blueteamsec

632 readers

60 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

1251

1

New Loader Executing TorNet and PureHVNC – IIJ Security Diary (in English) (sect.iij.ad.jp)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1252

5

Hack-cessibility: When DLL Hijacks Meet Windows Helpers (trustedsec.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1253

3

UnderlayCopy: PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1254

4

How a hacking gang held Italy’s political elites to ransom (www.politico.eu)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1255

2

Threats of Unvalidated XPC Clients on macOS (afine.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1256

1

Creating and maintaining a definitive view of your operational technology architecture (www.cyber.gov.au)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1257

1

Have you SYN what I see? Analyzing TCP SYN Payloads in the Wild (gsmaragd.github.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1258

1

BlueNoroff's latest campaigns: GhostCall and GhostHire (securelist.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1259

2

Possible CryptoChameleon Social Engineering Campaign Targeting LastPass Customers, Crypto Exchange Customers, Passkeys, and More (blog.lastpass.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1260

2

SockTail: joins a device to a Tailscale network and exposes a local SOCKS5 proxy. Designed for red team operations and ephemeral access into restricted environments using Tailscale’s (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1261

1

SockTail: joins a device to a Tailscale network and exposes a local SOCKS5 proxy. Designed for red team operations and ephemeral access into restricted environments using Tailscale’s (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1262

1

Function Peekaboo: Crafting self masking functions using LLVM (www.mdsec.co.uk)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1263

3

Mem3nt0 mori – The Hacking Team is back! (securelist.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1264

2

Uncovering Qilin attack methods exposed through multiple cases (blog.talosintelligence.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1265

2

Контроль за работой «белых» хакеров предложили передать ФСБ - It has been proposed that control over the work of "white hat" hackers be transferred to the FSB. (www.rbc.ru)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1266

3

pdf_object_hashing: PDF Object Hash is a way to identifying similarities between PDFs without relying on the content of the document. (github.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1267

3

Exclusive: Full Student Database of MOIS-Affiliated Ravin Academy Leaked (blog.narimangharib.com)

submitted 3 months ago by digicat to c/blueteamsec

1 comments fedilink

1268

2

Using EDR-Redir To Break EDR Via Bind Link and Cloud Filter (www.zerosalarium.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1269

1

UN Convention against Cybercrime opens for signature in Hanoi, Viet Nam (www.unodc.org)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1270

27

How a fake AI recruiter delivers five staged malware disguised as a dream job (medium.com)

submitted 3 months ago by digicat to c/blueteamsec

3 comments fedilink

1271

1

Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe (arcticwolf.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1272

1

SideWinder's Shifting Sands: Click Once for Espionage (www.trellix.com)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1273

0

Key IOCs for Pegasus and Predator Spyware Cleaned With iOS 26 Update (iverify.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1274

-1

TransparentTribe targets Indian military organisations with DeskRAT (blog.sekoia.io)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink

1275

3

CVE-2025-40780: DNS Cache poisoning due to weak PRNG - Bins 9! (kb.isc.org)

submitted 3 months ago by digicat to c/blueteamsec

0 comments fedilink