blueteamsec

545 readers

7 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1151

1

DPAPI Backup Key Compromise Pt. 1: Some Forests Must Burn (specterops.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1152

2

LARVA-208 compromised the Steam game Chemia to distribute multiple malware families - Indicators of Compromise (github.com)

submitted 3 months ago by digicat to c/blueteamsec

1 comments fedilink

1153

1

MCPSpy: MCP Monitoring with eBPF (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1154

1

eBPF: Handling events in Userspace (h0x0er.github.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1155

1

Sentrilite – Open source, Lightweight, Real time, Kernel level System Observability and Audit tool (Powered by eBPF + AI) (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1156

1

DESCG: data encoding scheme classification with GNN in binary analysis (link.springer.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1157

1

Invisible Traces: Using Hybrid Fingerprinting to identify underlying LLMs in GenAI Apps (arxiv.org)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1158

1

Explainable Vulnerability Detection in C/C++ Using Edge-Aware Graph Attention Networks (arxiv.org)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

https://github.com/Radowan98/ExplainVulD

1159

1

PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python (arxiv.org)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1160

2

Umbral Stealer config extractor.ipynb - Config extractor of obfuscated umbral stealer samples and CLEANED (de4dot) samples writen in DotNet. hashes (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1161

2

TPwSav.sys Driver - Arbitrary Physical Memory Read and Write Primitive (zeifan.my)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1162

3

MaaS Appeal: An Infostealer Rises From The Ashes — NOVABLIGHT is a NodeJS-based Malware-as-a-Service (MaaS) information stealer developed and sold by a threat group that demonstrates French-language (www.elastic.co)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1163

2

Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal - The campaign leverages malicious advertisements to lure victims to install fake applications which impersonate ~ 50 common apps (research.checkpoint.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1164

3

GOLD BLADE remote DLL sideloading attack deploys RedLoader (news.sophos.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1165

5

Spear Phishing Campaign Delivers VIP Keylogger via Email Attachment - AutoIt script is utilized to deliver and execute the malicious payload. (www.seqrite.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1166

4

Telemetry and Privacy Analysis of Trae IDE: A Deep Dive into ByteDance's VSCode Fork (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1167

2

Auto-Color Backdoor: the threat actor had exploited CVE-2025-31324 - Over the course of three days, a threat actor gained access to the customer’s network, attempted to download suspicious files (www.darktrace.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1168

4

RansomFS: an example of using canary files and directories, chained with different threshold engines to map a PID to its malicious behaviour and trigger a response when this threshold is breached. (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1169

3

Privacy Enhancing Technologies Symposium videos (youtube.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1170

2

Mistwalker: Create Entra Global Admin accounts from On-Prem (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1171

2

PENGUIN (Personalized EmulatioN Generated Using Instrumented Analysis) takes a target centric approach to rehosting using a precise and tailored specification of the rehosting process (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1172

12

Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications (www.wiz.io)

submitted 3 months ago by digicat to c/blueteamsec

3 comments fedilink

1173

2

Revisiting UNC3886 Tactics to Defend Against Present Risk - an APT group that has historically targeted including telco, gov tech and defense, with a recent attack against Singapore (www.trendmicro.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1174

4

PyPI Users Email Phishing Attack - The Python Package Index Blog (blog.pypi.org)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1175

5

Governor Walz Activates Minnesota National Guard Following Saint Paul Cyberattack (mn.gov)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink