As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Akash Patel
Master Wireshark tool Like a Pro: — The Ultimate Packet Analysis Guide for Real-World Analysts - CCL Solutions
Investigating PolyBuzz on Android - Christopher Eng at Ogmini
- Dr. Brian Carrier at Cyber Triage
SOC Investigations 2025: Clues Are Key - Derek Eiri
Exploring the macOS Native Commands Behind Andrea Lazzarotto’s Fuji - Digital Forensics Myanmar
Breaking into the Ecosystem – How One Weak Link Can Unlock a Secure Device (Myanmar Translation) - Oleg Afonin at Elcomsoft
iOS Extraction Tip: Why Start with Recovery Mode? - Forensafe
iOS Google Maps - Heather Chapentier
Glow&Behold - InfoSec Write-ups
Memory Analysis Introduction | TryHackMe Write-Up | FarrosFR - Koen Van Impe
Incident Response on ESXi - kyjonin
Velociraptor MCP - North Loop Consulting
Introducing Arsenic - Aj-Tap at ShinkenSec
Log Analysis Made Easy: The Swiss Army Knife for Logs – Logtap - SJDC
A Practical Path to Mobile Device Discovery for Private Investigators—Using Free Tools and Smart Workflows - Aaron at System Weakness
Mobile Acquisition | Tryhackme
THREAT INTELLIGENCE/HUNTING
- Faan Rossouw at Active Countermeasures
Threat Hunting C2 over HTTPS Connections Using the TLS Certificate - Adam at Hexacorn
- Ayelen Torello at AttackIQ
Emulating the Unyielding Scattered Spider - BI.Zone
Malware or LLM? Silent Werewolf employs new loaders to attack Russian and Moldovan organizations - Gracie Smith at Binary Defense
RMM: Tool Convenience and Control Comes with a Cost - Black Cell
Advanced phishing with legitimate emails - Mehmet Ergene at Blu Raven Academy
Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way Using Microsoft Defender for Endpoint - Brian Krebs at ‘Krebs on Security’
- CERT-AGID
- Check Point
- CISA
New Guidance for SIEM and SOAR Implementation - Cofense
- CTF导航
- Patrick Seltmann at ctrlshiftenter.cloud
Entra Connect Sync – Attack Surface Reductions - Cyber Axe
Complete Guide On How to Identify A Suspicious Process - Jane Ginn at Cyber Threat Intelligence Training Center
Schema-Free Intelligence: Document Databases as the Backbone of Adaptive CTI Systems - Cyfirma
Weekly Intelligence Report – 30 May 2025 - Damien Lewke
Threat Hunting the DPRK’s Remote Workers - Darktrace
PumaBot: Novel Botnet Targeting IoT Surveillance Devices - Johann Aydinbas, Bennet Conrads, Moaath Oudeh and Denis Szadkowski at DCSO CyTec
SafePay: The new kid on the block - Disconinja
Weekly Threat Infrastructure Investigation(Week21) - DomainTools
- Arda Büyükkaya & Alon Gal at EclecticIQ
Pakistan Telecommunication Company (PTCL) Targeted by Bitter APT During Heightened Regional Conflict - Esentire
When Samsung’s Magic Turns Tragic: A Tale of Unauthorized Mining - Flashpoint
Leader of Qakbot Malware Conspiracy Indicted for Involvement in Global Ransomware Scheme - Sai Molige at Forescout
Cybersecurity in Manufacturing: Threats, Trends, and Preparation - FourCore
Threat-informed defense with HarfangLab EDR and FourCore ATTACK - Gen
Gen Q1/2025 Threat Report - Google Cloud Security Community
New to Google SecOps: Building a Rule Using Match and Outcome Variables - Google Cloud Threat Intelligence
- Noah Stone at GreyNoise
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day - GreyNoise Labs
AyySSHush: Tradecraft of an emergent ASUS botnet - Hudson Rock
- Hunt IO
How to Track Threat Actors Through Real-World IOC Pivoting - Huntress
- IC3
Infrastructure Used to Manage Domains Related to Cryptocurrency Investment Fraud Scams between October 2023 and April 2025 - David Sardinha at Intrinsec
BtHoster: Identifying noisy networks emitting malicious traffic through masscan servers - Kijo Ninja
BEC Starts Here: Tracing the First Entry Technique - Lab52
Some thoughts about Laundry Bear - Lookout
What Is the MITRE ATT&CK Framework? Mapping to Today’s Defensive Controls - Daniel Jeremiah
Threat Hunting on Windows Server 2016: Uncovering Hidden C2 Malware Using Elastic SIEM - Microsoft Security
- Natebair
A Midnight Blizzard Special: Simulating an RDP Phishing Campaign — PT 1 - Natto Thoughts
From Humble Beginnings: How a Vocational College Became a Vulnerability Powerhouse - Netscout
Decoding TCP SYN for Stronger Network Security - Pierre-Henri Pezier at Nextron Systems
Stealth in 100 Lines: Analyzing PAM Backdoors in Linux - Oleg Skulkin at ‘Know Your Adversary’
- 146. Adversaries Abuse Haihaisoft PDF Reader to Deliver Rhadamanthys Stealer
- 147. Detecting a macOS Stealer
- 148. Base64? And What About Base85?
- 149. Adversaries Abuse Free Web Hosting Infrastructure
- 150. Adversaries Abuse Internet Query Files
- 151. Adversaries Abuse MST Transforms to Install Malware
- 152. Beyond Good Ol’ Windows Command Shell
- Miri Mohammed at OSINT Team
Inside the Scam Unpacking a Real Phishing Email Attempt - Outpost24
Threat Context Monthly May 2025: Scattered Spider & Lumma Stealer - Abian Morina at Permiso
CloudTrail Logging Evasion: Where Policy Size Matters - Adithya Vellal at Petra Security
When A Tesla Looks Like an Attacker - Practical Security Analytics
Profiling User Activity with EventLogs - SANS Internet Storm Center
- SVG Steganography, (Mon, May 26th)
- Securing Your SSH authorized_keys File, (Tue, May 27th)
- Alternate Data Streams ? Adversary Defense Evasion and Detection [Guest Diary], (Wed, May 28th)
- [Guest Diary] Exploring a Use Case of Artificial Intelligence Assistance with Understanding an Attack, (Wed, May 28th)
- Usage of “passwd” Command in DShield Honeypots, (Fri, May 30th)
- A PNG Image With an Embedded Gift, (Sat, May 31st)
- YARA 4.5.3 Release, (Sun, Jun 1st)
- Antonio Villalón at Security Art Work
Algunas reflexiones sobre Laundry Bear - Siddhant Mishra
- Simone Kraus
- SOCRadar
Dark Web Profile: NightSpire Ransomware - Anthony Bradshaw, Hunter Neal, Morgan Demboski, and Sean Gallagher at Sophos
DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers - Josh “Soup” Campbell and Brandon Murphy at Sublime Security
Detecting an email-based ClickFix attack that delivers DCRat malware payload - Manish Rawat at System Weakness
From Clueless to Clued-In: How YARA Helps You Hunt Malware Like a Pro - The Raven File
Lumma Stealer Still Active? After FBI Crackdown! - THOR Collective Dispatch
- Tom Hacker
LOLFS - Cris Tomboc and King Orande at Trustwave SpiderLabs
PhaaS the Secrets: The Hidden Ties Between Tycoon2FA and Dadsec’s Operations - Varonis
- István Márton at Wordfence
15,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in MasterStudy LMS Pro WordPress Plugin - Блог Solar 4RAYS
Webrat шпионит за жертвой через веб-камеру и похищает аккаунты и криптокошелки
UPCOMING EVENTS
- Dr. Ashar Neyaz and Elena Chertova at Belkasoft
Carving in DFIR: Data Recovery and Detection of Anti-Forensic Measures - Black Hills Information Security
BHIS – Talkin’ Bout [infosec] News 2025-06-02 #livestream #infosec #infosecnews - Huntress
Tradecraft Tuesday | AI: Friend or Faux? - George Glass and Keith Wojcieszek at Kroll
April Threat Intelligence Spotlight Report
PRESENTATIONS/PODCASTS
- Adversary Universe Podcast
Catching Up on Cloud Attack Paths with Cloud Threat Specialist Sebastian Walla - Archan Choudhury at BlackPerl
Threat Intelligence for SOC Analysts | ANY.RUN New TI Lookup and Feed - Belkasoft
Connecting the Dots: How Sparse Data Solves Real-World Crimes | Matthew Sorell - Breaking Badness
It Takes a Village to Secure AI - Cellebrite
Tip Tuesday: PA Installation - Clint Marsden at the TLP – Digital Forensics Podcast
Episode 19: AI Data Poisoning: How Bad Actors Corrupt Machine Learning Systems for Under $60 - Cloud Security Podcast by Google
EP227 AI-Native MDR: Betting on the Future of Security Operations? - Deepanshu Khanna
Complete Cyber Threat Intelligence (CTI) Masterclass | Learn and Hunt APT36 espionage group - Dr Josh Stroschein
AI Prompt Hunting with NOVA and the YARA Tool Kit – Guest Thomas Roccia - Endace
Integrating Always-On Packet Capture with Microsoft Sentinel - InfoSec_Bret
Challenge – SpiceRAT - Intel 471
Fingerprinting threat actors by their anonymity techniques - John Hammond
- Karsten Hahn at Malware Analysis For Hedgehogs
Malware Analysis – Virut’s NTDLL Hooking and Process Infection, Part 2 - Microsoft Threat Intelligence Podcast
Call of the Cyber Duty (A Global Cyber Challenge) - MSAB
- MyDFIR
SOC Analyst Job Description Review (What Skills You Actually Need) - Nuix
Sprint to success: Conversation with software leaders with AWS and Nuix - Parsing the Truth: One Byte at a Time
BTK Killer and the Purple Floppy Disk - SANS
- The Cyber Mentor
How Hackers Establish Persistence - The Weekly Purple Team
🛡️ Deep Dive: BadSuccessor – Full Active Directory Compromise - Threat Forest
Uhkametsän APT-uutiset ja Tuo Oma Haavoittuva Ajurisi - Three Buddy Problem
The dark hole of ‘friendlies’ and Western APTs
MALWARE
- Any.Run
- ASEC
Analysis of T-Rex CoinMiner Attacks Targeting Internet Cafés in Korea - Sean Shirley at LevelBlue
Hunting Malware with MSHTA and CyberChef: A Deep Dive into Obfuscation in Malicious Scripts and Credential Theft - Chetan Raghuprasad at Cisco’s Talos
Cybercriminals camouflaging threats as AI tool installers - Hendrik Eckardt at cyber.wtf
Notes on Pyarmor BCC Mode - Elastic Security Labs
Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns - Fatih Yilmaz
- Fortinet
- Banu Ramakrishnan at G Data Software
Reborn in Rust: AsyncRAT - g0njxa
Dark Partners: The crypto heist adventure of Poseidon Stealer and Payday Loader - Iram Jack
- Leandro Fróes at Netskope
PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands - Leandro Cuozzo at Securelist
Zanubis in motion: Tracing the active evolution of the Android banking malware - Sekoia
The Sharp Taste of Mimo’lette: Analyzing Mimo’s Latest Campaign targeting Craft CMS - Aj-Tap & johnKim at ShinkenSec
Brain Cipher Ransomware: Analysis of a Lockbit 3.0 variant - Shubho57
Analysis of DarkComet RAT (Synaptics Touchpad Driver) - Socket
- SquareX Labs
Safari Vulnerability Enables Attackers to Steal Credentials with Fullscreen BitM Attacks - Sucuri
- Srini Seethapathy at Trellix
A Flyby on the CFO’s Inbox: Spear-Phishing Campaign Targeting Financial Executives with NetBird Deployment - Joseph C Chen at Trend Micro
Earth Lamia Develops Custom Arsenal to Target Multiple Industries - Jason Reaves at Walmart
ARC Stealer Hiding in the Ether - Zhassulan Zhussupov
Malware and cryptography 42 – encrypt/decrypt payload via Speck cipher. Simple C example.
MISCELLANEOUS
- Dr. Erdal Ozkaya at Binalyze
Platform power or precision tools? The EDR investigation gap - Manny Kressel at Bitmindz
Nvidia Blackwell Architecture – The New KING of Decryption Engines - Brett Shavers
The Bitter Pill of DF/IR Hindsight - Cellebrite
Connect the Dots: Guide to Investigations with Multiple Digital Devices - Cyberbit
- Josibel Mendoza at DFIR Dominican
DFIR Jobs Update – 05/26/25 - Forensic Focus
- Forensics Europe Expo Returns To London With Cutting-Edge Focus On Digital Innovation, Interoperability And Next-Gen Forensics
- Oxygen Tech Bytes In April 2025
- Digital Forensics Round-Up, May 28 2025
- Oxygen Forensic® Detective v.17.3 Is Available Now
- Forensic Focus Digest, May 30 2025
- GMDSOFT Tech Letter Vol 11 Artifact Analysis Using Instagram Data Exports
- Julien Houry
From Alert to Insight: The Art of Incident Qualification - North Loop Consulting
Getting Started with Arsenic - Oxygen Forensics
Cutting Costs While Adding Capabilities: Targeted Remote Data Collection Using Oxygen Forensics - Lance Cody-Valdez at Paraben Corporation
Speaking Their Language: How Investigators Can Connect with Anyone - Jaikumar Vijayan at ReversingLabs
Detection as code: How to enhance your real-time threat detection - Salvation DATA
How to Recover the Deleted DVR Footage with VIP2.0 - Toby G at sentinel.blog
Simplifying Azure Log Analytics Table Retention Management: A Modern Approach
SOFTWARE UPDATES
- Antonio Formato at Antonio Formato
What’s new in TI Mindmap | May 2025 - Apache
26 May 2025: Apache Tika Release 3.2.0 - Brian Maloney
OneDriveExplorer v2025.05.30 - Crowdstrike
Falconpy Version 1.5.2 - Didier Stevens
- Digital Sleuth
- Doug Metz at Baker Street Forensics
Hashes for the Masses: Finding What Matters in a Sea of Samples - Metaspike
- OpenCTI
6.6.14 - PuffyCid
Artemis v0.14.0 – Released! - Rapid7
Velociraptor v0.74.3 - Yamato Security
suzaku v0.2.1 – AUSCERT/SINCON Release 2 - YARA
v4.5.4
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 
https://www.securityartwork.es/2025/05/28/algunas-reflexiones-sobre-laundry-bear/ is a machine translation of https://lab52.io/blog/some-thoughts-about-laundry-bear/ (posted one day earlier). Not sure the first page has any original content…
LikeLike