blueteamsec

670 readers

53 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

276

2

Iran conflict drives heightened espionage activity against Middle East targets | Proofpoint US (www.proofpoint.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

277

2

Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine (hunt.io)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

278

3

Uncovering a New Device Code Phishing Campaign (newtonpaul.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

279

2

The Tensor in the Haystack: Weightsquatting as a Supply-Chain Risk (labs.itresit.es)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

280

2

ENISA Technical Advisory for Secure Use of Package Managers | ENISA (www.enisa.europa.eu)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

281

2

Sednit reloaded: Back in the trenches (www.welivesecurity.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

282

3

China‑Nexus APT Targets Qatar (blog.checkpoint.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

283

3

New A0Backdoor Linked to Teams Impersonation and Quick Assist Social Engineering (www.bluevoyant.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

284

3

FortiGate Edge Intrusions | Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise (www.sentinelone.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

285

3

Behind the console: Active phishing campaign targeting AWS console credentials | Datadog Security Labs (securitylabs.datadoghq.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

286

1

Protecting Your Data: Essential Actions to Secure Experience Cloud Guest User Access - Salesforce Security has been tracking an increase in threat actor activity targeting misconfigurations (www.salesforce.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

287

3

MC1247893 - Microsoft Entra passkeys on Windows now support phishing-resistant sign-in | Microsoft 365 Message Center Archive (mc.merill.net)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

288

2

Hunting Lazarus, Part 5: Eleven Hours on His Disk - Forensic examination of an active Lazarus Group operator machine: a target list of nearly 17,000 developers, six drained wallets.. (redasgard.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

289

2

Unmasking an Attack Chain of MuddyWater | Huntress (www.huntress.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

290

1

Rusland voert cybercampagne uit tegen Signal- en Whatsapp-accounts | AIVD - Russia launches cyber campaign against Signal and WhatsApp accounts (www-aivd-nl.translate.goog)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

291

1

bromure: Secure, ephemeral browsing in a disposable VM (macOS only) (github.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

292

10

How I infiltrated phishing panels targeting European banks and tracked down their operators (inti.io)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

293

2

INC Ransom Affiliate Model Enabling Targeting of Critical Networks (www.cyber.gov.au)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

294

3

From a Sophisticated Browser-Extension Supply-Chain Compromise to a VibeCoded Twist: A Chrome Extension as the Initial Access Vector for a Broader Malware Chain (monxresearch-sec.github.io)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

295

1

Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition (cloud.google.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

296

1

hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far - StepSecurity (www.stepsecurity.io)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

297

1

How we built high speed threat hunting for email security (sublime.security)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

298

6

The "P" in PAM is for Persistence: Linux Persistence Technique (www.blackhillsinfosec.com)

submitted 3 weeks ago by digicat to c/blueteamsec

1 comments fedilink

299

9

neko: A self hosted virtual browser that runs in docker and uses WebRTC. (github.com)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink

300

1

ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense (arxiv.org)

submitted 3 weeks ago by digicat to c/blueteamsec

0 comments fedilink