Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A routine monitoring by researchers uncovered an exploitation attempt on a honeypot server running TeamCity, a CI/CD tool. The attack exploited an exposed Java Debug Wire Protocol (JDWP) interface, leading to remote code execution, deployment of cryptomining payload, and establishment of multiple persistence mechanisms. The attack was notable for its rapid exploitation, use of a customized XMRig payload, and stealthy crypto-mining techniques. JDWP, designed for debugging Java applications, becomes a high-risk entry point when exposed to the Internet without proper authentication. The attackers used a structured sequence to achieve remote code execution, likely using a variant of jdwp-shellifier. They deployed a dropper script that installed an XMRig miner and set up various persistence mechanisms including boot scripts, systemd services, cron jobs, and shell configuration files.

The threat involves exploitation of exposed Java Debug Wire Protocol (JDWP) interfaces on publicly accessible servers, specifically targeting a TeamCity continuous integration/continuous deployment (CI/CD) tool instance. JDWP is a protocol used for debugging Java applications, which by design allows remote control and inspection of Java processes. When JDWP ports are left open and accessible from the internet without authentication or proper network restrictions, attackers can leverage this to gain remote code execution (RCE) capabilities. In the observed attack, threat actors used a variant of the jdwp-shellifier tool to execute arbitrary commands on the compromised host. The attack chain began with reconnaissance and rapid exploitation of the exposed JDWP port, followed by deployment of a dropper script that installed a customized version of the XMRig cryptocurrency miner. To maintain persistence, the attackers employed multiple mechanisms including boot scripts, systemd service units, cron jobs, and modifications to shell configuration files. The mining operation was conducted stealthily to avoid detection and maximize resource usage. This attack highlights the critical risk of exposing debugging interfaces like JDWP to untrusted networks, as it effectively bypasses authentication and allows full control over the Java process and underlying system. The use of TeamCity as a target is significant given its role in software development pipelines, potentially enabling further lateral movement or supply chain compromise. The attack also demonstrates a typical post-exploitation pattern of cryptojacking, which while not immediately destructive, can degrade system performance and increase operational costs. The lack of authentication on JDWP and the absence of network segmentation or firewall rules are key enablers for this threat. No specific affected versions or patches are noted, emphasizing that the vulnerability is a misconfiguration rather than a software flaw. The attack does not require user interaction once the JDWP port is exposed, and exploitation can be automated and rapid.

Detailed information about Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open. Get real-time updates, technical details, and mitiga

Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open - Live Threat Intelligence - Threat Radar | OffSeq.com

Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

A new Android malware campaign has been discovered, disguising itself as a banking app to covertly mine cryptocurrency on locked devices. The malware, distributed through a phishing website impersonating Axis Bank, downloads and executes a modified version of XMRig, a popular cryptocurrency mining software. It monitors the device's lock state and battery level, initiating mining operations when the device is locked and stopping when unlocked. This stealthy approach allows for persistent mining, leading to excessive heat generation, battery drain, and potential hardware damage. The malware uses multiple hosting platforms to distribute its payload and connects to specific mining pools. Its impact on devices includes high CPU and memory usage, significant temperature increases, and overall performance degradation.

This threat involves a newly discovered Android malware campaign that masquerades as a legitimate banking application, specifically impersonating Axis Bank, to deceive users into installing it. The malware is distributed via phishing websites that mimic the bank's official site, tricking victims into downloading the malicious app. Once installed, the malware covertly downloads and executes a modified version of XMRig, a widely used cryptocurrency mining software. The malware is designed to monitor the device's lock state and battery level, initiating mining operations only when the device is locked and the battery is sufficiently charged, and ceasing mining when the device is unlocked. This stealthy behavior allows the malware to persistently mine cryptocurrency, primarily Monero, without immediate detection by the user. The mining activity results in excessive CPU and memory usage, leading to significant device overheating, rapid battery drain, and potential long-term hardware damage. The malware uses multiple hosting platforms to distribute its payload and connects to specific mining pools through domains such as getxapp.in and pool.uasecurity.org. Indicators of compromise include several file hashes and domains associated with the malware infrastructure. The campaign leverages phishing tactics combined with cryptojacking, exploiting user trust in banking apps and device idle states to maximize mining efficiency while minimizing user suspicion. Although no known exploits are currently reported in the wild, the threat demonstrates a medium severity level due to its potential to degrade device performance and cause hardware issues over time.

SHA256 of 7c3d7cddaf755343a9c32b30739db6e3

Detailed information about Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices. Get real-time updates, technical details, a

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

A resurgence of malware deploying XMRig cryptominer was discovered in mid-April 2025, coinciding with a rally in Monero cryptocurrency value. The malware uses a multi-staged approach and LOLBAS techniques, leveraging Windows tools like PowerShell for payload delivery, detection evasion, and persistence. The attack chain involves three stages: initial infection via a batch file, persistence establishment, and cryptomining execution. The malware targets diverse countries, including Russia, Belgium, Greece, and China. It disables Windows Update services, evades Windows Defender, and uses scheduled tasks for persistence. The XMRig miner creates registry entries and drops files for continued operation. Despite its simple, unobfuscated nature, the malware proved effective in avoiding detection.

The threat described is a resurgence of malware deploying the XMRig cryptominer, discovered in mid-April 2025, coinciding with an increase in the value of the Monero cryptocurrency. This malware uses a multi-stage infection chain and Living Off the Land Binaries and Scripts (LOLBAS) techniques, leveraging legitimate Windows tools such as PowerShell to deliver payloads, evade detection, and maintain persistence. The attack chain consists of three stages: initial infection via a batch file, establishment of persistence through scheduled tasks and registry modifications, and execution of the XMRig cryptominer to mine Monero. The malware disables Windows Update services to prevent system patches, evades Windows Defender detection mechanisms, and uses scheduled tasks to ensure continued operation after reboots. It creates registry entries and drops files to maintain persistence and continued cryptomining activity. Despite the malware’s relatively simple and unobfuscated code, it effectively avoids detection by abusing legitimate system tools and disabling security features. The malware has been observed targeting multiple countries, including Russia, Belgium, Greece, and China. Indicators of compromise include specific file hashes and a domain (notif.su) used in the attack infrastructure. The malware’s tactics align with several MITRE ATT&CK techniques such as T1053.005 (Scheduled Task), T1489 (Service Stop), T1059.001 (PowerShell), and others related to persistence, defense evasion, and execution. No known exploits or threat actors are currently linked to this malware, and no CVE identifiers are assigned. The overall severity is assessed as medium by the source, reflecting its impact and ease of detection avoidance but limited direct destructive capabilities.

Detailed information about Digging Gold with a Spoon – Resurgence of Monero-mining Malware. Get real-time updates, technical details, and mitigation strategies.

Digging Gold with a Spoon – Resurgence of Monero-mining Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Digging Gold with a Spoon – Resurgence of Monero-mining Malware

Librarian Ghouls, an APT group targeting entities in Russia and the CIS, has been conducting a campaign involving targeted phishing emails with malicious archives. The attackers use legitimate third-party software and scripts to establish remote access, steal credentials, and deploy an XMRig crypto miner. Their tactics include disabling security measures, scheduling tasks to cover their tracks, and exfiltrating sensitive data. The campaign primarily affects industrial enterprises and engineering schools in Russia, with some victims in Belarus and Kazakhstan. The group continues to refine its methods, focusing on data exfiltration, remote access, and email account compromise through phishing sites.

The threat involves the APT group known as Librarian Ghouls, which targets entities primarily in Russia and the Commonwealth of Independent States (CIS) through a sophisticated campaign. The attack vector is primarily phishing emails containing malicious archives that exploit social engineering to trick victims into executing payloads. The group leverages legitimate third-party software and scripting tools to establish persistent remote access, enabling them to steal credentials and exfiltrate sensitive data. Additionally, they deploy the XMRig cryptocurrency miner to illicitly mine Monero, thereby monetizing compromised systems. Their tactics include disabling security tools to evade detection, scheduling tasks to maintain persistence and cover tracks, and compromising email accounts via phishing sites to facilitate further lateral movement and data theft. The campaign mainly targets industrial enterprises and engineering schools, indicating a focus on sectors with valuable intellectual property and operational technology. The group continuously refines its methods, employing a range of MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job), T1036.005 (Masquerading), T1566.001 (Spearphishing Attachment), and others related to credential access, defense evasion, and command execution. While the campaign is currently concentrated in Russia, Belarus, and Kazakhstan, the use of legitimate tools and phishing makes it a flexible threat that could potentially affect similar targets elsewhere. No known public exploits exist for this campaign, and no specific vulnerable software versions are identified, indicating the attack relies heavily on social engineering and post-compromise tool usage rather than zero-day vulnerabilities.

Detailed information about APT carries out attacks with data theft and crypto miner deployment. Get real-time updates, technical details, and mitigation strateg

APT carries out attacks with data theft and crypto miner deployment - Live Threat Intelligence - Threat Radar | OffSeq.com

APT carries out attacks with data theft and crypto miner deployment

Blitz is a new Windows-based malware discovered in 2024 consisting of a downloader and bot payload. The latest version was spread through backdoored game cheats for Standoff 2 distributed via Telegram. Blitz abuses Hugging Face Spaces to host components of its C2 infrastructure and payloads. The malware performs information stealing and DDoS attacks. An XMRig cryptocurrency miner was also deployed as follow-up malware. By May 2025, the developer claimed to have abandoned the project. Russia accounted for the highest number of infections among 289 victims across 26 countries. Palo Alto Networks customers are protected through various security products and services.

Blitz is a Windows-based malware campaign identified in 2024, characterized by a modular architecture consisting primarily of a downloader and a bot payload. The malware's distribution vector is notably through backdoored game cheats for the popular mobile game Standoff 2, which were disseminated via Telegram channels. This method leverages the gaming community's trust and eagerness for cheats to propagate the malware. A distinctive feature of Blitz is its abuse of Hugging Face Spaces, a legitimate AI model hosting platform, to host components of its command and control (C2) infrastructure and payloads. This tactic complicates detection and takedown efforts because it blends malicious activity with legitimate cloud services.

Once deployed, Blitz performs multiple malicious activities: it steals sensitive information from infected systems and conducts distributed denial-of-service (DDoS) attacks, potentially disrupting network availability for targeted entities. Additionally, the malware deploys an XMRig cryptocurrency miner as a secondary payload, which hijacks system resources to mine Monero cryptocurrency, leading to degraded system performance and increased operational costs. By May 2025, the malware developer reportedly abandoned the project, but the infection footprint remains significant, with 289 victims identified across 26 countries. Russia has the highest infection count, indicating either targeting preferences or greater exposure.

The malware employs a wide range of tactics and techniques as mapped to MITRE ATT&CK, including credential dumping (T1003.001), input capture (T1056.001), command and control over web protocols (T1071), process injection (T1055), and persistence mechanisms (T1547.001), among others. These techniques enable stealthy operation, lateral movement, and sustained presence within compromised environments. Palo Alto Networks customers benefit from protection via their security products, but organizations outside this ecosystem may remain vulnerable.

Overall, Blitz represents a multifaceted threat combining social engineering (via game cheats), abuse of legitimate cloud infrastructure, and a blend of espionage and resource hijacking activities.

Detailed information about Blitz Malware: A Tale of Game Cheats and Code Repositories. Get real-time updates, technical details, and mitigation strategies.

Blitz Malware: A Tale of Game Cheats and Code Repositories - Live Threat Intelligence - Threat Radar | OffSeq.com

Blitz Malware: A Tale of Game Cheats and Code Repositories

A recent incident response case in Brazil revealed a Perl-based crypto mining botnet called Outlaw, also known as Dota, targeting Linux environments. The threat actor exploits weak SSH credentials, downloads malicious scripts, and deploys an XMRig miner for Monero cryptocurrency. The botnet includes an IRC-based client that acts as a backdoor, allowing for various malicious activities. Victims have been identified mainly in the United States, with additional targets in Germany, Italy, Thailand, Singapore, Taiwan, Canada, and Brazil. The article provides detailed analysis of the malware's components, persistence mechanisms, and evasion techniques. Recommendations for system administrators include hardening SSH configurations and implementing additional security measures to mitigate the risk of compromise.

The Outlaw cybergang operates a Perl-based crypto mining botnet, also known as Dota, primarily targeting Linux environments by exploiting weak SSH credentials. The attack vector begins with brute forcing or credential stuffing on SSH services, allowing the adversary to gain unauthorized access to vulnerable systems. Once access is obtained, the attacker downloads malicious scripts that deploy the XMRig cryptocurrency miner to illicitly mine Monero (XMR). The botnet's architecture includes an IRC-based client backdoor, which provides persistent remote control capabilities, enabling the threat actor to execute additional malicious activities beyond crypto mining, such as lateral movement, data exfiltration, or further malware deployment. The malware employs multiple persistence mechanisms and evasion techniques to maintain long-term presence and avoid detection, including obfuscation, process hiding, and possibly timestomping. The threat actor leverages various MITRE ATT&CK techniques such as T1110 (Brute Force), T1059.004 (Perl), T1021.004 (SSH), T1071 (Application Layer Protocol), T1564.001 (Hidden Files and Directories), and others, indicating a sophisticated and multi-faceted attack methodology. Victims have been identified globally, with a notable presence in the United States and European countries like Germany and Italy, as well as in Asia and the Americas. The botnet's focus on Linux systems, which are widely used in enterprise servers and cloud infrastructure, increases the potential attack surface. The threat's medium severity rating reflects its capability to compromise systems for illicit crypto mining and backdoor access, but it does not currently appear to include destructive payloads or widespread exploitation of zero-day vulnerabilities. However, the persistence and stealth features pose a risk of prolonged undetected compromise.

Detailed information about Outlaw cybergang attacking targets worldwide. Get real-time updates, technical details, and mitigation strategies.

Outlaw cybergang attacking targets worldwide - Live Threat Intelligence - Threat Radar | OffSeq.com

Outlaw cybergang attacking targets worldwide

Between February and May, multiple exploitations of CVE-2025-32432, a Remote Code Execution vulnerability in Craft CMS, were observed. The attack chain involves deploying a webshell, downloading an infection script, and executing malicious payloads including a loader, crypto miner, and residential proxyware. The Mimo intrusion set is believed responsible, using distinctive identifiers like '4l4md4r' and 'n1tr0'. The group deploys XMRig for cryptomining and IPRoyal for bandwidth monetization. Two potential operators, 'EtxArny' and 'N1tr0', were identified through social media analysis. While showing interest in Middle Eastern affairs, the group's primary motivation appears financial. Detection opportunities include monitoring for unusual processes in temporary directories and kernel module alterations.

The threat involves a campaign by the Mimo intrusion set exploiting a Remote Code Execution (RCE) vulnerability identified as CVE-2024-46483 in Craft CMS, a popular content management system. Between February and May 2025, attackers leveraged this vulnerability to deploy webshells on compromised servers, enabling remote control and further malicious activities. The attack chain typically begins with exploitation of the RCE flaw to upload and execute a webshell, followed by downloading an infection script that installs multiple payloads. These payloads include a loader component, the XMRig cryptominer, and residential proxyware (IPRoyal) used for bandwidth monetization. The campaign is financially motivated, with the adversary using compromised systems to mine cryptocurrency and resell network bandwidth. Distinctive identifiers such as '4l4md4r' and 'n1tr0' have been linked to the group, and social media analysis suggests two potential operators named 'EtxArny' and 'N1tr0'. The group shows some interest in Middle Eastern geopolitical affairs but primarily focuses on financial gain. Detection opportunities include monitoring for unusual processes running from temporary directories, kernel module modifications, and network traffic consistent with proxyware or cryptomining activity. The campaign employs multiple MITRE ATT&CK techniques such as T1190 (Exploit Public-Facing Application), T1059.004 (Command and Scripting Interpreter: Unix Shell), T1505.003 (Server Software Component: Web Shell), T1588.006 (Obtain Capabilities: Compromise Software Supply Chain), and others related to persistence, defense evasion, and resource hijacking. Although no known exploits in the wild were reported at the time of publication, the active exploitation window and presence of webshells indicate a real and ongoing threat to Craft CMS users.

Detailed information about The Sharp Taste of Mimo'lette: Analyzing Mimo's Latest Campaign targeting Craft CMS. Get real-time updates, technical details, and mi

Title	Severity	Type	Source	Date

Threats Tagged 'xmrig'

Filter Threats

Scan a website for live threats in under a minute

Threats Tagged 'xmrig'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility