Community icon

blueteamsec

!blueteamsec@infosec.pub

Hot
New Old Active
Hot
New Old Active
Posts Comments
List Tile Wide tile

CTO at NCSC Summary: week ending August 30th

by
0
4

Daily BlueTeamSec Briefing Archive - daily AI generated podcast of the last 24hours of posts

by
0
0

Peeling the Sentinel: A Market-Leading EDR Comes Apart With Undergraduate Tools

by
0
4

CVE-2026-9586: Sangoma Switchvox RCE

by
0
4

From Patch to Exploit; Using Claude Code to reverse engineer a zero-day in Papercut NG

by
0
3

Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing

by
0
2

How to get a free .arpa domain

by
1
13

APT-C-56（透明部落）近期攻击活动分析 -Analysis of Recent Attack Activities by APT-C-56 (Transparent Tribe)

by
0
3

pstrings: pstrings - Parallel strings extractor for very large files

by
0
8

Password spraying campaign targets AWS root user accounts across 150+ organizations

by
0
6

Incident response guide for AWS CloudTrail investigations – Part 2

by
0
1

Incident response guide for AWS CloudTrail investigations – Part 1

by
0
1

Daisy-Chaining Trust: Investigating Faronics Deploy Abuse

by
0
3
1

Kim Sooki again? This time, disguised as a seafood purchase request.

by
0
4

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

by
0
4

Windows 365 - Placing a Cloud PC Under Review

by
0
2

New Entra role - Entra SOC Identity Responder

by
0
2

Linux Detection Engineering - Fileless Execution

by
0
3

UK Cybercrime Journal: ExfilSquad Emerges

by
0
3

New backdoors from Toy Ghouls

by
0
3

Malicious code executed on clone between 2026-08-29 and 2026-09-02

by
0
3

CouchPotato: another PrivEsc potato - Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege.

by
0
3

Simulating legitimate Active Directory services on the network: the case of GPO exploitation

by
0
3

mythic_ornn: LLM-driven generator for Mythic Agents, Payload-Type and C2 Profiles.

by
0
3

How Forza Horizon 6 Breaks Your IDA

by
0
3

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Security Blog

by
0
3

Modern Adventures in Azure Privilege Escalation

by
0
3

Getting Agents to tell on themselves

by
0
3

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist - The Citizen Lab

by
0
8
1

Malicious Packages Served from Unauthorized Registry Server

by
0
4

Russian National Indicted For Exploiting Online Platform Used For Freelance Employment And Distributing Malware To Thousands Of Victim Users Worldwide For Financial Gain

by
0
3

Communicating under pressure: Best practices for service providers

by
0
2
1

Amir Yaryab – Rewards For Justice - a senior official in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Yaryab leads the IRGC-CEC’s Cyber Operations Command.

by
0
2

Node.js: Old Technique Makes a Comeback

by
0
2

Communicating under pressure: Best practices for service providers

by
0
1
1

Prince of Persia: Detecting the Next C2

by
0
1

Sality Malware Disrupted in International Cyber Takedown

by
0
2

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

by
0
1

ephemora-cell: Ephemora Cell — The execution layer for untrusted AI-generated code. Fast, capability-based WASM execution with explicit CPU, memory, time, I/O, and filesystem limits.

by
0
0

FalconFlank: Crowdstrike Falcon 0day Privilege Escalation Vulnerability

by
0
5

Persistent Engagement and the Illusion of Cyber Equilibrium

by
1
2
1

SuperProxy: How Residential Proxy Networks Have Become Malware Delivery Platforms

by
0
4

FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs

by
0
2

Update on Security at METR

by
0
2
1

Daisy-Chaining Trust: Investigating Faronics Deploy Abuse

by
0
1
1

Financially Motivated Threat Actor BREEZE COMET Targets Brazil

by
0
1

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

by
0
1

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

by
0
1

Malicious Packages Served from Unauthorized Registry Server - An unidentified malicious actor gained access to Coder’s Cloudflare infrastructure and added unauthorized IP addresses to the pool

by
1
2

The August 2026 Virtualizor Incident in BGPHorizon

by
0
2

Mirage Kitten switches to Node.js and JavaScript malware

by
0
2

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

by
0
-5

I Think the Military Commissary Freezers Were Hacked - 'the Pentagon now acknowledging a “possible refrigeration disruption” at numerous DeCA commissaries.'

by
2
9

OEMpocalypse Now: A Generic Exploitation Strategy from Android untrusted app to root

by
1
7

Good news about the Pixel 11. It still has at least bare minimum support for MTE at a hardware level - but disabled in Android firmware

by
0
4

Enclave: We Raced Seven AI Models to RCE

by
0
0

Qualcomm BootROM code signing bypass CVE-2026-25262 - needs hardware replacements

by
0
3

vhf-morse-transmitter-monitor: Set radio to 148.500 MHz, selct FM, USB, or CW, set squelch to 0 or 1. xtend your radio's antenna toward monitor's HDMI - now transmit in Morse code from your monitor!

by
0
2

ValleyRAT is spreading disguised as adware

by
0
10

Everything I own, owned

by
0
10
2

Out-of-tree Linux driver stack and boot tooling for the Cavium CN6640-SNIC10E (Octeon II, PCI 177d:0092), exposing as two independent 10 GbE interfaces (oct0/oct1) over a BAR2 shared-memory datapath

by
0
1

Improving our alignment and security practices - 'By default, all cyber evaluations should run inside a hardened sandbox (an isolated computing environment) with no internet access'

by
0
0

Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader

by
0
1

JavaScript obfuscation: From party trick to phishing kit

by
0
1

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure

by
0
1

Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies

by
0
4

Caught in 4K: The Aurora Files

by
0
3

Virtualizor Compromised (31st AUG): Virtualizor has been compromised, their BGP hijack a few days ago seems to have a deployed a malicious package.

by
0
3

lych: A monolithic ARM64 operating system written in Rust.

by
0
7

wyze-bulb-color-pwned: No-open firmware exploit for the Wyze WLPA19CV2 color bulb - or how to implant a lightbulb

by
0
5

How the Russians Got Inside My Phone

by
1
2

pqc-embedded: Post-quantum signature verification on constrained parts: LMS/HSS in no_std Rust, measured flash/RAM/time budgets against ML-DSA, SLH-DSA, ECDSA and Ed25519

by
0
3

Introduction - Windows Kernel Segment Heap Notes

by
0
3

Gryxa: The AI-Built Toolkit That Watches How You Remove It

by
0
4

Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source…

by
0
4

GreenSection: Nvidia GreenSection Memory Corruption 0day vulnerability

by
0
4

Mini Shai-Hulud Strikes Again: openapi-react-query-codegen

by
0
3

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution - "Approximately 97% of AI-enabled malware samples exist only in research repositories, sandbox environments and secu

by
0
2

DFIR-LABS: DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: DFIR, Malware Analysis and Threat Hunting.

by
0
2

Magneto CVE-2026-71362 — Root-cause walkthrough

by
0
2

CVE-2026-63077: TeamCity Pre-Auth RCE Explained

by
0
2

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

by
0
2

UAT-10147 Uses AI-Assisted Workflows to Deploy SPECTRE Backdoor

by
0
2

PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

by
0
2

Detect DLL search order hijacking with a single field

by
0
2

recently identified a domain (passkeyconnect[.]com) that is likely associated with Com-affiliated threat actors

by
0
2

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

by
0
2

The Video That Plays You: Fake MP4 File Carries Malicious Payload

by
0
2

ClickFix / ClearFake PowerShell Stager — Static Analysis Report

by
0
2

VRIG - Fuzzillai - goal of the project was to learn more about JavaScript engine fuzzing, V8 compiler internals, and the applications of AI systems to fuzzers like Fuzzilli.

by
0
2

PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability

by
0
2

JFrog Security Advisories: CVE-2026-82329 - Potential authentication bypass leading to administrative access in Artifactory -

by
0
2

visa-vulnerability-agentic-harness: Visa Vulnerability Agentic Harness

by
0
2

ClickExfil: My iteration on ClickFix and FileFix

by
0
2

The Hugging Face incident and the road ahead

by
14
1
4

logtotal-sanitizer: Framework-agnostic log sanitizer for browsers and Node.js. Redacts secrets and infrastructure identifiers with stable HMAC tokens so event correlation still works.

by
0
2

חשיפה: ההאקר מאשקלון - עובד IT ומומחה סייבר - he was charged with violations of the Computer Law, wiretapping and invasion of privacy. As far as is known so far, the suspected hacker – who, at the sam

by
0
1

vol-rs: Volatility 3 ported to Rust. Same output, much faster.

by
1
2

Questions about Collective action on cybersecurity

by
0
2

Incident Timeline // TeamPCP Supply Chain Campaign

by
0
3

iwa-tools — Offensive AD tradecraft in a browser tab

by
0
3

Android Intrusion Logs - A First Look

by
0
7