r/blueteamsec • u/digicat • 12h ago

highlevel summary|strategy (maybe technical) CTO at NCSC Summary: week ending October 18th

ctoatncsc.substack.com

1 Upvotes

r/blueteamsec • u/digicat • Mar 09 '26

highlevel summary|strategy (maybe technical) Daily BlueTeamSec Briefing Archive - daily AI generated podcast of the last 24hours of posts

briefing.workshop1.net

2 Upvotes

r/blueteamsec • u/digicat • 53m ago

malware analysis (like butterfly collections) KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize

• Upvotes

r/blueteamsec • u/digicat • 54m ago

low level tools|techniques|knowledge (work aids) firmware-reverse-engineering: A full claude, droid and codex skillsets for firmware reverse engineering.

• Upvotes

r/blueteamsec • u/digicat • 1h ago

vulnerability (attack surface) Package managers have an integrity problem

blog.trailofbits.com

• Upvotes

r/blueteamsec • u/digicat • 2h ago

intelligence (threat actor activity) ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

2 Upvotes

r/blueteamsec • u/digicat • 2h ago

incident writeup (who and how) We are continuing our investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick.

connectwise.com

2 Upvotes

r/blueteamsec • u/digicat • 11m ago

highlevel summary|strategy (maybe technical) US District Court denied WhatsApp's motion to hold NSO in contempt for continuing to hack WhatsApp users after a court order barred it from doing so.

storage.courtlistener.com

• Upvotes

r/blueteamsec • u/Cold-Dinosaur • 4h ago

research|capability (we need to defend against) PhantomBuffer: Effective EDR Evasion Through Stealth Injection

zerosalarium.com

2 Upvotes

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response).

Unlike traditional edr bypass techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.

r/blueteamsec • u/digicat • 55m ago

vulnerability (attack surface) OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

• Upvotes

r/blueteamsec • u/digicat • 56m ago

discovery (how we find bad stuff) The eBPF forensics gap and what your EDR cannot see

andreafortuna.org

• Upvotes

r/blueteamsec • u/digicat • 57m ago

intelligence (threat actor activity) TAG-193’s Regional Espionage Operations

recordedfuture.com

• Upvotes

r/blueteamsec • u/digicat • 1h ago

vulnerability (attack surface) Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)

• Upvotes

r/blueteamsec • u/digicat • 1h ago

intelligence (threat actor activity) Poisoned Vector: JADEPUFFER and Using Unauthenticated Chroma Databases for Retrieval Extortion

• Upvotes

r/blueteamsec • u/digicat • 1h ago

vulnerability (attack surface) Frostbitten in France: A Danfoss StoreView Internet Exposure Report

• Upvotes

r/blueteamsec • u/digicat • 1h ago

highlevel summary|strategy (maybe technical) SRE-Bench: A realistic, contamination-free benchmark for agentic reverse engineering.

• Upvotes

r/blueteamsec • u/digicat • 1h ago

intelligence (threat actor activity) skynox7: Proxyjacking Edge Devices Into Residential Proxies

• Upvotes

r/blueteamsec • u/digicat • 1h ago

vulnerability (attack surface) More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE

• Upvotes

r/blueteamsec • u/digicat • 1h ago

incident writeup (who and how) 連続不正アクセス事案の攻撃手法に関する調査 - Investigation into attack methods in serial unauthorized access cases

blogs.jpcert.or.jp

• Upvotes

r/blueteamsec • u/digicat • 1h ago

incident writeup (who and how) Cybersecurity Incident Disrupting Bankruptcy Court Operations

• Upvotes

r/blueteamsec • u/digicat • 1h ago

discovery (how we find bad stuff) Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device

• Upvotes

r/blueteamsec • u/digicat • 1h ago

highlevel summary|strategy (maybe technical) Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools

blog.polyswarm.io

• Upvotes

r/blueteamsec • u/digicat • 1h ago

discovery (how we find bad stuff) ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays

newsletter.securityinbits.com

• Upvotes

r/blueteamsec • u/digicat • 1h ago

vulnerability (attack surface) BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

• Upvotes

r/blueteamsec • u/digicat • 1h ago

intelligence (threat actor activity) Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands

• Upvotes

Subreddit

For [Blue|Purple] Teams in Cyber Defence

r/blueteamsec

We focus on technical intelligence, research and engineering to help operational [blue|purple] teams defend their estates and have awareness of the world. Our primary home is on Lemmy after the great ban debacle of 2025.

Members Active

73.0k

0

Sidebar

A community focusing on technical intelligence, research and engineering in support of operational blue teams and their activities.

Content Guidelines

/r/blueteamsec accepts quality technical posts. Non-technical posts are subject to moderation.

Content should focus on the "how." or "what."
Check the new queue for duplicates.
Always link to the original source.
Titles should provide context.
Ask questions in our Discussion Threads.
No adverts for products/services.
Do not submit prohibited topics.

Discussion Guidelines

Don't create unnecessary conflict.
Keep the discussion on topic.
Limit the use of jokes & memes.
Don't complain about content being a PDF.
Follow all reddit rules and obey reddiquette.

Prohibited Topics & Sources

No populist news articles (CNN, BBC, FOX, etc.)
No curated lists unless actively maintained, free and open.
No question posts.
No social media posts.
No image-only posts - talk videos are fine.
No livestreams.
No tech-support requests.
No paywall/regwall content.
No commercial advertisements for products or services
No crowdfunding posts.
No Personally Identifying Information

Related Reddits

/r/netsec - The original and less focused parent
/r/redteamsec - Our attack focused siblings
/r/blackhat - Hackers on Steroids
/r/computerforensics - IR Archaeologists
/r/crypto - Cryptography news and discussion
/r/Cyberpunk - High-Tech Low-Lifes
/r/HackBloc - Hacktivism & Crypto-anarchy
/r/lockpicking - Popular Hacker Hobby
/r/Malware - Malware reports and information
/r/netsecstudents - netsec for ~~noobs~~ students
/r/onions - Things That Make You Cry
/r/privacy - Orwell Was Right
/r/pwned - "What Security?"
/r/REMath - Math behind reverse engineering
/r/ReverseEngineering - Binary Reversing
/r/rootkit - Software and hardware rootkits
/r/securityCTF - CTF new and write-ups
/r/SocialEngineering - Free Candy
/r/sysadmin - Overworked Crushed Souls
/r/vrd - Vulnerability Research and Development
/r/xss - Cross Site Scripting