blueteamsec

630 readers

48 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

926

1

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System (www.darktrace.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

927

2

Microsoft 365: The Essential 10 Security Considerations (campbell.scot)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

928

1

Building custom C2 channels by hooking wininet (codex-7.gitbook.io)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

929

2

commandline_spoofing: Commandline spoofing on Windows (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

930

1

RelayInformer: Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

931

1

Anti-Sandbox: Detecting AnyRun sandbox, and more is coming out in the future - AnyRun being Russian in origin (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

932

1

GitHub - mimorep/Indirect-Shellcode-Executor: Indirect-Shellcode-Executor expoits the miss-configuration/vulnerability present on the API Windows method ReadProcessMemory (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

933

6

Living Off the Land: Windows Post-Exploitation Without Tools (xbz0n.sh)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

934

1

Neo: The NeoC2 Framework (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

935

3

Cracking the Crystal Palace - "To target Crystal Palace artefacts specifically, I only looked at the "stuff" that it inserts into the final assembly, rather than any code that can be written" (rastamouse.me)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

936

1

Cracking the Crystal Palace - "To target Crystal Palace artefacts specifically, I only looked at the "stuff" that it inserts into the final assembly, rather than any code that can be written" (rastamouse.me)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

937

1

MANTIS: A Deep Dive Into IRIS C2's Flagship Windows Agent (www.irisc2.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

938

1

The most advanced ClickFix yet? - "where the delivery vector was observed, 4 in 5 were accessed via Google Search." (pushsecurity.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

939

4

Phishing for AWS Credentials via the New ‘aws login’ Flow (medium.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

940

2

Analyzing the latest Sneaky2FA BITB phishing page (pushsecurity.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

941

1

Inside Valkyrie Stealer: Capabilities, Evasion Techniques, and Operator Profile (www.dexpose.io)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

942

1

CVE-2025-13315, CVE-2025-13316: Critical Twonky Server Authentication Bypass (NOT FIXED) (www.rapid7.com)

submitted 2 months ago by digicat to c/blueteamsec

1 comments fedilink

943

1

[Updated 27 Nov 2025 00:21 UTC] Deep scan for bad NPM packages nested across projects - DFIR for Shai-Hulud cyberattack, Sep-Nov 2025 (gist.github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

944

2

Apache Druid’s Kerberos authenticator uses a weak fallback secret (github.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

945

1

InfCode: Adversarial Iterative Refinement of Tests and Patches for Reliable Software Issue Resolution (arxiv.org)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

946

1

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets (www.cleafy.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

947

1

TangleCrypt: a sophisticated but buggy malware packer (labs.withsecure.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

948

1

Breaking Into a Brother (MFC-J1010DW): Three Security Flaws in a Seemingly Innocent Printer (starlabs.sg)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

949

8

Malicious VS Code Extension Impersonating “Material Icon Theme” Found in Marketplace (www.nextron-systems.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink

950

1

Operation Hanoi Thief: Threat Actor targets Vietnamese IT professionals and recruitment teams. (www.seqrite.com)

submitted 2 months ago by digicat to c/blueteamsec

0 comments fedilink