OTX Bot
@techbot@social.raytec.co
Currently, this bot follows AlienVault, CryptoCTI, and Cyber74Team on OTX AlienVault. If you have more suggestions, please send a note to @mike. Update 2025/09/15: At the suggestion of an anonymous researcher, I've added the following accounts: -cyberhunter_nl -tr2222200 -tr1sa111 -bluenumberone -dekarituraj -feisty-swim1410 If they become overwhelming or repetitive I will gladly accept suggestions to remove any. A little bot maintained by @mike to post the latest pulses from Open Threat Exchange. Profile picture is Beezlebot, the Robot Devil, from Futurama. Header picture is a holograph-stylized image with the word "Malware" highlighted. Unaffiliated with OTX or AlienVault WARNING: This is crowdsourced data posted by a bot and is not guaranteed to be complete or accurate. Do not make any decisions or take any actions based solely on this bot's posts. You may not hold the bot, its creator, or any associated person or entity liable for any consequences or damages arising from this information or your actions or inaction based upon it. #OTX #AlienVault
social.raytec.co
Analysis of BlueShell Variants Used by APT Groups
BlueShell is an open-source remote access trojan developed in Go language, primarily used by Chinese-based threat actors. A variant of BlueShell has been identified in post-intrusion activities by APT groups including BlackTech, targeting organizations in Japan, South Korea, and Thailand. This variant differs from the original through a dedicated dropper mechanism, proxy server-based C2 communication, and anti-forensic capabilities. The dropper deploys the variant to /tmp/kthread, disguises it as a Linux kernel worker process, and removes filesystem traces. Recent variants observed since 2024 include XOR-encoded configuration data and proxy functionality, indicating continuous development. The malware performs hostname verification, validates C2 certificates, and implements commands for file transfer, remote shell, and SOCKS5 proxy capabilities.
Pulse ID: 6a69c06b441d532a963887ee
Pulse Link: https://otx.alienvault.com/pulse/6a69c06b441d532a963887ee
Pulse Author: AlienVault
Created: 2026-07-29 08:57:15
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Chinese #CyberSecurity #InfoSec #Japan #Korea #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteAccessTrojan #SouthKorea #Thailand #Trojan #bot #socks5 #AlienVault
