blueteamsec

447 readers

11 users here now

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

founded 2 years ago

MODERATORS

digicat@infosec.pub

26

2

LLMDYara: LLMs-Driven Automated YARA Rules Generation with Explainable File Features and DNAHash (i.blackhat.com)

submitted 1 day ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

27

3

Turning Camera Surveillance on its Axis (claroty.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

28

5

Go Get 'Em: Updates to Volexity Golang Tooling (www.volexity.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

29

2

Shedding Light on PoisonSeed’s Phishing Kit (blog.nviso.eu)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

30

2

NTDS.dit Dumping with Shadow Snapshot Method via WMI (No Code Execution) (github.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

31

2

Certify 2.0 - AD CS attack tooling (specterops.io)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

32

1

Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds (www.bitdefender.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

33

1

Ransomware Landscape in H1 2025: Statistics and Key Issues (medium.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

34

1

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises (www.trendmicro.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

35

3

Heracles Attack - Chosen Plaintext Attack on AMD SEV-SNP (to appear at ACM CCS 2025) (heracles-attack.github.io)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

36

6

APT Down: The North Korea Files (drive.proton.me)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

37

5

RPC-Racer: Toolset to manipulate RPC clients by finding delayed services and masquerading as them (github.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

38

1

Extraction of Synology encrypted archives (www.synacktiv.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

39

1

针对Web3&Cryptocurrency领域GitHub项目定向钓鱼检测技术方案 - Targeted Phishing Detection Technology for GitHub Projects in the Web3 & Cryptocurrency Field (mp.weixin.qq.com)

submitted 2 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

40

2

Sanctum: Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust. (github.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

41

4

Yara-X v1.5: Implement the crx module for parsing Chrome Extension files (github.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

42

2

Justice Department Announces Coordinated Disruption Actions Against BlackSuit (Royal) Ransomware Operations (www.justice.gov)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

43

2

Shade BIOS: Unleashing the Full Stealth of UEFI Malware - proof of concept (github.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

Slides - https://blackhat.com/us-25/briefings/schedule/#shade-bios-unleashing-the-full-stealth-of-uefi-malware-45786

44

9

Breaking Into Your Network? Zer0 Effort. - DEF CON 33 Overview - research campaign investigating the security of Zero Trust Network Access solutions (blog.amberwolf.com)

submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

1 comments fedilink

45

2

Citrix kwetsbaarheid (Update 11-08-2025) - "forensic analyses of data from the affected organizations, the NCSC has indications that the vulnerabilities in Citrix NetScaler ADC exploited in May" (www-ncsc-nl.translate.goog)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

46

2

Remote-DLL-Injection-with-Timer-based-Shellcode-Execution: Remote DLL Injection with Timer-based Shellcode Execution (github.com)

submitted 3 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

47

5

finch: Fingerprint-aware TLS reverse proxy. Use Finch to outsmart bad traffic—collect client fingerprints (JA3, JA4 +QUIC, JA4H, HTTP/2) and act on them (github.com)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

48

8

awswaf: AWS WAF Solver, full reverse implemented in 100% Python & Golang. (github.com)

submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink

49

7

Custom firmware for sale for Flipper zero - "1995.- USD - support for Peugeot/Citroen/Volkswagen and new Ford models" (www.ifoedit.com)

submitted 5 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

2 comments fedilink

50

3

Efimer Trojan delivered via email and hacked WordPress websites (securelist.com)

submitted 4 days ago by digicat@infosec.pub to c/blueteamsec@infosec.pub

0 comments fedilink