Skip Navigation

digicat
digicat @ digicat @infosec.pub
Posts
282
Comments
15
Joined
2 yr. ago

blueteamsec @infosec.pub
digicat @infosec.pub

Subtle Snail (UNC1549, TA455), an Iran-nexus espionage group linked to the Eclipsed Wasp (Charming Kitten) network, has been active since at least November 2022 - IoCs
blueteamsec @infosec.pub
digicat @infosec.pub

WSL-Payloads: A small How-To on creating your own weaponized WSL file
blueteamsec @infosec.pub
digicat @infosec.pub

Detection Engineering: Practicing Detection-as-Code - Validation - Part 3
blueteamsec @infosec.pub
digicat @infosec.pub

Linux-persistence: A no-reboot, in-memory Linux persistence PoC leveraging namespace joining, user-namespace elevation, and self‑deletion.
blueteamsec @infosec.pub
digicat @infosec.pub

The Threat Hunter's Cookbook
blueteamsec @infosec.pub
digicat @infosec.pub

SCENE 1: SoupDealer - Technical Analysis of a Stealth Java Loader Used in Phishing Campaigns Targeting Türkiye
blueteamsec @infosec.pub
digicat @infosec.pub

クルド人グループによる日本の組織を狙ったサイバー攻撃 - Cyber attacks by Kurdish groups targeting Japanese organizations
blueteamsec @infosec.pub
digicat @infosec.pub

Microsoft Releases Guidance on High-Severity Vulnerability (CVE-2025-53786) in Hybrid Exchange Deployments
blueteamsec @infosec.pub
digicat @infosec.pub

BamboozlEDR: A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.
blueteamsec @infosec.pub
digicat @infosec.pub

Hidden Black Hands: How $1.46 Billion Disappeared in Silence - "This incident demonstrates the exceptionally targeted nature of Lazarus's attacks"
blueteamsec @infosec.pub
digicat @infosec.pub

turnt: A tool designed for smuggling interactive command and control traffic through legitimate TURN servers hosted by reputable providers such as Zoom.
blueteamsec @infosec.pub
digicat @infosec.pub

Trust Me, I’m a Legitimate Process: Verisimilitude and the Art of Hiding
blueteamsec @infosec.pub
digicat @infosec.pub

Threat actors: “Please do not use Okta FastPass”
blueteamsec @infosec.pub
digicat @infosec.pub

From The Depths of the Shadows IRGC and Hacker Collectives Of The 12-Day War
blueteamsec @infosec.pub
digicat @infosec.pub

Cyber Assessment Framework v4.0 released in response to growing threat - UK
blueteamsec @infosec.pub
digicat @infosec.pub

ThrottleStop driver abused to terminate AV processes
blueteamsec @infosec.pub
digicat @infosec.pub

UEFI Bootkit Hunting: Deep Search for Unique Code Behaviors - Chinese
blueteamsec @infosec.pub
digicat @infosec.pub

Stored XSS in OpenVPN Dashboard widget
blueteamsec @infosec.pub
digicat @infosec.pub

yaraast: A powerful Python library and CLI tool for parsing, analyzing, and manipulating YARA rules through Abstract Syntax Tree (AST) representation
blueteamsec @infosec.pub
digicat @infosec.pub

GRITREP: Observed Malicious Driver Use Associated with Akira SonicWall Campaign

ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One™ (On-Premise) Management Console Command Injection RCE Vulnerabilities

Jump

    • malefic: IoM implant, C2 Framework and Infrastructure - use seen in the wild

    Jump

    • Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities

    Jump

    • Welcome to the new home of what was /r/Blueteamsec and how it works..

    Jump

  • I think this might need to be @jerry

    • Welcome to the new home of what was /r/Blueteamsec and how it works..

    Jump

  • V welcome..

    • LOLRMM is a curated list of Remote Monitoring and Management (RMM) - now with SIEM detections - see comment for important PR for KQL

    Jump

    • Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data."

    Jump

    • Shutting the Door on Vishing-Driven Data Theft in Salesforce - "UNC6040’s phone-phishers lure employees into approving a fake dataloader[.]io app, hijacking Salesforce APIs to siphon customer data."

    Jump

    • Clorox versus Cognizant Complaint - Cognizant’sconduct on August 11, 2023, demonstrated spectacularly that it was failing to do so. Cognizantrepeatedly gave a cybercriminal access to Clorox’s network

    Jump

    • Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition

    Jump

    • LARVA-208 compromised the Steam game Chemia to distribute multiple malware families - Indicators of Compromise

    Jump

    • Welcome to the new home of what was /r/Blueteamsec and how it works..

    Jump

  • Nope, very manual and the plan is to stay here :) - I managed to keep the last community going at this rate for ~8 years.

    • Ability to share links

    Jump

  • Almost need 'Voyager link post'

    • Ability to share links

    Jump

  • I wanted to do browser to Lemmy I get this

    • Chinese hackers have seized control. How did we let this happen?

    Jump