Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

DarkComet RAT malware has resurfaced disguised as a fake Bitcoin-related tool, distributed via a RAR archive containing a UPX-packed executable. Upon execution, it installs itself as 'explorer. exe' in the user's AppData folder and establishes persistence through a registry run key. The malware communicates with its command and control server at kvejo991. ddns. net on port 1604. It performs keylogging, storing captured keystrokes in a dedicated folder, and uses process injection into notepad. exe to evade detection. The malware also spawns multiple cmd. exe and conhost.

The DarkComet Remote Access Trojan (RAT), an older but still effective malware strain, has reemerged in a new campaign disguised as a fake Bitcoin-related application. The malware is distributed as a RAR archive containing a UPX-packed executable file, a packing method used to evade signature-based detection by antivirus solutions. Once the executable is unpacked and run, it installs itself under the name 'explorer.exe' within the user's AppData directory, a common tactic to blend with legitimate Windows processes. To maintain persistence, it creates a registry run key, ensuring execution upon system startup. The RAT establishes command and control (C2) communication with a server hosted at 'kvejo991.ddns.net' on port 1604, allowing attackers to remotely control infected machines. Functionally, DarkComet performs keylogging by capturing keystrokes and storing them in a 'dclogs' folder, enabling theft of sensitive information such as credentials. For stealth, it injects its payload into the legitimate notepad.exe process and spawns multiple cmd.exe and conhost.exe processes, complicating detection and analysis. The use of cryptocurrency-themed social engineering lures increases the likelihood of user interaction and infection. Although no new exploits or vulnerabilities are leveraged, the malware’s persistence and data exfiltration capabilities pose significant risks. Indicators of compromise include multiple file hashes and the C2 domain and URL. The malware’s tactics align with MITRE ATT&CK techniques such as T1056.001 (Keylogging), T1566.001 (Phishing), T1204 (User Execution), T1041 (Exfiltration Over C2 Channel), T1547.001 (Registry Run Keys), T1027.002 (Packing), and T1071.001 (Application Layer Protocol).

Detailed information about DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool. Get real-time updates, technical details, and mitigation strategies.

DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool - Live Threat Intelligence - Threat Radar | OffSeq.com

DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool

Mirai, a notorious botnet targeting IoT devices, has evolved since its 2016 debut. Initially known for massive DDoS attacks, newer variants employ sophisticated techniques like UPX packing and common network utilities for evasion and adaptability. Modern Mirai samples extend beyond DDoS, focusing on data exfiltration and long-term persistence. The analysis compares a June 2025 variant with the original, highlighting differences in execution, network behavior, and file characteristics. The new variant demonstrates increased stealth, modularity, and versatility, making it a more significant threat in the interconnected device landscape. Prevention strategies include updated antivirus software, avoiding suspicious links, and regular system and network monitoring.

Mirai is a notorious IoT botnet first identified in 2016, primarily known for orchestrating large-scale DDoS attacks by compromising vulnerable IoT devices such as routers, cameras, and DVRs. The 2025 variant of Mirai represents a significant evolution in its threat profile. Unlike the original, which focused mainly on volumetric DDoS, the modern Mirai employs sophisticated evasion techniques including UPX packing—a method of compressing and obfuscating binaries to hinder analysis and detection. It also uses legitimate network utilities to blend in with normal traffic, increasing stealth and persistence. The new variant is modular, allowing it to adapt its payloads and behaviors dynamically, extending its capabilities beyond DDoS to include data exfiltration and establishing long-term footholds on infected devices. Technical analysis reveals changes in execution flow, network communication patterns, and file characteristics compared to the original Mirai. Indicators of compromise include specific IP addresses and file hashes associated with this variant. Although no active exploits are currently reported in the wild, the botnet’s enhanced stealth and modularity raise the risk of future attacks targeting IoT ecosystems. The threat leverages common IoT device vulnerabilities such as default credentials and unpatched firmware, exploiting the widespread lack of robust security controls in these devices. Prevention strategies emphasize maintaining updated antivirus software capable of detecting packed binaries, avoiding suspicious links or downloads that could deliver the malware, and implementing continuous system and network monitoring to detect anomalous behavior indicative of infection or data exfiltration attempts.

Detailed information about Mirai: The IoT Botnet. Get real-time updates, technical details, and mitigation strategies.

Mirai: The IoT Botnet - Live Threat Intelligence - Threat Radar | OffSeq.com

Mirai: The IoT Botnet

Inf0s3c Stealer is a sophisticated Python-based malware designed to collect system information and user data. It systematically gathers host identifiers, CPU information, network configuration, and captures screenshots. The malware enumerates running processes, generates directory views, and compiles stolen data into a password-protected archive for exfiltration. It employs various techniques for persistence, including injection into Discord and Windows Startup manipulation. The stealer targets sensitive information such as passwords, cookies, browsing history, and cryptocurrency wallets. It also implements anti-VM checks and can self-delete after execution. The analysis reveals similarities with other malware projects, suggesting potential for rapid iteration and wider distribution.

Inf0s3c Stealer is a sophisticated Python-based malware designed primarily for data theft and system reconnaissance on Windows platforms. It collects extensive system information including host identifiers, CPU details, and network configurations, which helps attackers profile the infected environment. The malware captures screenshots and enumerates running processes and directory structures to gather further intelligence. It targets sensitive user data such as passwords, cookies, browsing history, and cryptocurrency wallets, consolidating stolen data into a password-protected archive for exfiltration. Persistence is achieved through injection into the Discord application and manipulation of Windows Startup entries, enabling the malware to survive reboots and maintain a foothold. Anti-virtual machine (anti-VM) checks are implemented to evade analysis in sandboxed or virtualized environments, and the malware can self-delete after execution to reduce forensic traces. The use of UPX packing and PyInstaller packaging techniques complicates detection and analysis. The malware leverages multiple Windows API calls and employs various MITRE ATT&CK techniques such as process injection (T1055), credential dumping (T1003), system information discovery (T1082), and data exfiltration over command and control channels (T1071). Similarities with other malware projects suggest that Inf0s3c Stealer could be rapidly iterated and widely distributed, posing a persistent threat. No known exploits in the wild or specific threat actors have been identified yet, but the malware’s capabilities indicate a medium severity threat with significant potential for data compromise and operational disruption.

Detailed information about UNVEILING A PYTHON STEALER – INF0S3C STEALER. Get real-time updates, technical details, and mitigation strategies.

UNVEILING A PYTHON STEALER – INF0S3C STEALER - Live Threat Intelligence - Threat Radar | OffSeq.com

UNVEILING A PYTHON STEALER – INF0S3C STEALER

Raven Stealer is a modern, lightweight information-stealing malware developed in Delphi and C++. It targets Chromium-based browsers to extract sensitive data, including passwords, cookies, and payment details. The malware uses a modular architecture and UPX packing to evade detection. It executes stealthily and exfiltrates data via Telegram bot integration. Distributed through GitHub and promoted on Telegram, Raven Stealer's user-friendly interface and dynamic module support make it attractive in the commodity malware ecosystem. The malware's capabilities include credential theft, browser data harvesting, and real-time exfiltration, posing a significant threat when used maliciously.

Raven Stealer is a contemporary information-stealing malware developed using Delphi and C++. It specifically targets Chromium-based browsers to harvest sensitive user data such as passwords, cookies, and payment information. The malware employs a modular architecture, allowing it to dynamically load and execute various components, enhancing its flexibility and adaptability. To evade detection by security solutions, Raven Stealer uses UPX packing, a common technique to compress and obfuscate executable files. One of the distinctive features of this malware is its method of data exfiltration: it leverages Telegram bot integration to stealthily send stolen data to attackers in real-time. This approach benefits from Telegram's encrypted and widely used messaging platform, making detection and blocking more challenging. Raven Stealer is distributed through GitHub repositories and promoted on Telegram channels, indicating an open and accessible distribution model that lowers the barrier for cybercriminals to acquire and deploy it. Its user-friendly interface and support for dynamic modules make it attractive within the commodity malware ecosystem, facilitating widespread use by less sophisticated threat actors. The malware’s capabilities include credential theft, browser data harvesting, and real-time data exfiltration, posing a significant threat to individuals and organizations that rely on Chromium-based browsers for daily operations. Although no known exploits in the wild have been reported at the time of analysis, the malware’s stealth features and modular design suggest it could be effectively used in targeted or broad campaigns. The use of Telegram for command and control and data exfiltration is notable, as it blends malicious activity with legitimate traffic, complicating detection efforts. The malware also employs various evasion techniques such as process injection and anti-debugging, as indicated by associated MITRE ATT&CK techniques (e.g., T1129, T1542.003, T1564), further increasing its stealth and persistence capabilities.

Detailed information about RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'upx packing'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'upx packing'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility