Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers. Once opened, the malware automatically propagates via WhatsApp Web, causing infected accounts to be banned due to excessive spam activity.

SORVEPOTEL is a malware strain observed spreading on Windows systems through phishing emails containing malicious ZIP file attachments. The phishing lure is crafted to entice users to open the attachment on desktop environments, suggesting that attackers aim at enterprise users rather than casual consumers. Upon execution, the malware uses PowerShell scripts and loader components to establish persistence and execute payloads. It then propagates via WhatsApp Web by automatically sending spam messages to contacts, which results in infected WhatsApp accounts being banned due to spam detection. The malware's propagation via WhatsApp Web is notable because it leverages a widely used communication platform to spread laterally and potentially infect other users. The infection chain involves social engineering, script execution, and abuse of legitimate communication channels. Although initially reported in Brazil, the techniques used could be adapted to other regions where WhatsApp Web is prevalent. The malware employs various tactics such as code injection (T1055), command and scripting interpreter abuse (T1059), persistence mechanisms (T1547), and credential access techniques (T1550). No known exploits beyond phishing delivery are reported, and no CVSS score is assigned. The malware's impact includes potential disruption of business communications, account bans, and the risk of further spreading within enterprise environments.

MD5 of c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5

MD5 of bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328

MD5 of 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6

MD5 of 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b

MD5 of dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5

MD5 of 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500

SHA1 of 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6

SHA1 of 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500

SHA1 of 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b

SHA1 of c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5

SHA1 of bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328

SHA1 of dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5

Detailed information about Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US). Get real-time updates, technical details

Title	Severity	Type	Source	Date

Threats Tagged 'water saci'

Filter Threats

Threats Tagged 'water saci'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility