Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Zanubis is an evolving Android banking Trojan that emerged in 2022, targeting financial institutions in Peru before expanding to virtual cards and crypto wallets. It impersonates legitimate apps to trick users into granting accessibility permissions, enabling extensive data theft and device control. The malware has undergone significant development, incorporating features like SMS hijacking, screen recording, and device credential stealing. Recent versions show improved obfuscation, encryption, and silent installation techniques. The threat actors, likely based in Peru, continue to refine the malware's capabilities and targeting strategy, focusing on high-value financial targets in the region.

Zanubis is a sophisticated Android banking Trojan first identified in 2022, initially targeting financial institutions in Peru. Over time, it has evolved to expand its attack surface to include virtual cards and cryptocurrency wallets, reflecting a strategic shift to high-value digital assets. The malware operates by impersonating legitimate applications to deceive users into granting accessibility permissions. These permissions are critical as they allow Zanubis to perform extensive data theft and device control operations. Key technical capabilities of Zanubis include SMS hijacking, which enables interception and manipulation of text messages often used in two-factor authentication; screen recording to capture sensitive user interactions; and stealing device credentials to facilitate unauthorized access to financial accounts. Recent iterations of Zanubis demonstrate enhanced obfuscation and encryption techniques, making detection and analysis more challenging for security tools. Additionally, the Trojan employs silent installation methods to avoid user suspicion and maintain persistence on infected devices. The threat actors behind Zanubis are believed to be based in Peru and continue to refine the malware’s capabilities and targeting strategies, focusing on high-value financial targets within their region. Although Zanubis has not been reported to exploit known vulnerabilities or have publicly available exploits, its evolving feature set and stealth techniques make it a persistent threat to Android users involved in financial transactions, particularly in Latin America.

Detailed information about Evolution of Zanubis, a banking Trojan for Android. Get real-time updates, technical details, and mitigation strategies.

Evolution of Zanubis, a banking Trojan for Android - Live Threat Intelligence - Threat Radar | OffSeq.com

Evolution of Zanubis, a banking Trojan for Android

Threats Tagged 'zanubis'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'zanubis'

Lead Pen Test Professional