Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A detailed analysis of a sophisticated intrusion targeting a cryptocurrency foundation employee is presented. The attack, attributed to the North Korean APT group BlueNoroff, began with a social engineering lure via Telegram, leading to the installation of malicious software disguised as a Zoom extension. The intrusion involved multiple stages of malware deployment, including persistent implants, backdoors, keyloggers, and cryptocurrency stealers. The attackers utilized advanced techniques such as process injection on macOS and leveraged various tools to collect sensitive information, particularly focusing on cryptocurrency-related data. The analysis covers the initial access vector, technical details of the malware components, and their functionalities, providing insights into the evolving tactics of state-sponsored threat actors targeting macOS systems.

The BlueNoroff Web3 macOS intrusion campaign is a sophisticated cyber espionage and cryptocurrency theft operation attributed to the North Korean APT group BlueNoroff. The attack targets employees of cryptocurrency foundations, leveraging social engineering via Telegram to initiate the compromise. The initial access vector involves a lure message on Telegram that convinces the target to install a malicious software component masquerading as a Zoom extension. This deceptive tactic exploits user trust in legitimate collaboration tools to bypass initial suspicion.

Once installed, the malware deploys multiple stages of payloads designed for persistence and extensive data exfiltration. These include implants that maintain long-term access, backdoors for remote control, keyloggers to capture user input, and cryptocurrency stealers specifically crafted to harvest sensitive wallet credentials and transaction data. The attackers employ advanced macOS-specific techniques such as process injection using the dynamic linker (dyld), enabling stealthy code execution within legitimate processes to evade detection.

The campaign utilizes a variety of malware components with capabilities including credential dumping (T1555), process injection (T1055), masquerading (T1036), and command and control communication over standard protocols (T1071.001). The attackers also use obfuscation (T1027) and persistence mechanisms (T1547.001) to maintain foothold. The focus on Web3 and cryptocurrency-related data indicates a strategic targeting of digital asset infrastructure. The campaign demonstrates evolving tactics of state-sponsored actors adapting to macOS environments, which have traditionally been less targeted than Windows but are increasingly attractive due to growing adoption in high-value sectors.

Indicators of compromise include multiple file hashes and suspicious domains used for command and control or malware distribution, such as 'metamask.awaitingfor.site' and 'support.us05web-zoom.biz'. The campaign does not rely on known software vulnerabilities but rather on social engineering and custom malware, highlighting the importance of user awareness and endpoint detection on macOS platforms.

Detailed information about Inside the BlueNoroff Web3 macOS Intrusion Analysis. Get real-time updates, technical details, and mitigation strategies.

Inside the BlueNoroff Web3 macOS Intrusion Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

Inside the BlueNoroff Web3 macOS Intrusion Analysis

Threats Tagged 'xscreen'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'xscreen'

Lead Pen Test Professional