Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat identified as "Charting TA2541's Flight" is a malware campaign attributed to the threat actor TA2541, characterized primarily as a remote access tool (RAT) with spyware capabilities. This malware enables unauthorized remote access to compromised systems, allowing attackers to stealthily monitor, control, and exfiltrate sensitive information. The classification tags indicate that the malware is used for nefarious activities involving remote access abuse, specifically through phishing vectors, which suggests that initial infection vectors likely involve social engineering techniques to deceive users into executing malicious payloads. The malware is persistent, described as having a "perpetual" lifetime, implying that it maintains long-term access to infected systems without easy detection or removal. Although no specific affected software versions or products are listed, the nature of RATs typically targets widely used operating systems or enterprise environments where remote access capabilities are prevalent. The absence of known exploits in the wild suggests this malware is either custom-built or distributed through targeted phishing campaigns rather than exploiting public vulnerabilities. The threat level is marked as high, reflecting the significant risk posed by remote access malware in enabling espionage, data theft, and potential lateral movement within networks. The certainty of the intelligence is moderate (50%), indicating some confidence in the attribution and behavior but possibly limited visibility into the full scope of the campaign. Overall, this malware represents a sophisticated espionage tool used by TA2541 to gain persistent, covert access to victim systems primarily through phishing, enabling extensive surveillance and data compromise.

Detailed information about Charting TA2541's Flight. Get real-time updates, technical details, and mitigation strategies.

Charting TA2541's Flight - Live Threat Intelligence - Threat Radar | OffSeq.com

Charting TA2541's Flight

OSINT - Iranian PupyRAT Bites Middle Eastern Organizations

PupyRAT is a remote access Trojan (RAT) linked to Iranian threat actors such as APT35 (also known as OilRig or Cleaver) and the Magic Hound intrusion set. This malware is designed to provide attackers with persistent, stealthy remote access to compromised systems. PupyRAT is a modular, multi-platform RAT primarily written in Python, capable of running on Windows, Linux, and macOS environments. It supports a wide range of capabilities including keylogging, credential theft, file system manipulation, command execution, and network reconnaissance. The malware’s modular architecture allows attackers to load additional plugins dynamically, enhancing its functionality and adaptability to different operational needs. The threat is primarily observed targeting Middle Eastern organizations, often aligned with espionage objectives typical of state-sponsored actors. Despite no known public exploits or patches, PupyRAT’s use by sophisticated Iranian APT groups indicates a high level of operational maturity and targeted deployment. The malware is typically delivered via spear-phishing campaigns or exploiting weak remote access configurations, enabling attackers to establish footholds within victim networks. Once inside, PupyRAT facilitates lateral movement and data exfiltration, posing significant risks to confidentiality and integrity of sensitive information. The threat intelligence tags associate this malware with espionage-focused Iranian APTs, emphasizing its use in strategic intelligence gathering rather than indiscriminate cybercrime. The lack of publicly available indicators of compromise (IOCs) and absence of known exploits in the wild suggest that detection and mitigation rely heavily on behavioral analysis and network monitoring rather than signature-based methods.

Detailed information about OSINT - Iranian PupyRAT Bites Middle Eastern Organizations. Get real-time updates, technical details, and mitigation strategies.

OSINT - Iranian PupyRAT Bites Middle Eastern Organizations - Live Threat Intelligence - Threat Radar | OffSeq.com

The Turla Kazuar RAT (Remote Access Trojan) is a malware attributed to the Turla threat group, also known as G0010, a well-known advanced persistent threat (APT) actor. Kazuar is a remote access tool designed to provide attackers with persistent, stealthy access to compromised systems. It enables the threat actor to conduct espionage, data exfiltration, and maintain control over targeted networks. Kazuar is part of the Turla malware family and is known for its modular architecture, allowing it to load additional payloads and adapt to different environments. The RAT typically operates by establishing covert communication channels with command and control (C2) servers, often using encrypted protocols to evade detection. Although the provided information indicates a low severity rating and no known exploits in the wild, the threat level is marked as 3 (moderate), reflecting its potential use in targeted attacks. The malware is linked to remote access abuse, spyware capabilities, and is associated with espionage activities. The lack of specific affected versions or patch information suggests that Kazuar is a tool used in targeted intrusions rather than a vulnerability affecting a broad range of products. The Turla group has historically targeted government, military, diplomatic, and critical infrastructure organizations, leveraging sophisticated malware like Kazuar to maintain long-term access and gather intelligence.

Detailed information about 2019-01-28: Turla Kazuar RAT. Get real-time updates, technical details, and mitigation strategies.

2019-01-28: Turla Kazuar RAT - Live Threat Intelligence - Threat Radar | OffSeq.com

2019-01-28: Turla Kazuar RAT

njRAT is a remote access trojan (RAT) that has been known since at least 2014 and is primarily used to gain unauthorized remote control over infected Windows systems. It allows attackers to perform a variety of malicious activities including keylogging, screen capturing, file system manipulation, and execution of arbitrary commands. The provided information indicates this is an OSINT report referencing old njRAT activity, with no specific new variants or active campaigns detailed. njRAT typically spreads through phishing emails, malicious downloads, or exploit kits, targeting end-user systems to establish persistence and remote control. Despite its age, njRAT remains relevant due to its ease of use, availability in underground forums, and continued use by low-sophistication threat actors. The report notes a low severity and no known exploits in the wild at the time of publication, suggesting limited active exploitation or impact currently. The technical details show moderate confidence in the analysis and a low threat level, consistent with njRAT's historical profile as a commodity RAT rather than a sophisticated targeted threat. However, its capabilities for remote access and data exfiltration mean it can still pose risks if deployed in an environment without adequate defenses.

Detailed information about OSINT - old njRAT activity. Get real-time updates, technical details, and mitigation strategies.

OSINT - old njRAT activity - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - old njRAT activity

TALOS Blog: Picking Apart Remcos Botnet-In-A-Box

The Remcos Botnet-In-A-Box is a commercially available Remote Access Trojan (RAT) malware that enables attackers to gain unauthorized remote access and control over compromised systems. It is distributed primarily through social engineering techniques, often embedded within malicious documents that, when opened, execute the malware payload. Once installed, Remcos provides extensive command and control (C2) capabilities, allowing attackers to perform a wide range of malicious activities such as keylogging, screen capturing, file manipulation, process management, and remote shell access. The malware is marketed as a 'botnet-in-a-box,' which lowers the barrier to entry for cybercriminals by providing a ready-made toolkit for building and managing botnets. Although no specific affected versions or patches are listed, the malware's presence and capabilities pose a significant threat to endpoint security. The TALOS blog analysis highlights the malware's modular architecture and its misuse vector via remote access, emphasizing the risk of unauthorized system control through social engineering vectors. While no known exploits in the wild are reported, the malware's medium threat level and ease of deployment make it a persistent risk, especially in environments where users may be susceptible to phishing or malicious document attacks.

Detailed information about TALOS Blog: Picking Apart Remcos Botnet-In-A-Box. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'veris:action:misuse:vector="remote access"'

Filter Threats

Threats Tagged 'veris:action:misuse:vector="remote access"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility