Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

DeerStealer is a sophisticated information-stealing malware that targets a wide range of user and system data. It employs deception techniques, persistence mechanisms, and rootkit-like capabilities to evade detection and maintain stealth on compromised systems. The malware uses signed executables, legitimate DLLs, and multi-stage execution to perform its malicious activities. It establishes persistence through scheduled tasks and employs auto-elevated COM objects to bypass User Account Control. DeerStealer's adaptive design allows it to switch C2 servers and use obfuscated files for effective data exfiltration. The malware is actively sold and supported through dark-web forums and Telegram channels, posing a significant threat to both individuals and organizations.

DeerStealer is a sophisticated information-stealing malware campaign characterized by advanced stealth, persistence, and rootkit-like capabilities. It targets a broad spectrum of user and system data, aiming to exfiltrate sensitive information from compromised endpoints. The malware employs multiple evasion techniques, including the use of signed executables and legitimate DLLs, which help it bypass traditional signature-based detection mechanisms. Its multi-stage execution model allows it to deploy payloads in phases, complicating detection and analysis. Persistence is achieved through scheduled tasks, ensuring the malware remains active across system reboots. Additionally, DeerStealer leverages auto-elevated COM objects to bypass User Account Control (UAC), granting it elevated privileges without user consent or interaction. This UAC bypass is particularly concerning as it enables the malware to operate with higher system privileges, increasing its potential impact. The malware also exhibits rootkit-like behavior, hiding its presence and activities from security tools and system administrators. Its adaptive design includes the ability to switch command and control (C2) servers dynamically and use obfuscated files to evade network and endpoint detection. DeerStealer is actively marketed and supported on dark-web forums and Telegram channels, indicating a commoditized threat that can be deployed by a wide range of threat actors against both individuals and organizations. Indicators of compromise include numerous file hashes, IP addresses, and domains associated with its infrastructure, which can be used for detection and blocking. Although no known exploits in the wild have been reported, the malware's capabilities and active distribution pose a significant risk to targeted environments.

Detailed information about DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities. Get real-time updates, technical details, and miti

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities - Live Threat Intelligence - Threat Radar | OffSeq.com

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities

Title	Severity	Type	Source	Date

Threats Tagged 'xfiles spyware'

Filter Threats

Threats Tagged 'xfiles spyware'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility