blueteamsec

557 readers
16 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago
MODERATORS
digicat@infosec.pub
listing: all - local
926
2
Ransomware Damage Recovery｜National Police Agency - Phobos/8Base Decryption Tool (www.npa.go.jp)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
927
4
Security incident post-mortem - "resulted in $14 million in unauthorized withdrawals from 9 user accounts.this attack was perpetrated by UNC4899, a North Korean state-sponsored actor" (woox.io)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
928
2
Operation HanKook Phantom: APT37 Spear-Phishing Campaign (www.seqrite.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
929
3
Founding: Founding is a generator that will create a loader encrypted or obfuscated with different execution types (github.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
930
11
Copilot Broke Your Audit Log, but Microsoft Won’t Tell You (pistachioapp.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
931
2
Using Auth0 Logs for Proactive Threat Detection (sec.okta.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
932
3
Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis (www.gdatasoftware.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
933
8
Canary tokens: Learn all about the unsung heroes of security at Grafana Labs (grafana.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
934
4
Uncovering Compromised Hosts using SSH Public Keys (www.usenix.org)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
935
3
Advisory - Netskope Client for Windows - Local Privilege Escalation via Rogue Server (CVE-2025-0309) (blog.amberwolf.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
936
7
Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 (doublepulsar.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
937
3
CTO at NCSC Summary: week ending August 31st (ctoatncsc.substack.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
938
0
PoolFlip: A Multi-Agent Reinforcement Learning Security Environment for Cyber Defense (arxiv.org)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
939
1
Chasing the Silver Fox: Cat & Mouse in Kernel Shadows (research.checkpoint.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
940
2
Methodology for Characterizing Network Behavior of Internet of Things Devices (www.nist.gov)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
941
8
WhatsApp - "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability .. may have been exploited" (www.whatsapp.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
942
5
Iran-Nexus Spear phishing Campaign Masquerades as Omani MFA to Target Global Governments (dreamgroup.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
943
2
Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE) (labs.watchtowr.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
944
3
Amazon disrupts watering hole campaign by Russia’s APT29 | Amazon Web Services (aws.amazon.com)
submitted 3 months ago* (last edited 3 months ago) by digicat@infosec.pub to c/blueteamsec@infosec.pub
1 comments fedilink
945
3
Detecting Velociraptor misuse :: Velociraptor (docs.velociraptor.app)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
946
4
A Nightmare on EDR Street: WDAC's Revenge (beierle.win)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
947
7
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration (www.group-ib.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
948
4
TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents (www.trendmicro.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
949
9
Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide (www.bitdefender.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
950
6
Loophole allows threat actors to claim VS Code extension names (www.reversinglabs.com)
submitted 3 months ago by digicat@infosec.pub to c/blueteamsec@infosec.pub
0 comments fedilink
view more: ‹ prev next ›