As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Adam Messer
  Cloud Digital Forensics and Incident Response — EC2 Compromise Leads to S3 Bucket Exfiltration
  
  
• Baris Dincer
  • Forensic Investigation Operations — Windows Base I
  • Forensic Investigation Operations — Windows Base II
    
    
• Belkasoft
  Challenges in Digital Forensics: The Case of the Trump Rally Shooter’s Phone
  
  
• Digital Forensics Myanmar
  • eCDFP (Module-6) (Window Forensics) (Part – 2 )
  • eCDFP (Module-6) (Window Forensics) (Part – 3 )
    
    
• Forensafe
  Investigating Android AVG Antivirus
  
  
• Gabe Renfro and Jake Plant at GuidePoint Security
  Fraudster’s Fumble: From Phish to Failure
  
  
• Husam Shbib at Memory Forensic
  • Memory Dumps Collection – Volume 1
  • MEM Challenge
    
    
• Kevin Stokes
  Plaso Super Timelines with Docker
  
  
• Dan Aschwanden and Mikhail Bushkov at Open Source DFIR
  GRR with GCS Blobstore and Cloud Pub/Sub Service
  

THREAT INTELLIGENCE/HUNTING

• Anton Chuvakin
  Google Cloud Security Threat Horizons Report #10 Is Out!
  
  
• Any.Run
  What Are the 3 Types of Threat Intelligence Data
  
  
• Ayelen Torello at AttackIQ
  Response to CISA Advisory (AA24-193A): CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth
  
  
• Avertium
  Botnets to Watch – CatDDoS and Zergeca
  
  
• CERT Ukraine
  Цільові кібератаки UAC-0180 у відношенні оборонних підприємств з використанням GLUEEGG / DROPCLUE / ATERA (CERT-UA#10375)
  
  
• CERT-AGID
  • Campagne di phishing ai danni del Ministero degli Affari Esteri e della Cooperazione Internazionale
  • Problemi informatici globali in corso
  • Sintesi riepilogativa delle campagne malevole nella settimana del 13 – 19 luglio 2024
    
    
• Chainalysis
  Introducing Chainalysis Operation Spincaster: An Ecosystem-Wide Initiative To Disrupt and Prevent Billions in Losses to Crypto Scams
  
  
• Check Point
  • 15th July – Threat Intelligence Report
  • New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
    
    
• Yehuda Gelb at Checkmarx Security
  Tip of the Iceberg: Malicious Python Packages Reveal Extensive Cybercriminal Operation Based in…
  
  
• Allen Marin at Corelight
  Understanding the Latest Threat Landscape: Insights from Mandiant M-Trends
  
  
• Cyble
  • Investigating the New Jellyfish Loader 
  • Hacktivist Groups “People’s Cyber Army” And “HackNeT” Launch Trial DDoS Attacks on French Websites; prior to the Onslaught during Paris Olympics   
  • New Malware Campaign Abusing RDPWrapper and Tailscale to Target Cryptocurrency Users 
  • Threat Actors Exploit Recent CrowdStrike Outage to Ramp Up Suspicious Domain Creation
    
    
• Cyfirma
  Threat Actors Actively Exploiting CVE-2024–24919: Underground Forums Share IP Addresses of…
  
  
• Cyfirma
  Weekly Intelligence Report – 19 July 2024
  
  
• Cyjax
  Weekly Cyber Threat Intelligence Summary
  
  
• Esentire
  The Gatekeeper’s Secrets: DarkGate Malware Analysis
  
  
• g0njxa
  Approaching stealers devs : a brief interview with Poseidon
  
  
• Mike Stokkel, Pierre Gerlings, Renato Fontana, Luis Rocha, Jared Wilson, Stephen Eckels, and Jonathan Lepore at Google Cloud Threat Intelligence
  APT41 Has Arisen From the DUST
  
  
• Konstantin Lazarev at GreyNoise Labs
  Command and Control (C2) Servers 101
  
  
• HackTheBox
  How to apply the MITRE ATT&CK framework to your cybersecurity strategy
  
  
• Haircutfish
  TryHackMe Room — Threat Intelligence for SOC
  
  
• Human Security
  Satori Threat Intelligence Alert: Konfety Spreads ‘Evil Twin’ Apps for Multiple Fraud Schemes
  
  
• InQuest
  USPS Parcel Delivery Themed Smishing Campaign Activity
  
  
• Intel471
  • Cyber Threat Landscape: 2024 Paris Olympic Games
  • BreachForums Saga Continues. What’s Next?
    
    
• Yuma Masubuchi, Kota Kino, and Shusei Tomonaga at JPCERT/CC
  MirrorFace Attack against Japanese Organisations
  
  
• Justin Ibarra
  Introducing the REx: Rule Explorer Project
  
  
• Kaido Järvemets
  • How Many Domain Admins Do You Really Have?
  • Stay Ahead with Azure Arc: Automate Expiry Alerts for Service Principal
    
    
• Brian Krebs at Krebs on Security
  • Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks
  • Global Microsoft Meltdown Tied to Bad Crowdstrike Update
    
    
• Suneel Sundar at MITRE-Engenuity
  Industry Leaders Expand Threat-Informed Defense to AI-Enabled Systems
  
  
• Brad LaPorte at Morphisec
  Mid-year Threat Landscape Roundup: What You Need to Know
  
  
• Natto Thoughts
  Ransom-War Part 4b: Ransomware Diplomacy
  
  
• Nextron Systems
  Antivirus Event Analysis Cheat Sheet v1.13.0
  
  
• Yosef Yaakov and Bar Ben-Michael at Palo Alto Networks
  Container Breakouts: Escape Techniques in Cloud Environments
  
  
• AJ Hammond at Praetorian
  Unconstrained Delegation in Active Directory
  
  
• Raj Samani at Rapid7
  Defending Against APTs: A Learning Exercise with Kimsuky
  
  
• Recorded Future
  • TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies
  • Security Challenges Rise as QR Code and AI-Generated Phishing Proliferate
    
    
• ReliaQuest
  Ransomware and Cyber Extortion in Q2 2024
  
  
• SANS
  Defending Against SCATTERED SPIDER and The Com with Cybercrime Intelligence
  
  
• SANS Internet Storm Center
  • Wireshark 4.2.6 Released, (Sun, Jul 14th)
  • Protected OOXML Spreadsheets, (Mon, Jul 15th)
  • “Reply-chain phishing” with a twist, (Tue, Jul 16th)
  • Who You Gonna Call? AndroxGh0st Busters! [Guest Diary], (Tue, Jul 16th)
  • Widespread Windows Crashes Due to Crowdstrike Updates, (Fri, Jul 19th)
    
    
• Security Joes
  Security’s Achilles’ Heel: Vulnerable Drivers on the Prowl
  
  
• SentinelOne
  • NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI
  • FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks
    
    
• Simone Kraus
  Why CONTI has changed incident response — and why it’s not over
  
  
• SOCRadar
  • SOCRadar’s Global Ransomware Report 2024: Gain Insights Into Worldwide Ransomware Trends
  • Suspicious Domains Exploiting the Recent CrowdStrike Outage!
    
    
• Puja Mahendru at Sophos
  The State of Ransomware in Critical Infrastructure 2024
  
  
• Splunk
  • Woken by Ransomware, Are We Hypnotized by Tunnel Vision?
  • Breaking Down Linux.Gomir: Understanding this Backdoor’s TTPs
    
    
• Taz Wake
  Linux Security – Forwarding the Journal logs
  
  
• Trend Micro
  • CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
  • Play Ransomware Group’s New Linux Variant Targets ESXi, Shows Ties With Prolific Puma
    
    
• John Dwyer, Kevin Haubris and Eric Gonzalez at TrustedSec
  Technical Analysis: Killer Ultra Malware Targeting EDR Products in Ransomware Attacks
  
  
• Trustwave SpiderLabs
  Facebook Malvertising Epidemic – Unraveling a Persistent Threat: SYS01
  

UPCOMING EVENTS

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2024-07-22
  
  
• Cyber Triage
  Fuzzy Malware Matching Methods for DFIR – How to Scope Incidents
  
  
• Magnet Forensics
  • Global call for papers for MUS 2025 & MVS 2025 now open!
  • Dancing between eDisco and DFIR
    

PRESENTATIONS/PODCASTS

• AhmedS Kasmani
  Malware 101: Injection Basics – Local Shellcode Injection
  
  
• Breaking Badness
  Breaking Badness Cybersecurity Podcast – 190. The Weak Security Default in Our Stars
  
  
• Clint Marsden at the TLP – Digital Forensics Podcast
  Episode 10 – Detecting and Preventing Phishing Attacks
  
  
• Cloud Security Podcast by Google
  EP181 Detection Engineering Deep Dive: From Career Paths to Scaling SOC Teams
  
  
• Cyber Social Hub
  Are You Using a CSAM Global Database in Your Investigation?
  
  
• Desi at Hardly Adequate
  S02E27 – Hardly a Week 29
  
  
• DFIR101
  Podcast Visualized:  Digital Forensic Survival Podcast (ep002) – Windows Link Files
  
  
• FIRST
  2024 Cyber Threat Intelligence Conference | #FIRSTCTI24
  
  
• Huntress
  July 2024 Community Fireside Chat: Cyber Insurance Office Hours
  
  
• InfoSec_Bret
  Challenge – Confluence CVE-2023-22527 – Part 2
  
  
• John Hammond
  • Hacking Windows TrustedInstaller (GOD MODE)
  • He Sent Me Minecraft Malware (Java Deobfuscation)
    
    
• Justin Tolman at AccessData
  • FTK Over the Air – Techno Security 2024 Recap – Season 2 Episode 5
  • FTK Over the Air – Bitmindz Forensic Solutions – Building the Perfect Forensic Workstation
    
    
• LetsDefend
  SOC Analyst Interview Questions
  
  
• Magnet Forensics
  • How to help your stakeholders use Mobile View in Portable Cases
  • Cyber Unpacked Ep. 2 // Uncovering the unseen: Mastering mobile data for internal investigations and eDiscovery
    
    
• MSAB
  XRY Show Summary Page
  
  
• MyDFIR
  Hack The Box SOC Analyst Lab – Unit42 (Sysmon)
  
  
• Nuix
  • Nuix Neo – One platform for all your complex data challenges
  • Nuix XLR8/24
  • Nuix & ACEDS webinar // Unlocking The Potential of AI In Legal Discovery
  • Webinar – Unlocking the power of AI for unstructured data with integrated link analysis
  • Nuix & Grant Thornton webinar – Meeting your data challenges with responsible AI solutions
  • On demand webinar// Are you ready to tackle the surge in Data Subject Access Requests (DSAR)?
  • Webinar//eDiscovery Automation: How Technology is Revolutionizing Legal Challenges
    
    
• Palo Alto Networks Unit 42
  Vishing Villains and Voter Vigilance
  
  
• Richard Davis at 13Cubed
  Mounting Linux Disk Images in Windows
  
  
• Sandfly Security
  • SSH Security Zones – Track, secure and monitor SSH keys on Linux agentlessly.
  • SSH Security Zones – Full demo of how to track, secure and monitor SSH keys on Linux agentlessly.
    
    
• SANS
  How to Attract, Hire and Retain Mid-Level Cybersecurity Roles
  
  
• Security Conversations
  Ep5: CrowdStrike’s faulty update shuts down global networks
  
  
• Threat Forest
  News from Threat Forest: Akira, Phishing kit and AutoIT information stealer
  

MALWARE

• ASEC
  • Private HTS Program Continuously Used in Attacks
  • Warning Against the Distribution of Malware Disguised as Software Cracks (Disrupts V3 Lite Installation)
    
    
• CyberArmor
  White Snake: Latest Campaign With Multi-Stage Malware Dropper
  
  
• Dark Atlas
  Kimsuky APT: The TrollAgent Stealer Analysis
  
  
• Ivan Kosarev at Deep Instinct
  Deep Dive: Exposing Stealthy New BlackSuit Ransomware
  
  
• Dr Josh Stroschein – The Cyber Yeti
  How to Find Digital Certificates in the PE File Format
  
  
• Fareed Fauzi
  Dive into PEB Walk in Malware Analysis
  
  
• Google Cloud Threat Intelligence
  Scaling Up Malware Analysis with Gemini 1.5 Flash
  
  
• James Barnett at Infoblox
  RDGAs: The Next Chapter in Domain Generation Algorithms
  
  
• Nicole Fishbein at Intezer
  How to Analyze Malicious MSI Installer Files
  
  
• Nithin Chenthur Prabhu
  Malware Development, Analysis and DFIR Series – Part IV
  
  
• Ovi Liber
  • instructSOCIETY | Malware digraphs &modelling // part 1
  • instructSOCIETY | Visual programming of malware tutorial &project files // part 2
    
    
• Lee Wei Yeong at Palo Alto Networks
  Beware of BadPack: One Weird Trick Being Used Against Android Devices
  
  
• Patrick Wardle at Objective-See
  This Meeting Should Have Been an Email
  
  
• Phylum
  Fake AWS Packages Ship Command and Control Malware In JPEG Files
  
  
• Richard Christopher
  Bitter [IR/Malware Analysis]
  
  
• Sekoia
  MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign
  
  
• Liran Tal at Snyk
  Suspicious Maintainer Unveils Threads of npm Supply Chain Attack
  
  
• SonicWall
  Volcano Demon Group Targets Idealease Inc. Using LukaLocker Ransomware
  
  
• Matt Morrow at Sucuri
  Attackers Abuse Swap File to Steal Credit Cards
  
  
• Tony Lambert
  Decompiling a JPHP Loader with binwalk and cfr
  
  
• Romain Dumont at WeLiveSecurity
  HotPage: Story of a signed, vulnerable, ad-injecting driver
  
  
• Zhassulan Zhussupov
  • Malware development: persistence – part 25. Create symlink from legit to evil. Simple C example.
  • Malware and cryptography 29: LOKI payload encryption. Simple C example.
    

MISCELLANEOUS

• Cellebrite
  Cellebrite Industry Trends Survey 2024: Is Your Business Prepared? 
  
  
• Cyberdom
  Microsoft Defender Delayed Updates
  
  
• Forensic Focus
  • Event Recap: Techno Security East 2024
  • Digital Forensics Round-Up, July 17 2024
  • Vaibhav Malik, Global Partner Solution Architect, Cloudflare
    
    
• Google Cloud Threat Intelligence
  AI-Powered Learning: Your NIST NICE Prompt Library (Built with Google Gemini)
  
  
• Matt C. A. Smith
  Endpoint detection and response (EDR) – setting the record straight
  
  
• MISP
  Maltego Integration with MISP
  
  
• Stephan Jou at OpenText
  A study of threat hunters  
  
  
• Oxygen Forensics
  • 5 surprising things you may not know about Oxygen Forensic® Detective
  • Android Keystore extraction in Oxygen Forensic® Detective
    
    
• Prodaft
  What Is the Difference Between the Deep Web and the Dark Web?
  
  
• Salvation DATA
  • What Types of Digital Devices Can Hold Forensic Evidence?
  • Become a Skilled Forensic Technician: Essential Insights
    
    
• SANS
  • How to Become a SOC Analyst
  • Master Cloud Threat Detection with Cutting-Edge Techniques
  • How SOAR Transforms Security Operations: A Real-World Case Study
  • Lessons Learned on the Impact of Training on Hiring Success: A Mastercard Use Case
  • Strategies for Training and Hiring in the US Government: A Black Rainbow Case Study
    
    
• Jennifer Gregory at Security Intelligence
  Cybersecurity crisis communication: What to do
  

SOFTWARE UPDATES

• Airbus Cybersecurity
  IRIS-Web v2.4.9
  
  
• Apache
  Release 3.0.0-BETA2 – 07/09/2024
  
  
• Brian Maloney
  OneDriveExplorer v2024.07.19
  
  
• Brim
  v1.17.0
  
  
• Cellebrite
  Breaking Down Barriers: Native Linux Support in Cellebrite Endpoint Inspector 2.2
  
  
• Datadog Security Labs
  GuardDog v2.0.0
  
  
• Didier Stevens
  • Update: cut-bytes.py Version 0.0.17
  • Update: oledump.py Version 0.0.77
    
    
• Digital Sleuth
  winfor-salt v2024.12.1
  
  
• Google
  Timesketch 20240717
  
  
• Magnet Forensics
  • Magnet Axiom Cyber 8.3: MFT parsing improvements, collapse/expand file trees, and more cloud acquisition improvements
  • Magnet Axiom 8.3: Exhibit Builder updates, more surveillance applications and updated external mapping options
    
    
• Martin Korman
  Regipy release 4.3.0
  
  
• OpenCTI
  6.2.6
  
  
• Sandfly Security
  Sandfly 5.1 – Introducing SSH Security Zones
  
  
• Sigma
  Release r2024-07-17
  
  
• Xways
  X-Ways Forensics 21.2 SR-1
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!