As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Akash Patel
- John Hyla at Blue Crew Forensics
iOS Stream Names - Christopher Eng at Ogmini
- Chris Ray at Cyber Triage
Windows Registry Forensics Cheat Sheet 2025 - D.ForensicatorJourney
Timestamp Changes between OS via SMB Share - Oleg Afonin at Elcomsoft
What TRIM, DRAT, and DZAT Really Mean for SSD Forensics - Lionel Notari
iOS Unified Logs – log command major updates to not miss! - Sumuri
Imaging Apple Silicon Macs: A Modern Forensic Guide
THREAT INTELLIGENCE/HUNTING
- Abdallah Elnoty
Threat-Actor-Profiles - Ashok Krishna Vemuri
StealingCredentials - Bitdefender
- Brian Krebs at ‘Krebs on Security’
Proxy Services Feast on Ukraine’s IP Address Exodus - CERT Polska
UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign - CERT-AGID
- Chainalysis
How Chainalysis Helped the FBI Track Down and Freeze Millions in the Caesars Casino Ransomware Attack - Check Point
2nd June – Threat Intelligence Report - CISA
#StopRansomware: Play Ransomware - Jacob Finn, Dmytro Korzhevin, and Asheer Malhotra at Cisco’s Talos
Newly identified wiper malware “PathWiper” targets critical infrastructure in Ukraine - CloudSEK
- Kahng An at Cofense
ClickFix Campaign Spoofs Booking.com for Malware Delivery - CrowdStrike
- Cyble
- Cyfirma
Weekly Intelligence Report – 06 June 2025 - Dark Atlas
Operational Analysis of Ransomware Attack Lifecycle - Darktrace
Unpacking ClickFix: Darktrace’s detection of a prolific social engineering tactic - Detect FYI
- Disconinja
Weekly Threat Infrastructure Investigation(Week22) - Dzianis Skliar
Service URLs: The Hidden Gateways in Your Attack Surface - ElementalX
Looking into Wondershare Repairit DLL Hijacking issue - Esentire
Operation Endgame Disrupts AvCheck, Forces Threat Actors to Seek Alternatives - Merlyn Albery-Speyer and Malcolm Heath at F5 Labs
Delving Into the SparkRAT Remote Access Tool - FalconFeeds
- Vojtěch Krejsa and Milan Špinka at Gen
Say Hi to HelloTDS: The Infrastructure Behind FakeCaptcha - Google Cloud Security Community
- Google Cloud Threat Intelligence
- Ron Bowes at GreyNoise Labs
Suricata evasion, starring URL decoding - Hudson Rock
Mandiant Exposes Salesforce Phishing Campaign as Infostealer Malware Emerges as a Parallel Threat - Huntress
- InfoSec Write-ups
- Learning YARA: A Beginner SOC Analyst’s Notes
- {CyberDefenders Write-up}OskiCategory: Threat Intel
- SOC L1 Alert Triage: TryHackMe
- SC-200 – MS Security Operations Analyst illustrative notes
- {CyberDefenders Write-up} Yellow RAT
- Atomic Red Team Setup on Windows for ATT&CK-Based Adversary Simulation
- Shodan Dorks to Find PII Data & Leaks
- SOC AUTOMATION — Part 4
- Intel 471
Android malware trends: Stealthier, easier-to-use - Invictus Incident Response
Profiling Laundry Bear: Tactics, History & Defenses - Jeffrey Bellny at CatchingPhish
History and Evolution of Ransomware Leak Sites - Kijo Ninja
BEC Persistence and Data Exfiltration Techniques - Mark O’halloran
Incident Response in AWS: Scoping strategies - Mat Fuchs
Understanding and Mitigating Insider Threats - Mehmet Ergene at Blu Raven Academy
- Vasu Jakkal at Microsoft Security
Announcing a new strategic collaboration to bring clarity to threat actor naming - Oleg Skulkin at ‘Know Your Adversary’
- 153. Here’s How Threat Actors Hinder Forensic Recovery
- 154. Threat Actors Abuse Google Apps Script for Phishing
- 155. Is Abusing Browser Extensions Noisy Enough?
- 157. Aspia: An RMM in a Partisan Hands
- 156. Threat Actors Abuse OpenSSH to Run a Simple Backdoor
- 158. Here’s How TA397 Abuses Task Scheduler
- 159. Hunting for Backdoored Game Cheats
- Ryan G. Cox at OSINT Team
My Log Source-Agnostic Methodology to Understanding Big Data - Adithya Vellal at Petra Security
Corporate Espionage in the Cloud - Heloise Montini at Porthas
What is an Incident Response Plan - Proofpoint
The Bitter End: Unraveling Eight Years of Espionage Antics—Part One - Rapid7
- Tre Wilkins and Chris Brook at Red Canary
All about that baseline: Detecting anomalies with Surveyor - Red Hot Cyber
RHC Interviews NOVA Ransomware – “Expect Dangerous Attacks. No One Is Safe.” | BLACKVIEW Series - SANS Internet Storm Center
- Simple SSH Backdoor, (Mon, Jun 2nd)
- Phishing e-mail that hides malicious link from Outlook users, (Wed, Jun 4th)
- Be Careful With Fake Zoom Client Downloads, (Thu, Jun 5th)
- Upcoming DShield Honeypot Changes and Customizations, (Fri, Jun 6th)
- Wireshark 4.4.7 Released, (Sun, Jun 8th)
- Extracting With pngdump.py, (Sun, Jun 8th)
- Securelist
- Subhajeet Singha and Sathwik Ram Prakki at Seqrite
Operation DRAGONCLONE: Chinese Telecommunication industry targeted via VELETRIX & VShell malware - Simone Kraus
Unmasking the Shadow Gangs: How Criminal Networks Fabricate Terrorism to Silence Security Experts - Mary Yang at SquareX Labs
Interlock and the Kettering Ransomware Attack: ClickFix’s Persistence - SuspectFile
- Yuanjing Guo at Symantec Enterprise
- System Weakness
- Tarek Mostafa
NightSpire APT Profiling - THOR Collective Dispatch
- ThreatFabric
Crocodilus Mobile Malware: Evolving Fast, Going Global - Nyxgeek at TrustedSec
Full Disclosure, GraphGhost: Are You Afraid of Failed Logins? - Ugur Koc and Bert-Jan Pals at Kusto Insights
Kusto Insights – May Update - Kenneth Kinion at Valdin
Illuminating Transparent Tribe with Validin - Vasilis Orlof at Cyber Intelligence Insights
Cobalt on the weekends - WeLiveSecurity
BladedFeline: Whispering in the dark - Gili Tikochinski, Danielle Aminov, and Merav Bar at Wiz
DevOps Tools Targeted for Cryptojacking - Блог Solar 4RAYS
Охота на Kubernetes: угрозы в джунглях оркестрации
UPCOMING EVENTS
- Peter Sosic at Amped
Amped User Days 2025: Join Us Live on Zoom This September! - Black Hills Information Security
- Oxygen Forensics
Maximizing Speed in Data Loading: Cutting Through the Clutter - Recorded Future
Beyond Ransomware: The Invisible Data Economy Targeting Retail - Silent Push
Workshop – Pivoting Across Infrastructure to Detect Unknown Threats
PRESENTATIONS/PODCASTS
- Hexordia
Truth in Data: EP8: Carving Your Path: Insights into Various Digital Forensics Roles - Adversary Universe Podcast
Where AI Fits in the Adversary’s Toolbox - Behind the Binary by Google Cloud Security
EP 10 Tim Blazytko – Protecting Intellectual Property: Obfuscation & Anti-Reverse Engineering in Software - Belkasoft
Waypoint Analysis: Narrowing Timelines with Partial Data | Matthew Sorell - Breaking Badness
Beyond the Perimeter: How Attackers Use Domains, Phishing & AI and How to Fight Back - Clint Marsden at the TLP – Digital Forensics Podcast
Episode 20:What Makes an Elite Incident Response Team: Mindset, Mastery, and Real-World DFIR Lessons - Cloud Security Podcast by Google
EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines - Cyber Social Hub
- Cyberwox
Detection-as-Code & CI/CD for Detection Engineering with Dennis Chow | Detection Opportunities EP 9 - Deepanshu Khanna
CTI Masterclass Part-II | Automating CTI & hunting APT groups | Automating CTI Lab with Docker - Eric Capuano and Whitney Champion
Modernizing Incident Response Using Techniques that Scale - FIRST
Episode 49: John Stoner, FIRSTCON25 Speaker - 2 Cyber Chicks
Cyber Warfare & Geopolitics: How Threat Actors Are Targeting America with David Cook | S6 E8 - Huntress
- InfoSec_Bret
Challenge – Velociraptor - Matthew Plascencia
THANKS FOR 500 SUBSCRIBERS!!! - MSAB
MM XAMN Timeline - MyDFIR
Avoid These Common Mistakes If You Want To Get Into Cybersecurity - Paraben Corporation
Using E3 with Mobile Data to Export to Relativity as load file or RSMF - Parsing the Truth: One Byte at a Time
The Hidden Partition - SANS
Smart Phone Forensics Circa 2028 - The Cyber Mentor
🔴 LIVE: Conti Ransomware | Cybersecurity | TryHackme | AMA - The Defender’s Advantage Podcast
Vishing in the Wild - Three Buddy Problem
Mikko Hypponen talks drone warfare, APT naming schemes
MALWARE
- Mauro Eldritch at Any.Run
OtterCookie: Analysis of Lazarus Group Malware Targeting Finance and Tech Professionals - ASEC
ViperSoftX Stealing Cryptocurrencies - Dr Josh Stroschein
- Shiyin Lin at Fortinet
How a Malicious Excel File (CVE-2017-0199) Delivers the FormBook Payload - Gi7w0rm
HuluCaptcha — An example of a FakeCaptcha framework - haxrob
- Hunt IO
Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure - Iram Jack
- K7 Labs
- Jan Michael Alcantara at Netskope
Glitch-hosted Phishing Uses Telegram & Fake CAPTCHAs to Target Navy Federal Credit Union Customers - Dominik Reichel at Palo Alto Networks
Blitz Malware: A Tale of Game Cheats and Code Repositories - RevEngAI
Automating String Decoding in Malware: Analysing StealC V1 with IDAPython - Anderson Leite at Securelist
Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721 - Shubho57
Analysis of an AsyncRAT variant from an ClickFix Powershell Script (Keylogger) - Socket
- Malicious Ruby Gems Exfiltrate Telegram Tokens and Messages Following Vietnam Ban
- Malicious npm Packages Target BSC and Ethereum to Drain Crypto Wallets
- Destructive npm Packages Disguised as Utilities Enable Remote System Wipe
- PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
- Matt Wixey and Andrew O’Donnell at Sophos
The strange tale of ischhfd83: When cybercriminals eat their own - Matt Morrow at Sucuri
Fake WordPress Caching Plugin Used to Steal Admin Credentials - Niranjan Hegde, Vasantha Lakshmanan Ambasankar and Adarsh S at Trellix
Demystifying Myth Stealer: A Rust Based InfoStealer - Bernardo Quintero at VirusTotal
What 17,845 GitHub Repos Taught Us About Malicious MCP Servers - VMRay
New malware: Akemi sample uses trailing slash in class filenames to thwart static analysis and unzipping - Marco Wotschka at Wordfence
Malware Masquerades as Legitimate, Hidden WordPress Plugin with Remote Code Execution Capabilities - István Márton at Wordfence
9,000 WordPress Sites Affected by Arbitrary File Upload and Deletion Vulnerabilities in WP User Frontend Pro WordPress Plugin - Шифровальщики-вымогатели The Digest “Crypto-Ransomware”
MISCELLANEOUS
- Belkasoft
- Brian Maloney
Weekly Update 6/6/2025 - Cellebrite
Cellebrite to Acquire Corellium - Decrypting a Defense
The Growing ALPR Threat, Crypto Meets Traditional Crime, Border Search Decision, Celebrating Our 5th Anniversary & More - Josibel Mendoza at DFIR Dominican
DFIR Jobs Update – 06/02/25 - Didier Stevens
- Forensic Focus
- Kevin Pagano at Stark 4N6
Forensics StartMe Updates (6/1/2025) - Magnet Forensics
Introducing Magnet One Mobile Case Stream - Oxygen Forensics
Supercharge investigations by analyzing data from ALL sources in Oxygen - Amber Schroader at Paraben Corporation
From Solitary Sleuth to Connected Pro: Networking for Introverted Digital Investigators - Mari DeGrazia at SANS
Stay Ahead of Ransomware: Communication During a Cyber Incident - Sleuth Kit Labs
Endpoint Triage: How MSSPs Help Their Clients After An Alert
SOFTWARE UPDATES
- Airbus Cybersecurity
IRIS-Web v2.4.22 - Didier Stevens
- Digital Sleuth
winfor-salt v2025.9.1 - Erik Hjelmvik at Netresec
CapLoader 2.0 Released - Francesco Varotto
SlothLog - hasherezade
tiny_tracer 3 - Lethal Forensics
Microsoft-Analyzer-Suite v1.5.1 - Mandiant
Capa v9.2.1 - Mark Baggett
SRUM-DUMP 3.2 - MISP
MISP 2.4.211 & 2.5.13 Released – A Double Dose of Security, Search, and Stability - X1 Discovery
X1 Unveils Major Search Upgrade with New Slack Integration, Enhanced M365 Support, and Unmatched Speed - Xways
- Victor M. Alvarez
YARA-X is stable!
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 