blueteamsec

670 readers

22 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

76

4

Tails 7.6 Hides Bridge Requests Behind CDN Traffic (www.sambent.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

77

4

BPFdoor in Telecom Networks: Sleeper Cells in the backbone (www.rapid7.com)

submitted 6 days ago by digicat to c/blueteamsec

1 comments fedilink

78

0

MemShellParty: 一款专注于 Java 主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队成员的工作流程，提升攻防 - tool for quickly generating memory malware for mainstream Java web middleware (github.com)

submitted 3 days ago by digicat to c/blueteamsec

0 comments fedilink

79

3

Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka (www.malwarebytes.com)

submitted 6 days ago by digicat to c/blueteamsec

1 comments fedilink

80

2

Apifox CDN 供应链投毒事件简单复盘 - A brief recap of the Apifox CDN supply chain poisoning incident (www-leavesongs-com.translate.goog)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

81

2

Voidstealer ABE Bypass: Chromium Application-Bound Encryption. (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

82

2

Bypassing Code Integrity Using BYOVD for Kernel R/W Primitives (medium.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

83

2

BPFDoor-controller-source: Source code to recent BPFDoor's controller variant (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

84

2

BRUSHWORM and BRUSHLOGGER (www.elastic.co)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

85

2

Ivanti EPMM Exploitation: Hit-and-Run (labs.withsecure.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

86

3

BPFdoor in Telecom Networks: Sleeper Cells in the backbone (www.rapid7.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

87

0

gh-safe-repo: Python CLI that creates GitHub repos with safe defaults — branch protection, Dependabot, secret scanning, and pre-flight security scanning — applied automatically. (github.com)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

88

-1

Leveling Up Secure Code Reviews with Claude Code (specterops.io)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

89

2

Keys on Doormats: Exposed API Credentials on the Web (arxiv.org)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

90

2

Operation Storming Tide: A massive multi-stage intrusion campaign (fortgale.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

91

2

When Bills Come with Surprise: Donut of Python and Rat🤮 (labs.itresit.es)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

92

2

Russian cybercriminal sentenced to prison for using a “botnet” to steal millions from American businesses (www.justice.gov)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

93

2

Wargaming a China-Taiwan Conflict and Its Cyber Scenarios (open.substack.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

94

4

Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs (v4bel.github.io)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

95

4

NICKEL ALLEY strategy: Fake it ‘til you make it - Victimizing software developers via fake companies, jobs, and code repositories to steal cryptocurrency (www.sophos.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

96

3

Pro-Iranian Nasir Security is Targeting The Energy Sector in the Middle East (www.resecurity.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

97

10

Our investigation of the laptop farm identified that DPRK IT workers leverage Raspberry Pi-based KVM (Keyboard-Video-Mouse) devices to remotely access desktops and mesh VPN (6068438.fs1.hubspotusercontent-na1.net)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

98

1

Who Runs Cl0p? Inside the Most Elusive Ransomware Operation in the World (rmoskovy.github.io)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

99

3

TeamPCP Isn't Done: Threat Actor Behind Trivy and KICS Compromises Now Hits LiteLLM's 95 Million Monthly Downloads on PyPI (www.endorlabs.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

100

2

APT-C-13 (Sandworm) RDP backdoor attack (mp.weixin.qq.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink