News · r/blueteamsec
-
r/blueteamsec
Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies
r/blueteamsec · justice.gov
-
r/blueteamsec
Ukraine struck Yandex: tracing the Russian internet that resurfaced after a 54% drop
r/blueteamsec · infrawatch.com
-
r/blueteamsec
Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération - Security incident targeting remote controllers of refrigeration systems
r/blueteamsec · cert.cyber.gouv.fr
-
r/blueteamsec
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey
r/blueteamsec · dl.acm.org
-
r/blueteamsec
BinarySoap: A python proof of concept tool to assist in your payloads classification against EDR/AV's machine learning models
r/blueteamsec · github.com
-
r/blueteamsec
Sentinel: Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.
r/blueteamsec · github.com
-
r/blueteamsec
NTDLL-reconstruction: A technique that mixes NTDLL unhooking and hellsgate gate variants
r/blueteamsec · github.com
-
r/blueteamsec
InjectEave: an attack that intercepts analog audio signals
r/blueteamsec · kaspersky.com
-
r/blueteamsec
Ivanti Connect Secure (CVE-2026-104935)
r/blueteamsec · hub.ivanti.com
CVE-2026-104935 -
r/blueteamsec
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
r/blueteamsec · asec.ahnlab.com
-
r/blueteamsec
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
r/blueteamsec · crowdstrike.com
-
r/blueteamsec
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
r/blueteamsec · volexity.com
-
r/blueteamsec
Apex Accelerator: Malicious npm packages target Web3 startups
r/blueteamsec · elastic.co
-
r/blueteamsec
Hayabusa-Bulk-Runner: run Hayabusa across a whole folder of per-host KAPE collections and get one cross-host triage view
Built this in my free time and figured this crowd might get some use out of it, or at least tell me what I've got wrong. Hayabusa, by Yamato Security, is excellent on a single host. You point it at a directory of event logs and get fast Sigma-based detections with an HTML summary. The snag for me is what an engagement actually looks like: a folder of KAPE collections, one per host, some loose and…
-
r/blueteamsec
AI models may be capable of self-replicating without access to a datacenter
r/blueteamsec · anthropic.com
-
r/blueteamsec
Rewards for Justice (RFJ) is offering a reward of up to $10 million for info on Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology Company, Ltd
r/blueteamsec · rewardsforjustice.net
-
r/blueteamsec
F.B.I. Arrests Key Suspect in ShinyHunters Hack of Its Own Agents’ Data
r/blueteamsec · nytimes.com
-
r/blueteamsec
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
r/blueteamsec · asec.ahnlab.com
-
r/blueteamsec
French supermarket chains say cyberattack forced refrigerator shutdown
r/blueteamsec · france24.com
-
r/blueteamsec
Observed fake Claude Code ad / DLL sideloading chain with blockchain C2 (EtherHiding) - IOCs included
We came across a malware sample pushed through a paid search/ad impersonating Claude Code. I reversed it over the past day. Putting the detection content first so if you're not interested in the analysis. Quick summary: a renamed, legitimately signed JetBrains binary sideloads a malicious libcef.dll, the real payload is a .NET exe hidden inside icudtl.dat, it pulls its C2 from a smart contract on…
-
r/blueteamsec
Foreigner arrested in Sihanoukville for deploying fake cell tower to beam scam SMS
r/blueteamsec · khmertimeskh.com
-
r/blueteamsec
Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway
r/blueteamsec · community.citrix.com
CVE-2026-107406 -
r/blueteamsec
Research Shows More Than 8,500 Exposed Systems in Europe’s Wind and Solar Parks
r/blueteamsec · modat.io
-
r/blueteamsec
New speed, same tricks: Defend against AI threats with security fundamentals
r/blueteamsec · okta.com
-
r/blueteamsec
Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War
r/blueteamsec · genians.co.kr
-
r/blueteamsec
eBPF vs fanotify for pre-encryption ransomware detection on Linux — what's actually running in prod?
Curious what people are actually running in production for Linux endpoint ransomware detection, specifically the pre-encryption window. The main options and their annoyances: eBPF (kprobes/tracepoints on vfs_write / security_file_open): great context (pid, path, bytes) and low overhead, but you're reacting after the write, and you pay the verifier + kernel portability tax (CO-RE helps, old kernel…
-
r/blueteamsec
Friend of suspected FBI data thief says he warned 'crazy' teen not to hack bureau
r/blueteamsec · reuters.com
-
r/blueteamsec
Coding Conflict: Bias and Visibility in Cyber-Incident Data Construction
r/blueteamsec · academic.oup.com
-
r/blueteamsec
Zircolite 4.5: Sigma rules over EVTX, Auditd, Sysmon for Linux and JSON logs, with a very fast offline browser viewer
r/blueteamsec · github.com
-
r/blueteamsec
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain
r/blueteamsec · morphisec.com
-
r/blueteamsec
jev-ids: Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.
r/blueteamsec · github.com
-
r/blueteamsec
The Rejection Rate of ML-DSA Signing: Correcting FIPS-204
r/blueteamsec · amongbytes.com
-
r/blueteamsec
Black Hat USA 2026 NOC: Cleartext, Leaky Apps, AI Mistakes
r/blueteamsec · corelight.com
-
r/blueteamsec
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
r/blueteamsec · gendigital.com
-
r/blueteamsec
Telegram Desktop: one-click account takeover via IPC injection
r/blueteamsec · beaksec.github.io
-
r/blueteamsec
vmp-lazy-unpack: An emulation-based unpacker and import resolver for Windows x64 VMProtect 3.x binaries.
r/blueteamsec · github.com
-
r/blueteamsec
How AI Agents Turned One Exposed Endpoint into a Server Takeover
r/blueteamsec · reliaquest.com
-
r/blueteamsec
Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
r/blueteamsec · blog.virustotal.com
-
r/blueteamsec
InjectSetConsole: Proof of Concept for Process Code Injection Without Using WriteProcessMemory
r/blueteamsec · github.com
