blueteamsec

674 readers
16 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat
listing: all - local
776
2
Reversing a Microsoft-Signed Rootkit: The Netfilter Driver (splintersfury.github.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
777
2
CoreAudio Exploit POC (macOS Sequoia) (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
778
2
Practical Threat Detections for Telecommunications (gcforum.org)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
779
2
CTO at NCSC Summary: week ending February 1st (ctoatncsc.substack.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
780
2
Android Trojan Campaign Uses Hugging Face Hosting for RAT Payload Delivery (www.bitdefender.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
781
1
.NET GAC and NIC hijacking for lateral movement - ... (williamknowles.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
782
2
DynoWiper update: Technical analysis and attribution (www.welivesecurity.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
783
8
Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) (labs.watchtowr.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
784
5
When Malware Talks Back | Pulsar RAT Powers Live Chat Driven Remote Control and Advanced Infostealer Delivery via Donut Loader (www.pointwild.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
785
2
Living off the Process (g3tsyst3m.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
786
2
Energy Sector Incident Report - 29 December 2025 by CERT Poland (cert.pl)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
787
4
Black Industry: IRGC-Linked offensive OT framework (lab52.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
788
3
NetScaler® Secure Deployment Guide - if you run two NetScalers in the high availability (HA/HA-INC) deployment, no SSH host key checks are performed between them - fixed in 14.1-60.52 - no CVE (docs.netscaler.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
 
 

https://x.com/i/status/2016836304730739158

789
4
Bypassing Windows Administrator Protection (projectzero.google)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
790
3
Introducing RelayKing – Relay To Royalty (www.depthsecurity.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
791
5
SonicWall Breach Led to Ransomware Attack on 74 US Banks (www.ctrlaltnod.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
792
2
Winsock no winsocks (gist.github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
793
2
Retro hunt results for binaries with the Claude refusal magic string by Florian (docs.google.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
794
3
The mystery behind a backslash: an anti-sandbox bypass technique for undisclosed APT32 samples (xz.aliyun.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
795
2
drvtrace: WinDbg plugin to trace module transitions from a debugged driver. (github.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
796
3
Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic (blog.sekoia.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
797
2
RedKitten: AI-accelerated campaign targeting Iranian protests (harfanglab.io)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
798
1
CVE-2025-40551: SolarWinds WHD RCE (horizon3.ai)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
799
1
ErrTraffic Under the Hood: A look at the source code (ctrlaltintel.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
800
1
LABYRINTH CHOLLIMA Evolves into Three Adversaries (www.crowdstrike.com)
submitted 2 months ago by digicat to c/blueteamsec
0 comments fedilink
view more: ‹ prev next ›