blueteamsec

632 readers

18 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1326

3

DetonatorAgent: Detonate malware on VMs and get logs & detection status (github.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1327

3

To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER (cloud.google.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1328

3

Effective practices: Cyber response and recovery capabilities (www.bankofengland.co.uk)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1329

2

From Chaos to Capability: Building the US Market for Offensive Cyber (sergeybratus.gitlab.io)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1330

9

Spyware maker NSO Group blocked from WhatsApp | TechCrunch (techcrunch.com)

submitted 4 months ago by digicat to c/blueteamsec

1 comments fedilink

1331

3

How to use chaos engineering in incident response | Amazon Web Services (aws.amazon.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1332

3

Malicious package with AdaptixC2 framework agent found in npm registry (securelist.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1333

2

WOOT'25 videos (www.youtube.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1334

3

Unmasking the Invisible: Hunting and Defeating EDR-Evading Threats Like BRICKSTORM - "YARA signatures, or suspicious file paths on a vCenter server) were found in a customer's backups" (zerolabs.rubrik.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1335

4

Extortion and ransomware drive over half of cyberattacks - "Just 20 ASNs—only 0.04%— account for more than 80% of malicious password spray activity" (cdn-dynmedia-1.microsoft.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1336

1

Secure Parsing and Serializing with Separation Logic Applied to CBOR, CDDL, and COSE (www.microsoft.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1337

5

Diffing 7-Zip for CVE-2025-11001 (pacbypass.github.io)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1338

1

KNighter: Transforming Static Analysis with LLM-Synthesized Checkers (arxiv.org)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1339

1

Shifts in the Underground: The Impact of Water Kurita’s (Lumma Stealer) Doxxing (www.trendmicro.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1340

2

DefenderWrite: Abusing Whitelisted Programs for Arbitrary Writes (www.zerosalarium.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1341

2

Lessons from the BlackBasta Ransomware Attack on Capita (blog.bushidotoken.net)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1342

3

CTO at NCSC Summary: week ending October 19th.. (ctoatncsc.substack.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1343

2

BeaverTail and OtterCookie evolve with a new Javascript module (blog.talosintelligence.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1344

1

OtterCandy, malware used by WaterPlum | セキュリティナレッジ | NTTセキュリティ・ジャパン株式会社 (jp.security.ntt)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1345

2

New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware | Google Cloud Blog (cloud.google.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1346

2

DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains | Google Cloud Blog (cloud.google.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1347

4

Training Solo - the first systematic analysis of self-training Spectre-v2 attacks that break the core assumption behind domain isolation—even when implemented perfectly. (www.vusec.net)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1348

2

yIKEs (WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242) (labs.watchtowr.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1349

4

StealthServer: A Dual-Platform Backdoor from a South Asian APT Group (blog.xlab.qianxin.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink

1350

3

Operation Silk Lure: Scheduled Tasks Weaponized for DLL Side-Loading (drops ValleyRAT) (www.seqrite.com)

submitted 4 months ago by digicat to c/blueteamsec

0 comments fedilink