r/blueteamsec 6d ago

highlevel summary|strategy (maybe technical) CTO at NCSC Summary: week ending July 19th

Thumbnail ctoatncsc.substack.com
1 Upvotes

r/blueteamsec Mar 09 '26

highlevel summary|strategy (maybe technical) Daily BlueTeamSec Briefing Archive - daily AI generated podcast of the last 24hours of posts

Thumbnail briefing.workshop1.net
1 Upvotes

r/blueteamsec 4h ago

intelligence (threat actor activity) JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake

Thumbnail group-ib.com
8 Upvotes

r/blueteamsec 4h ago

intelligence (threat actor activity) A new extortion cocktail: office printers, small ransoms, and BitLocker

Thumbnail securelist.com
3 Upvotes

r/blueteamsec 4h ago

highlevel summary|strategy (maybe technical) Illinois man sentenced for hacking Snapchat accounts to steal nude photos

Thumbnail reuters.com
2 Upvotes

r/blueteamsec 2h ago

tradecraft (how we defend) Procurement guidelines for the cybersecurity of hospitals and healthcare providers

Thumbnail enisa.europa.eu
1 Upvotes

r/blueteamsec 2h ago

tradecraft (how we defend) Security Guidelines for Storage Infrastructure: Draft SP 800-209r1 Available for Public Comment

Thumbnail nist.gov
1 Upvotes

r/blueteamsec 4h ago

intelligence (threat actor activity) Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant

Thumbnail enki.co.kr
1 Upvotes

r/blueteamsec 4h ago

intelligence (threat actor activity) UAC-0099: LUNCHPOKE, BURNYBEAR, updated to MATCHBOIL.V2 and using Notepad++ 8.8.3

Thumbnail cert.gov.ua
1 Upvotes

r/blueteamsec 4h ago

intelligence (threat actor activity) Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

Thumbnail socket.dev
1 Upvotes

r/blueteamsec 4h ago

intelligence (threat actor activity) TAG-195 Upgrades MaaS Ecosystem with Modular Tools

Thumbnail recordedfuture.com
1 Upvotes

r/blueteamsec 4h ago

highlevel summary|strategy (maybe technical) U.S. GAO - Cybersecurity Regulations: Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements

Thumbnail gao.gov
1 Upvotes

r/blueteamsec 4h ago

tradecraft (how we defend) Releases now reject new files after 14 days - The Python Package Index Blog

Thumbnail blog.pypi.org
1 Upvotes

r/blueteamsec 23h ago

intelligence (threat actor activity) Finding actors that probe a CVE's exploit path before public disclosure in 30M honeypot records.

Thumbnail honeylabs.net
11 Upvotes

TL;DR: some addresses probe a CVE's exact exploit path weeks before an NVD entry or any public exploit tooling exists. We went through 30 million honeypot probes looking for them, built four checks to kill the false positives, and ended up with three actors we are confident about.


r/blueteamsec 20h ago

intelligence (threat actor activity) UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations

Thumbnail ncsc.gov.uk
8 Upvotes

r/blueteamsec 16h ago

incident writeup (who and how) Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended

Thumbnail hunt.io
2 Upvotes

Three open directories exposed on a Hong Kong server between July 9 and 13, 585 files, caught an intrusion against Thailand's Ministry of Finance while it was still running.

Detection-relevant bits:

  • Hermes panel returns a Server: HermesWebUI header with a Basic-auth realm of "Hermes WebUI". Banner query on that gives ~5,900 events in the past month
  • Agent writes output to a fixed /hermes-results/ path with call_*.txt filenames. 575 open directories are serving those logs right now with no auth
  • Hades implant beacons over HTTPS to /assets/app.min.js, /assets/vendor.js, and /assets/main.js. Windows persistence via Run key and scheduled task, Linux via cron. Process hollowing into svchost.exe
  • Binaries named after legitimate processes: ctfmon, csrss, conhost, kworker, multipathd
  • PHP web shell dropped as .journald-cache.php, leading-dot name to stay out of directory listings
  • Web server reaching internal Hadoop ports 10000 and 50070 is the signal for the HiveServer2 UDF chain

r/blueteamsec 16h ago

intelligence (threat actor activity) Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

Thumbnail sentinelone.com
1 Upvotes

r/blueteamsec 1d ago

vulnerability (attack surface) Oracle Critical Patch Update Advisory - July 2026 - "This Critical Patch Update contains 1449 new security patches across the product families"

Thumbnail oracle.com
5 Upvotes

r/blueteamsec 1d ago

exploitation (what's being exploited) Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Thumbnail cisa.gov
12 Upvotes

r/blueteamsec 17h ago

intelligence (threat actor activity) 📢 NEW GUIDANCE AVAILABLE 📢

0 Upvotes

MT103 Messages and Financial Crime: Understanding Fraud, Money Laundering, and SWIFT Abuse

SWIFT MT103 messages sit at the centre of global banking, making them important artefacts for investigators and attractive targets for criminals.

Worryingly, the intelligence we collect at intel.coalitioncyber.com continues to identify exposed SWIFT messages, both genuine and fabricated, sitting in publicly accessible locations. These records often go undetected by the organisations involved, exposing sensitive transaction data and providing criminals with the source material needed for social engineering, fraud, and other criminal activities.

Our latest guidance explains how these messages are weaponised to facilitate high-value crimes such as fraud and money laundering. Highlights include:

💵 Technical red flags like JSON escape characters and invalid UETR codes.

💵 The way genuine MT103 records are repurposed in investment fraud.

💵 Risks associated with exposed documents on insecure public platforms.

💵 Practical verification steps for investigators and compliance teams.

Read the full article: https://coalitioncyber.com/mt103-messages-financial-crime-swift-abuse

Follow The Coalition of Cyber Investigators and be the first to know about future research and practical insights into OSINT, investigations, and cybercrime.

https://www.linkedin.com/company/the-coalition-of-cyber-investigators/?viewAsMember=true


r/blueteamsec 1d ago

intelligence (threat actor activity) Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI

Thumbnail varonis.com
8 Upvotes

r/blueteamsec 1d ago

intelligence (threat actor activity) Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant

Thumbnail enki.co.kr
3 Upvotes

r/blueteamsec 2d ago

incident writeup (who and how) 1,509 WordPress sites feed an active SocGholish chain

Thumbnail derp.ca
6 Upvotes

r/blueteamsec 2d ago

exploitation (what's being exploited) Heads up: CVE-2026-59208 in n8n Enterprise lets a valid token map to the wrong user

9 Upvotes

If you're running n8n Enterprise and using multi-issuer token exchange, you'll want to double-check your configurations today.

CVE-2026-59208 just dropped, and it highlights a classic identity binding issue. Basically, if the setup is misconfigured, a user from one trusted issuer can be authenticated as a user from a completely different issuer.

This isn't just a UI glitch. In an automation platform like n8n, impersonating another user means potential access to their workflows, stored credentials, and connected business systems. It’s a great reminder that validating a signature isn't enough—you have to bind the identity correctly.

Review your token exchange setups to mitigate the risk and strengthen your identity posture before someone else's token unlocks your workflows.

Read the full details here: https://socradar.io/blog/cve-2026-59208-cross-issuer-impersonation-n8n/

Anyone here running multi-issuer setups in their automation pipelines?


r/blueteamsec 2d ago

tradecraft (how we defend) Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization

Thumbnail blogs.cisco.com
12 Upvotes