAT botnet C2 domain (confidence level: 100%)

NetSupportManager RAT payload delivery URL (confidence level: 100%)

pupy botnet C2 server (confidence level: 100%)

Chaos botnet C2 server (confidence level: 100%)

Unknown Webinject credit card skimming domain (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-06-07. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'tlp:white'

Filter Threats

Threats Tagged 'tlp:white'