Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A coordinated spearphishing campaign targeted NGOs and Ukrainian government administrations involved in war relief efforts. The attack used emails impersonating the Ukrainian President's Office with weaponized PDFs, employing a fake Cloudflare captcha page to execute malware. The final payload was a WebSocket RAT enabling remote command execution and data exfiltration. Despite six months of preparation, the attackers' infrastructure was only active for one day, indicating sophisticated planning and operational security. An additional mobile attack vector was discovered, using fake applications to collect data from Android devices. The campaign demonstrated extensive operational planning, compartmentalized infrastructure, and deliberate exposure control.

This threat involves a multi-stage Remote Access Trojan (RAT) delivered through a spearphishing campaign targeting NGOs and Ukrainian government administrations engaged in war relief efforts. Attackers impersonated the Ukrainian President's Office in emails containing weaponized PDF attachments. Upon opening, victims were redirected to a fake Cloudflare captcha page, which served as a loader to execute the malware payload. The final payload is a WebSocket-based RAT that establishes a persistent, encrypted communication channel with the command and control (C2) server, enabling remote command execution, system reconnaissance, credential theft, and data exfiltration. The campaign also included a mobile attack vector using fake Android applications designed to collect sensitive data from infected devices. The attackers exhibited high operational security, preparing infrastructure over six months but limiting its active use to a single day, minimizing exposure and detection risk. Indicators of compromise include multiple file hashes, IP addresses, and suspicious domains linked to the infrastructure. The campaign leverages PowerShell scripts and various Windows commands to maintain persistence and evade defenses. No CVE or public exploit is associated, and no widespread exploitation has been observed. The campaign's sophistication and targeting suggest a state-sponsored or highly skilled threat actor focused on intelligence gathering and disruption related to the ongoing conflict in Ukraine.

Detailed information about Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation. Get real-time updates, technical details, and mitiga

Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation - Live Threat Intelligence - Threat Radar | OffSeq.com

PhantomCaptcha: Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

Threats Tagged 'websocket rat'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'websocket rat'

Lead Pen Test Professional