blueteamsec

550 readers

24 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

digicat@infosec.pub

26

5

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads (www.acronis.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

27

4

Russian-Linked StealC V2 Campaign Targeting Blender Users via Malicious .blend Files (www.morphisec.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

28

3

The Hidden Dangers of Calendar Subscriptions: 4 Million Devices at Risk (www.bitsight.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

29

2

Native Secure Enclaved backed ssh keys on MacOS (gist.github.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

30

2

Discreet Driver Loading in Windows (whiteknightlabs.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

31

2

Dissenting Statement of Commissioner Anna M. Gomez - Protecting the Nation’s Communications Systems from Cybersecurity Threats (docs.fcc.gov)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

32

4

WhatsApp compromise leads to Astaroth deployment (news.sophos.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

33

0

Critical strike: China's hacking training grounds (PART 1) (substack.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

34

3

santamon: Lightweight macOS detection agent built on Santa’s Endpoint Security telemetry. (github.com)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

35

12

NSO seeks to overturn WhatsApp case, saying it is ‘catastrophic’ for the spyware maker (therecord.media)

submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

36

1

ToddyCat APT's new tools and techniques (securelist.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

37

4

Kimsuky’s Ongoing Evolution of KimJongRAT and Expanding Threats (www.enki.co.kr)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

38

3

The threat actors behind Shai Hulud has struck again, hitting Zapier and Ensdomains (www.aikido.dev)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

39

3

Shai-Hulud 2.0: Ongoing Supply Chain Attack (www.wiz.io)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

40

1

Processing CloudTrail Logs from S3 (deceptiq.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

41

3

North Korean APT duo join forces: Kimsuky acts as the "eyes" to steal intelligence, while Lazarus steals cryptocurrency to fill the "money bag"! (mp.weixin.qq.com)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

42

4

Misaligned Opcode Exception Waterfall (MOEW) A Technical Analysis of Exception-Driven SEH Manipulation, Telemetry Evasion, and Kernel-Mediated User-Mode Code Execution (github.com)

submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

1 comments fedilink

43

5

Unhooking ntdll.dll in Rust: A Beginner-Friendly Guide to Bypassing EDR Hooks (medium.com)

submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

44

2

GoDefender: Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY. (github.com)

submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

45

4

Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (www.validin.com)

submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

46

3

Native Sysmon functionality coming to Windows (techcommunity.microsoft.com)

submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

1 comments fedilink

47

3

IACR News item: 21 November 2025 - Unfortunately, one of the three trustees has irretrievably lost their private key, and therefore cannot compute their decryption share (www.iacr.org)

submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

48

3

Sliver C2 Insecure Default Network Policy (CVE-2025-27093) (hngnh.com)

submitted 6 days ago* (last edited 6 days ago) by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

49

3

Enhancing visibility into your identity fabric with Microsoft Defender - Account correlation links related accounts and corresponding insights to provide identity-level visibility (techcommunity.microsoft.com)

submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

50

3

Active Directory Security: Trusts Stuck on Windows 2000 Attributes (www.tenable.com)

submitted 6 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink