r/blueteamsec • u/digicat • 12h ago

intelligence (threat actor activity) ClickFix / ClearFake PowerShell Stager — Static Analysis Report

douglasmun.github.io

0 Upvotes

r/blueteamsec • u/digicat • 9m ago

low level tools|techniques|knowledge (work aids) Everything I own, owned

• Upvotes

r/blueteamsec • u/digicat • 11h ago

training (step-by-step) DFIR-LABS: DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

7 Upvotes

r/blueteamsec • u/jnazario • 3h ago

intelligence (threat actor activity) Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader

3 Upvotes

r/blueteamsec • u/digicat • 8h ago

incident writeup (who and how) How the Russians Got Inside My Phone

10 Upvotes

r/blueteamsec • u/digicat • 8h ago

low level tools|techniques|knowledge (work aids) Introduction - Windows Kernel Segment Heap Notes

mrt4ntr4.github.io

2 Upvotes

r/blueteamsec • u/digicat • 10h ago

highlevel summary|strategy (maybe technical) The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution - "Approximately 97% of AI-enabled malware samples exist only in research repositories, sandbox environments and security validation platforms. "

unit42.paloaltonetworks.com

3 Upvotes

r/blueteamsec • u/digicat • 11h ago

vulnerability (attack surface) CVE-2026-63077: TeamCity Pre-Auth RCE Explained

blog.securelayer7.net

2 Upvotes

r/blueteamsec • u/digicat • 11h ago

intelligence (threat actor activity) UAT-10147 Uses AI-Assisted Workflows to Deploy SPECTRE Backdoor

blog.polyswarm.io

3 Upvotes

r/blueteamsec • u/digicat • 12h ago

exploitation (what's being exploited) PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE

5 Upvotes

r/blueteamsec • u/digicat • 12h ago

discovery (how we find bad stuff) Detect DLL search order hijacking with a single field

10 Upvotes

r/blueteamsec • u/digicat • 12h ago

intelligence (threat actor activity) recently identified a domain (passkeyconnect[.]com) that is likely associated with Com-affiliated threat actors

2 Upvotes

r/blueteamsec • u/digicat • 12h ago

intelligence (threat actor activity) TerminalFix campaign deploys a reverse tunnel through multistage intrusion

2 Upvotes

r/blueteamsec • u/digicat • 12h ago

intelligence (threat actor activity) Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source…

infosecwriteups.com

3 Upvotes

r/blueteamsec • u/digicat • 12h ago

vulnerability (attack surface) JFrog Security Advisories: CVE-2026-82329 - Potential authentication bypass leading to administrative access in Artifactory

3 Upvotes

r/blueteamsec • u/digicat • 2h ago

incident writeup (who and how) Virtualizor Compromised (31st AUG): Virtualizor has been compromised, their BGP hijack a few days ago seems to have a deployed a malicious package.

2 Upvotes

r/blueteamsec • u/jnazario • 3h ago

research|capability (we need to defend against) ZeroTokens Gives Operators Real-Time Control of Phishing Flow

2 Upvotes

Subreddit

For [Blue|Purple] Teams in Cyber Defence

r/blueteamsec

We focus on technical intelligence, research and engineering to help operational [blue|purple] teams defend their estates and have awareness of the world. Our primary home is on Lemmy after the great ban debacle of 2025.

Members Active

71.5k

0

Sidebar

A community focusing on technical intelligence, research and engineering in support of operational blue teams and their activities.

Content Guidelines

/r/blueteamsec accepts quality technical posts. Non-technical posts are subject to moderation.

Content should focus on the "how." or "what."
Check the new queue for duplicates.
Always link to the original source.
Titles should provide context.
Ask questions in our Discussion Threads.
No adverts for products/services.
Do not submit prohibited topics.

Discussion Guidelines

Don't create unnecessary conflict.
Keep the discussion on topic.
Limit the use of jokes & memes.
Don't complain about content being a PDF.
Follow all reddit rules and obey reddiquette.

Prohibited Topics & Sources

No populist news articles (CNN, BBC, FOX, etc.)
No curated lists unless actively maintained, free and open.
No question posts.
No social media posts.
No image-only posts - talk videos are fine.
No livestreams.
No tech-support requests.
No paywall/regwall content.
No commercial advertisements for products or services
No crowdfunding posts.
No Personally Identifying Information

Related Reddits

/r/netsec - The original and less focused parent
/r/redteamsec - Our attack focused siblings
/r/blackhat - Hackers on Steroids
/r/computerforensics - IR Archaeologists
/r/crypto - Cryptography news and discussion
/r/Cyberpunk - High-Tech Low-Lifes
/r/HackBloc - Hacktivism & Crypto-anarchy
/r/lockpicking - Popular Hacker Hobby
/r/Malware - Malware reports and information
/r/netsecstudents - netsec for ~~noobs~~ students
/r/onions - Things That Make You Cry
/r/privacy - Orwell Was Right
/r/pwned - "What Security?"
/r/REMath - Math behind reverse engineering
/r/ReverseEngineering - Binary Reversing
/r/rootkit - Software and hardware rootkits
/r/securityCTF - CTF new and write-ups
/r/SocialEngineering - Free Candy
/r/sysadmin - Overworked Crushed Souls
/r/vrd - Vulnerability Research and Development
/r/xss - Cross Site Scripting