blueteamsec

549 readers

9 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

digicat@infosec.pub

1

2

CTO at NCSC Summary: week ending November 23rd (ctoatncsc.substack.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

2

5

Department 40 Exposed: Inside the IRGC Unit Connecting Cyber Ops to Assassinations (blog.narimangharib.com)

submitted 5 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

3

5

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads (www.acronis.com)

submitted 5 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

4

4

Russian-Linked StealC V2 Campaign Targeting Blender Users via Malicious .blend Files (www.morphisec.com)

submitted 5 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

5

3

The Hidden Dangers of Calendar Subscriptions: 4 Million Devices at Risk (www.bitsight.com)

submitted 5 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

6

2

Native Secure Enclaved backed ssh keys on MacOS (gist.github.com)

submitted 6 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

7

2

Discreet Driver Loading in Windows (whiteknightlabs.com)

submitted 8 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

8

2

Dissenting Statement of Commissioner Anna M. Gomez - Protecting the Nation’s Communications Systems from Cybersecurity Threats (docs.fcc.gov)

submitted 9 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

9

1

ToddyCat APT's new tools and techniques (securelist.com)

submitted 14 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

10

1

Processing CloudTrail Logs from S3 (deceptiq.com)

submitted 17 hours ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

11

4

WhatsApp compromise leads to Astaroth deployment (news.sophos.com)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

12

3

santamon: Lightweight macOS detection agent built on Santa’s Endpoint Security telemetry. (github.com)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

13

3

The threat actors behind Shai Hulud has struck again, hitting Zapier and Ensdomains (www.aikido.dev)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

14

3

Shai-Hulud 2.0: Ongoing Supply Chain Attack (www.wiz.io)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

15

4

Kimsuky’s Ongoing Evolution of KimJongRAT and Expanding Threats (www.enki.co.kr)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

16

3

North Korean APT duo join forces: Kimsuky acts as the "eyes" to steal intelligence, while Lazarus steals cryptocurrency to fill the "money bag"! (mp.weixin.qq.com)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

17

12

NSO seeks to overturn WhatsApp case, saying it is ‘catastrophic’ for the spyware maker (therecord.media)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

18

2

GoDefender: Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY. (github.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

19

4

Misaligned Opcode Exception Waterfall (MOEW) A Technical Analysis of Exception-Driven SEH Manipulation, Telemetry Evasion, and Kernel-Mediated User-Mode Code Execution (github.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

1 comments fedilink

20

5

Unhooking ntdll.dll in Rust: A Beginner-Friendly Guide to Bypassing EDR Hooks (medium.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

21

1

magnet: Purple-team telemetry & simulation toolkit. (github.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

22

4

Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (www.validin.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

23

3

Native Sysmon functionality coming to Windows (techcommunity.microsoft.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

1 comments fedilink

24

3

IACR News item: 21 November 2025 - Unfortunately, one of the three trustees has irretrievably lost their private key, and therefore cannot compute their decryption share (www.iacr.org)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

25

1

CustomC2ChannelTemplate: template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. (github.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink