blueteamsec

550 readers
9 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
26
4
Kimsuky’s Ongoing Evolution of KimJongRAT and Expanding Threats (www.enki.co.kr)
submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
27
12
NSO seeks to overturn WhatsApp case, saying it is ‘catastrophic’ for the spyware maker (therecord.media)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
28
3
North Korean APT duo join forces: Kimsuky acts as the "eyes" to steal intelligence, while Lazarus steals cryptocurrency to fill the "money bag"! (mp.weixin.qq.com)
submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
29
4
Misaligned Opcode Exception Waterfall (MOEW) A Technical Analysis of Exception-Driven SEH Manipulation, Telemetry Evasion, and Kernel-Mediated User-Mode Code Execution (github.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
30
5
Unhooking ntdll.dll in Rust: A Beginner-Friendly Guide to Bypassing EDR Hooks (medium.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
31
2
GoDefender: Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY. (github.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
32
4
Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (www.validin.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
33
3
Native Sysmon functionality coming to Windows (techcommunity.microsoft.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
34
3
IACR News item: 21 November 2025 - Unfortunately, one of the three trustees has irretrievably lost their private key, and therefore cannot compute their decryption share (www.iacr.org)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
35
3
Sliver C2 Insecure Default Network Policy (CVE-2025-27093) (hngnh.com)
submitted 5 days ago* (last edited 5 days ago) by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
36
3
Enhancing visibility into your identity fabric with Microsoft Defender - Account correlation links related accounts and corresponding insights to provide identity-level visibility (techcommunity.microsoft.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
37
3
Active Directory Security: Trusts Stuck on Windows 2000 Attributes (www.tenable.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
38
3
Creating a YARA Repository (brkalbyrk.github.io)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
39
3
Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets (dti.domaintools.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
40
1
magnet: Purple-team telemetry & simulation toolkit. (github.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
41
1
CustomC2ChannelTemplate: template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. (github.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
42
1
Systematically Deconstructing APVD Steganography and its Payload with a Unified Deep Learning Paradigm - ""our model achieves a detection accuracy of 96.2 percent." (arxiv.org)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
43
1
疑似APT-C-26（Lazarus）组织利用远程IT伪装部署监控程序的攻击行动分析 - Analysis of attack activities suspected to be deployed by the APT-C-26 (Lazarus) group using remote IT spoofing to deploy surveillance programs (mp.weixin.qq.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
44
1
MuddyWater组织近期钓鱼攻击活动分析 - Analysis of MuddyWater's Recent Phishing Attacks (mp.weixin.qq.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
45
4
Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router (securityscorecard.com)
submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
46
1
The Guardians of Name Street: Studying the Defensive Registration Practices of the Fortune 500 (fabianmonrose.github.io)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
47
1
Understanding Orphan Flows: This work presents the first large-scale analysis of orphan flows to understand 1) the practical hurdles to measuring orphan flows, and 2) the potential utility for SOCs (angelosk.github.io)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
48
1
From Concealment to Exposure: Understanding the Lifecycle and Infrastructure of APT Domains (tillsongalloway.com)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
49
1
Towards understanding the lifecycle of malicious network infrastructure (repository.gatech.edu)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
50
1
ForgeDAN: An Evolutionary Framework for Jailbreaking Aligned Large Language Models (arxiv.org)
submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›