blueteamsec

623 readers

17 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

126

4

Compromised Routers, DNS, and a TDS Hidden in Aeza Networks (www.infoblox.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

127

4

They Got In Through SonicWall. Then They Tried to Kill Every Security Tool (www.huntress.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

128

5

Authentication Downgrade Attacks: Deep Dive into MFA Bypass (www.ioactive.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

129

3

Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure (www.group-ib.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

130

3

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia - Check Point Research (research.checkpoint.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

131

3

APT28’s Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure (www.trellix.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

132

4

Synthèse de la menace sur l’IA générative face aux attaques informatiques | Summary of the threat to generative AI in the face of cyberattacks (cyber.gouv.fr)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

133

3

notepad-plus-plus-hashes: Aggregated SHA-256 and SHA-1 checksums for Notepad++ release assets - collected from official GitHub release checksum files. (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

134

2

Cloud Security Posture Management: silver bullet or another piece in the cloud puzzle? (www.ncsc.gov.uk)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

135

3

A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends - v2 published January 6th (arxiv.org)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

136

8

Velociraptor artifact to assist scoping IOCs related to the recent publicly disclosed Notepad++ supply chain attack. (docs.velociraptor.app)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

137

5

Continuous Intrusion/Continuous Distribution: Tracking Fox’s Iterative Malspam Campaign (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

138

6

Unmasking the CoGUI Phishing Kit, the Major Chinese Phishing-as-a-Service Targeting Japan (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

139

4

Following the Trace: Reconstructing Attacks from Ext4 and XFS Journals (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

140

4

Infrastructure-less Adversary: C2 Laundering via Dead-Drop Resolvers and the Microsoft Graph API (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

141

6

Ghost in Your Network: How Earth Kurma Stays Hidden and Exfiltrates Your Data (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

142

3

Continuous Evolution of Tianwu’s Pangolin8RAT and Custom Cobalt Strike Beacon (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

143

5

Unraveling the WSUS Exploit Chain Incident Analysis and Actor Insights (jsac.jpcert.or.jp)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

144

3

GatewayToHeaven: Finding a Cross-Tenant Vulnerability in GCP's Apigee (omeramiad.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

145

6

Yara: "Detects payload bytes in first 0x490 bytes in clipc.dll Warbird technique as described by Rapid7 (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

146

5

Abusing Microsoft Warbird for Shellcode Execution - from 2024 but recently utilised in the Notepad++ payloads (cirosec.de)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

147

3

YARA Rule Skill [CRT] - An LLM Agent Skill that embeds expert YARA knowledge into your AI assistant. (yarahq.github.io)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

148

2

Cobaltstrike_BOFLoader: open source port/reimplementation of the Cobalt Strike BOF Loader as is (github.com)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

149

10

How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS (clearbluejar.github.io)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink

150

6

APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign) (blog.synapticsystems.de)

submitted 1 week ago by digicat to c/blueteamsec

0 comments fedilink