blueteamsec

679 readers

30 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

2026

5

Building the Leading Open-Source Pentesting Agent: Architecture Lessons from XBOW Benchmark (medium.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2027

2

2025年度版：脅威ハンティング再考 - 2025 Edition: Threat Hunting Revisited (www.scientia-security.org)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2028

1

aws-iam-actions-list: A list of all known Amazon Web Services' IAM actions; and a way of updating that list. (github.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2029

1

The Evolution of Qilin RaaS (www.sans.org)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2030

1

SBI Crypto - SBI Crypto joined an expensive club nobody wants membership in: Japanese crypto companies that marketed security while hemorrhaging funds to North Korean hackers (rekt.news)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2031

4

CrowdStrike Identifies Campaign Targeting Oracle E-Business Suite via Zero-Day Vulnerability Tracked as CVE-2025-61882 (www.crowdstrike.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2032

5

Well, Well, Well. It’s Another Day. (Oracle E-Business Suite Pre-Auth RCE Chain - CVE-2025-61882) (labs.watchtowr.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2033

1

CN APT targets Serbian Government (strikeready.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2034

1

CVE-2025-61882: Detection for CVE-2025-61882 - Oracle E-Business zero-day (github.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2035

1

Oracle Security Alerts CVE-2025-61882 - October 4th 2025 - "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network .. this vulnerability may result (www.oracle.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2036

3

Inside the Unified Log 3: Log storage and attrition (eclecticlight.co)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2037

2

XWorm V6: Exploring Pivotal Plugins (www.trellix.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2038

5

Exploiting Legitimate Remote Access Tools in Ransomware Campaigns (www.seqrite.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2039

2

Don’t Sweat the ClickFix Techniques: Variants & Detection Evolution | Huntress (www.huntress.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2040

2

Operation SouthNet: SideWinder Targets South Asia Maritime (hunt.io)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2041

2

Coordinated Grafana Exploitation Attempts on 28 September (www.greynoise.io)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2042

1

Defending against supply chain attacks like Chalk/Debug and the Shai-Hulud worm (aws.amazon.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2043

1

Using .LNK files as lolbins (www.hexacorn.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2044

3

North Korea IT Workers: Inside the DPRK’s Crypto Laundering Network (www.chainalysis.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2045

3

OneDrive. Let's take this offline (malwaremaloney.blogspot.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2046

1

NetworkHound: Advanced Active Directory network topology analyzer with SMB validation, multiple authentication methods (password/NTLM/Kerberos), and comprehensive network discovery. (github.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2047

1

Adding Determinism and Safety to Uber IAM Policy Changes (www.uber.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2048

1

Taming 2,500 compiler warnings with CodeQL, an OpenVPN2 case study (blog.trailofbits.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2049

1

GhostSocks: From Initial Access to Residential Proxy (synthient.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink

2050

3

0day .ICS attack in the wild - details an incident from April 2025 in September 2025 - "a then-zero-day exploit in Zimbra’s Collaboration Suite, CVE-2025-27915" (strikeready.com)

submitted 6 months ago by digicat to c/blueteamsec

0 comments fedilink