Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Efimer Trojan is spreading through compromised WordPress sites, malicious torrents, and email campaigns impersonating lawyers. It steals cryptocurrency by replacing wallet addresses in the clipboard and can execute additional malicious scripts. The Trojan communicates with its command-and-control server via the Tor network. It has additional capabilities to brute-force WordPress sites and harvest email addresses for further distribution. The malware primarily targeted users in Brazil, India, Spain, Russia, Italy, and Germany between October 2024 and July 2025, affecting over 5,000 Kaspersky users.

The Efimer Trojan is a multifaceted malware strain actively spreading through compromised WordPress websites, malicious torrent files, and targeted email campaigns impersonating legal professionals. Its primary malicious function is to steal cryptocurrency by intercepting and replacing wallet addresses copied to the clipboard, a technique known as clipboard hijacking. Beyond this, Efimer can execute additional malicious scripts, enhancing its persistence and capabilities. Communication with its command-and-control (C2) infrastructure is conducted over the Tor network, which anonymizes traffic and complicates detection and takedown efforts. The Trojan also incorporates brute-force attack capabilities aimed at WordPress sites, attempting to gain unauthorized access by guessing credentials. Additionally, it harvests email addresses from infected systems to expand its distribution via phishing campaigns. The malware has been observed targeting users predominantly in Brazil, India, Spain, Russia, Italy, and Germany from October 2024 through July 2025, impacting over 5,000 users monitored by Kaspersky. The attack vectors leverage common web application vulnerabilities and social engineering, exploiting WordPress’s widespread deployment and the trust users place in email communications from purported legal entities. The use of the Tor network for C2 communication and the combination of multiple infection and propagation methods make Efimer a persistent and evasive threat. Although no specific affected software versions are listed, the brute-force attacks on WordPress suggest exploitation of weak credentials or unpatched installations. The malware’s tactics align with several MITRE ATT&CK techniques, including clipboard data theft (T1115), command execution (T1059.007), phishing (T1566.002), brute forcing (T1110), and use of anonymizing networks (T1571).

Detailed information about Efimer Trojan delivered via email and hacked WordPress websites. Get real-time updates, technical details, and mitigation strategies.

Efimer Trojan delivered via email and hacked WordPress websites - Live Threat Intelligence - Threat Radar | OffSeq.com

Efimer Trojan delivered via email and hacked WordPress websites

Threats Tagged 'torrent'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'torrent'

Lead Pen Test Professional