Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Contagious Interview campaign, linked to North Korean actors, has evolved to use JSON storage services for hosting and delivering malware. This campaign targets software developers, particularly those in cryptocurrency and Web3 projects, across Windows, Linux, and macOS. The attackers use social engineering tactics, including fake recruiter profiles, to deliver trojanized code during staged job interviews. The malware payload includes BeaverTail and OtterCookie infostealers, along with the InvisibleFerret RAT. The attack chain involves multiple stages, from initial contact to malware delivery, utilizing legitimate websites like JSON Keeper and code repositories to operate stealthily. The campaign also incorporates additional components such as the Tsunami Payload, which adds exceptions to Windows Defender and creates scheduled tasks.

The Contagious Interview campaign is a sophisticated cyber espionage and malware delivery operation linked to North Korean threat actors. It specifically targets software developers working in cryptocurrency and Web3 projects across Windows, Linux, and macOS platforms. The attackers employ social engineering by creating fake recruiter profiles to engage victims in staged job interviews, during which they deliver trojanized code. This code is hosted on legitimate JSON storage services such as JSON Keeper and popular code repositories, allowing the attackers to evade traditional detection mechanisms by blending malicious payloads with legitimate web traffic. The malware payload includes BeaverTail and OtterCookie infostealers designed to exfiltrate sensitive information, and the InvisibleFerret Remote Access Trojan (RAT) that provides persistent remote control over infected systems. Additionally, the campaign uses the Tsunami Payload, which modifies Windows Defender to add exceptions and creates scheduled tasks to maintain persistence and evade endpoint security. The attack chain is multi-staged, starting from initial social engineering contact, progressing through delivery of trojanized code, and culminating in the deployment of multiple malware components. The use of legitimate services for hosting payloads and the targeting of niche developer communities make this campaign particularly stealthy and effective. The campaign leverages various MITRE ATT&CK techniques such as T1053 (Scheduled Task), T1562 (Impair Defenses), T1566 (Phishing), and T1204 (User Execution), highlighting its complexity and sophistication. No known public exploits exist for this campaign, but its reliance on social engineering and multi-platform malware increases its threat potential.

Detailed information about Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery. Get real-time updates, technical details, and mit

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

Threats Tagged 'tsunami payload'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'tsunami payload'

Lead Pen Test Professional