blueteamsec

627 readers

35 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

451

5

GCVE Announces the Launch of db.gcve.eu: A New Open Public Vulnerability Advisory Database (gcve.eu)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

452

5

CVE-2026-0830 - Command Injection in Kiro GitLab Merge Request Helper (aws.amazon.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

453

3

Fugitive wanted in connection with Desjardins data breach arrested in Spain (www.cbc.ca)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

454

5

The State of Ransomware in the U.S.: Report and Statistics 2025 (www.emsisoft.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

455

7

France releases Russian man wanted in US for cyberhacking, lawyer says (www.reuters.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

456

2

CTO at NCSC Summary: week ending January 11th (ctoatncsc.substack.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

457

3

dumpguard_bof: Beacon Object File (BOF) port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

458

1

The Pattern in the Noise: What 1,602 Exposed Modbus Systems Reveal About Industrial Security's Systemic Failures (chawkr.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

459

2

The Ghost in the Machine: Unmasking CrazyHunter's Stealth Tactics (www.trellix.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

460

1

Deep Malware and Phishing Analysis -Breaking Down an Access-Code-Gated Malware Delivery Chain (www.joesecurity.org)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

461

1

Package-Inferno: A Public Package Scanner for The Community (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

462

2

The defendant is sentenced to seven years in prison. He is guilty of complicity in computer hacking. The purpose of this was to gain access to port systems so he could then import drugs undetected (uitspraken.rechtspraak.nl)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

463

2

Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant (www.cloudsek.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

464

2

ESXi Exploitation in the Wild (www.huntress.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

465

1

Real-time malware defense: Leveraging AWS Network Firewall active threat defense (aws.amazon.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

466

4

Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) (www.cyera.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

467

3

JA4 Fingerprinting Against AI Scrapers: A Practical Guide (webdecoy.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

468

3

Malware Analysis Space: Revisiting LoJax: Supplementary Analysis and Research Notes (malwareanalysisspace.blogspot.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

469

3

Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns (research.checkpoint.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

470

2

100 Days of KQL 2026: Unusual use of msbuild.exe to execute code inside .proj file to bypass AV detection (github.com)

submitted 1 month ago* (last edited 1 month ago) by digicat to c/blueteamsec

0 comments fedilink

471

2

100 Days of KQL 2026: Filename pattern for RAT dropped in BSOD Clickfix Campaign (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

472

2

100 Days of YARA 2026: Detects DCRAT samples used in the PhaltBlyx campaign, specifically identifying Stub.exe samples with PE stomping of the creation date. (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

473

2

100 Days of YARA 2026: detects on files greater than 300MB in size with a low entropy (low randomness). Average PE entropy is around 6 or 7. The files we are looking for are between 3 and 0.01. (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

474

2

100 Days of YARA 2026: Detects Industroyer malware based on the count of specific PE Rich header Prod IDs (github.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink

475

6

Updating the Sysmon Community Guide: Lessons Learned from the Front Lines (trustedsec.com)

submitted 1 month ago by digicat to c/blueteamsec

0 comments fedilink