blueteamsec

674 readers

31 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

851

5

Sandworm behind cyberattack on Poland’s power grid in late 2025 (www.welivesecurity.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

852

1

timeline-downloader: A CLI tool for downloading device timeline events from Microsoft Defender XDR using the unofficial apiproxy feature. (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

853

2

OmniScan: OmniScan is a lightweight, multi-engine vulnerability scanner based on Python, designed specifically for red team operations and security research. (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

854

1

VulnLLM-R: Specialized Reasoning LLM for Vulnerability Detection (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

855

1

BGP Vortex: Internet Routing Vortices Create Outages by Preventing Convergence (pulse.internetsociety.org)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

856

1

Ransomware: Tactical Evolution Fuels Extortion Epidemic (www.security.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

857

4

TrueSightKiller: Weaponized Drivers Killing EDR at Scale (www.magicsword.io)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

858

2

cua-kit: Tools for attacking Computer Use Agents (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

859

2

Abusing Windows Audio for Local Privilege Escalation (medium.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

860

2

Decrypting View State Messages (zeroed.tech)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

861

2

Unauthenticated RCE in NetSupport Manager - A Technical Deep Dive (code-white.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

862

5

BaconSampler: Sniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast. (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

863

3

Revisiting GPUGate: Repo Squatting and OpenCL Deception to Deliver HijackLoader (gmo-cybersecurity.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

864

2

CTO at NCSC Summary: week ending January 25th (ctoatncsc.substack.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

865

3

A Shared Arsenal: Identifying Common TTPs Across RATs (www.splunk.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

866

1

LNKファイルを介して実行されるマルウェアMoonPeak – MoonPeak malware executed via LNK files (sect.iij.ad.jp)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

867

1

Oracle RCE Vulnerability CVSS 10.0 - affecting Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS (www.oracle.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

868

1

Scattered Spider Attacks | Infrastructure and TTP Analysis (www.team-cymru.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

869

3

Inside Iran’s APT Network: Profiling the Most Active Iranian State‑Linked Threat Actors (falconfeeds.io)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

870

1

IDA_Plugin_IID_to_String: A plugin for IDA that converts IID/GUID data structures to string and adds comments where the IID is referenced (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

871

3

Break LLM Workflows with Claude's Refusal Magic String (hackingthe.cloud)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

872

1

Analysis of Single Sign-On Abuse on FortiOS (www.fortinet.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

873

1

Before the Headlines: Northwave’s Early LOLDrivers Research (www.magicsword.io)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

874

1

Attackers are leveraging SEO poisoning and abusing online repositories to target users looking for legitimate tools. Associated ZIP archives contain BAT files that impersonate various applications (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

875

3

Cyberattack Targeting Poland’s Energy Grid Used a Wiper (www.zetter-zeroday.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink