blueteamsec

429 readers

35 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

101

3

obfus.h: Macro-header for compile-time C obfuscation (tcc, win x86/x64) (github.com)

submitted 5 days ago by digicat to c/blueteamsec

1 comments fedilink

102

2

Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal - The campaign leverages malicious advertisements to lure victims to install fake applications which impersonate ~ 50 common apps (research.checkpoint.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

103

2

Auto-Color Backdoor: the threat actor had exploited CVE-2025-31324 - Over the course of three days, a threat actor gained access to the customer’s network, attempted to download suspicious files (www.darktrace.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

104

2

Mistwalker: Create Entra Global Admin accounts from On-Prem (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

105

2

PENGUIN (Personalized EmulatioN Generated Using Instrumented Analysis) takes a target centric approach to rehosting using a precise and tailored specification of the rehosting process (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

106

2

Revisiting UNC3886 Tactics to Defend Against Present Risk - an APT group that has historically targeted including telco, gov tech and defense, with a recent attack against Singapore (www.trendmicro.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

107

2

Consumer Beware! Exploring Data Brokers' CCPA Compliance (arxiv.org)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

108

2

Important Security Update - "statement to inform you of an isolated security incident involving a malware-infected version of our Configuration Tool for the OP1w 4k v2 mouse." (www.endgamegear.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

109

1

Two (or Too Many) Cheers for UN Cyber Diplomacy? (carnegieendowment.org)

submitted 4 days ago by digicat to c/blueteamsec

0 comments fedilink

110

4

Chinese hackers have seized control. How did we let this happen? (www.telegraph.co.uk)

submitted 6 days ago by digicat to c/blueteamsec

5 comments fedilink

111

3

Stack Overflows, Heap Overflows, and Existential Dread (SonicWall SMA100 CVE-2025-40596, CVE-2025-40597 and CVE-2025-40598) (labs.watchtowr.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

112

3

RuleSetRAT: A curated collection of YARA rules and structured JSON reports designed to identify and analyze various malware builder variants, for educational and research purposes only. (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

113

3

Pixels of Deception: How VMDetector Loader Hides in Plain Sight (www.sonicwall.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

114

3

Certiception-ADCS-trap: An ADCS honeypot to catch attackers in your internal network. (github.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

115

3

A curated collection of Living off the Land (LotL) attack demonstrations where trusted binaries go rogue, because if it didn’t launch calc.exe, did it even happen (github.com)

submitted 6 days ago by digicat to c/blueteamsec

0 comments fedilink

116

1

Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition (arxiv.org)

submitted 5 days ago by digicat to c/blueteamsec

1 comments fedilink

117

1

Targeted attacks leverage accounts on popular online platforms as C2 servers - Cobalt Strike Beacon delivered via GitHub and social media (securelist.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

118

1

China’s Covert Capabilities | Silk Spun From Hafnium (www.sentinelone.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

119

1

Lionishackers: Analyzing a corporate database seller (outpost24.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

120

2

Understanding Current CastleLoader Campaigns - "An emerging loader malware using phishing & fake GitHub repos to deploy RATs & stealers. Now targeting enterprise users via fake Zscaler Client & more." (catalyst.prodaft.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

121

2

EXEfromCER: PoC that downloads an executable from a public SSL certificate (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

122

2

WorkloadIdentityInfoXdr: Function to get summarized overview of application and workload identities from IdentityInfo and OAuthAppInfo table with API Permissions, Azure RBAC- and Entra ID roles etc. (github.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

123

2

Root Cause Analysis of the CitrixBleed 2 (CVE-2025–5777) Vulnerability (medium.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

124

2

Detecting the Most Popular MITRE Persistence Method – Registry Run Keys / Startup Folder (www.nextron-systems.com)

submitted 5 days ago by digicat to c/blueteamsec

0 comments fedilink

125

2

Process Injection using Return-Oriented Programming (ieeexplore.ieee.org)

submitted 5 days ago by digicat to c/blueteamsec

1 comments fedilink