| Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity Security In this session, Permiso’s CTO will cover: – How attackers moved from GitHub → AWS → Salesforce using stolen OAuth tokens. – Why this “all-machine” attack is a wake-up call for SaaS supply chains and NHIs. – Practical steps to detect and contain similar threats in your environment. Watch the Video Podcast |
| Sponsored by Permiso |
As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Akash Patel
- From Rejection to Relocation: Breaking Myths About Getting a Job Abroad
- The Core Principles of Successful Incident Response
- The Sneakiest Phishing Trick I’ve Seen Lately — And Why Your Email Security Won’t Save You
- Beyond Tools: The Human Side of Incident Response
- Divide and rule in Incident Response
- Christopher Eng at Ogmini
- Forensafe
iOS Silent Phone - Forensic Science International: Digital Investigation
Volume 54 - Lucid Truth Technologies
Mobile Phone Evidence Without the Device: Working from UFEDs, Backups, and Targeted Exports - Matthew Plascencia
Get Me All That Info With the Tap! - The DFIR Report
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs
THREAT INTELLIGENCE/HUNTING
- Adam at Hexacorn
Beyond good ol’ Run key, Part 151 - Any.Run
Lazarus Group Attacks in 2025: Here’s Everything SOC Teams Need to Know - ASEC
August 2025 APT Group Trends - Ben Bornholm at HoldMyBeer
Ingesting BTV’s DC30 dataset into Databricks - Jade Brown at Bitdefender
Bitdefender Threat Debrief | September 2025 - Black Hills Information Security, Inc.
Microsoft Store and WinGet: Security Risks for Corporate Environments - Brad Duncan at Malware Traffic Analysis
2025-09-07: Seven days of scans and probes and web traffic hitting my web server - Brian Krebs at ‘Krebs on Security’
- BushidoToken
Ransomware Tool Matrix Update: Community Reports - CERT-AGID
- Check Point
- Cisco’s Talos
- Max Gannon and Kahng An at Cofense
Dual Threat: Threat Actors Combine Credential Phishing and Malware - CTF导航
- Cyfirma
Weekly Intelligence Report – 12 September 2025 - Andrea Draghetti at D3Lab
Campagna di smishing ai danni dell’Agenzia delle Entrate: finta dichiarazione fiscale sulle criptovalute - Damien Lewke
Echoes of Ransomware - Darktrace
Unpacking the Salesloft incident: Insights from Darktrace - Detect FYI
- Thoughts on the recent Ethereum smart contracts C2 abuse
- The importance of match ratio using Threat Inteligence Feeds (combined with KQL Collectors)
- The Present and Future of Managed Detection and Response
- Intelligence-Driven Detection Engineering: From Threat Intel to Detection-as-Code (with the Pyramid…
- Detection Gaps: The Hidden Enemy in SOC Threat Hunting & Detection Engineering
- DomainTools Investigations
Newly Identified Domains Likely Linked to Continued Activity from PoisonSeed E-Crime Actor - FalconFeeds
- Code on Demand: An In-Depth Analysis of the Freelance Malware-as-a-Service Ecosystem
- AI in the Underground: A Cyber Threat Intelligence blog on the Weaponization of Language Models
- Cybercrime’s Middlemen: The Role of Data Brokers, Interpreters, and Translators in the Underground
- Zero-Noise Attacks: The Silent Tactics of Threat Actors Avoiding Public Channels
- Flashpoint
Infostealers to Watch in 2025: Katz, Bee, Acreed, and More - HP Wolf Security
HP Wolf Security Threat Insights Report: September 2025 - Hunt IO
Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66 - Jamie Levy, Lindsey O’Donnell-Welch, and Michael Tigges at Huntress
An Attacker’s Blunder Gave Us a Look Into Their Operations - IC3
Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion - InfoSec Write-ups
LockBit 3.0 (“LockBit Black”) APT High Level Profile - Pieter Arntz at Malwarebytes
iCloud Calendar infrastructure abused in PayPal phishing campaign - Mark Ohalloran
AWS Incident Response: Uploading External CloudTrail Logs to S3 for Querying in Athena - Kseniia Yamburh at Moonlock
Mac.c stealer evolves into MacSync: Now with a backdoor - Natto Thoughts
Salt Typhoon: New Joint Advisory Offers a Beacon Through the Storm but Stirs Up New Questions - Stamatis Chatzimangou at NVISO Labs
Detection Engineering: Practicing Detection-as-Code – Versioning – Part 5 - Oleg Skulkin at ‘Know Your Adversary’
- 250. CastleRAT Abuses Steam Community Pages to Store C2 Addresses
- 251. That’s How MostereRAT Abuses Ruby
- 252. Is APT37 Noisy Enough to Be Detected?
- 253. Ransomware Gangs Abuse PowerRun for Privilege Escalation
- 254. That’s How Adversaries Modify Registry to Weaken Security
- 255. Adversaries Use Azure Functions as C2
- 256. That’s How Adversaries Abuse PowerShell Cmdlets
- 257. Adversaries Abuse ITarian for Command and Control
- Andi Ahmeti at Permiso
Inboxfuscation: Because Rules Are Meant to Be Broken - Dan Green at Push Security
How Push stopped a high risk LinkedIn spear-phishing attack against a company Exec - Recorded Future
- Red Canary
You’re invited: Four phishing lures in campaigns dropping RMM tools - Red Siege Information Security
- Resecurity
KillSec Ransomware is Attacking Healthcare Institutions in Brazil - Yoann Dequeker And Andarnaud Petitcol at RiskInsight
AWSDoor : Persistance sur AWS - SANS Internet Storm Center
- Trey Bilbrey at Scythe
SCYTHE Labs Threat Intel: Scattered Spider (UNC3944) Your Help Desk Became a Security Risk - Security Scorecard
What is Cyber Threat Hunting? - Thomas Roccia at SecurityBreak
The State of Adversarial Prompts - Siddhant Mishra
- Silent Push
- Socket
- SOCRadar
Dark Web Profile: Mr Hamza - Rajan Sanhotra at Sophos
The State of Ransomware in Education 2025 - Vincent Zell at Stairwell
CastleBot: YARA Rule for Core Backdoor - Mike at sudo rem
SSLVPN Honeypots: Fortigate Findings & Musings - The Raven File
Uncovering ALVIVA HOLDING: Links to Russian Shell Companies and Cybercrime - THOR Collective Dispatch
- Threatmon
Global Malware Campaign Activity – August 2025 Summary - Maulik Maheta and Lishoy Mathew at Trellix
Silent Pivot: Detecting Fileless Lateral Movement via Service Manager with Trellix NDR - Trend Micro
- Sean Metcalf at TrustedSec
Detecting Password-Spraying with a Honeypot Account - Kenneth Kinion and Elliot Roe at Valdin
Pivots Revisited: Still Valid Months Later? - Vectra AI
- Aiden Grajo at Walmart
Bypassing Malicious TDS in ClickFix Campaigns - Victor M. Alvarez at YARA-X
Smarter is not always better - Zero Salarium
Old But Gold, Dumping LSASS With Windows Error Reporting On Modern Windows 11 - Amir Moin and Swapnil Kumbhar at ZScaler
Detecting Kerberos attacks and other Active Directory maladies with Deception
UPCOMING EVENTS
- Black Hills Information Security
- Cellebrite
Inside the Autumn 2025 Release - Magnet Forensics
- Simply Defensive
Why Most Threat Intel Fails — and How to Fix It | Jordan Kalm (Morado) | Simply Defensive S4 E8
PRESENTATIONS/PODCASTS
- Adversary Universe Podcast
Tech Sector Targeting, Innovation Race, Fal.Con Countdown - Alexis Brignoni
LAVA usage demo! (LEAPPs Artifact Viewer App) - Belkasoft
Databases Under Attack: Malware in Trusted SQL Servers | Vedant Narayan - Cellebrite
- Cloud Security Podcast by Google
EP242 The AI SOC: Is This The Automation We’ve Been Waiting For? - Compass Security
- Cyberwox
Cybersecurity Homelab – Deploying Wazuh SIEM & XDR on Proxmox - Huntress
- InfoSec_Bret
SA – SOC205-231 – Malicious Macro has been executed - Karsten Hahn at Malware Analysis For Hedgehogs
Malware Theory – What breakpoints to set for unpacking - Magnet Forensics
- Microsoft Threat Intelligence Podcast
Click, Call, Compromise: Inside the Latest Loader Campaigns - Monolith Forensics
- MSAB
XAMN Language Packs - MyDFIR
- OALabs
IDA Free Reverse Engineering – Step-by-Step DLL Analysis - Off By One Security
CTRAPS: CTAP Impersonation and API Confusion Attacks on FIDO2 - Parsing the Truth: One Byte at a Time
Casey Anthony Lessons Learned - Proofpoint
Freighty Cats: RFQ Phishing Comes to A Warehouse Near You - Richard Davis at 13Cubed
AI vs. Windows Forensics - The Weekly Purple Team
Using Velociraptor for Evil - Three Buddy Problem
Can Apple’s New Anti-Exploit Tech Stop iPhone Spyware Attacks?
MALWARE
- ASEC
- Bogdan Zavadovschi, Victor Vrabie, Adrian Schipor, and Martin Zugec at Bitdefender
EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company - Cybereason
Behind the Mask of Madgicx Plus: A Chrome Extension Campaign Targeting Meta Advertisers - Cyble
LunoBotnet: A Self-Healing Linux Botnet with Modular DDoS and Cryptojacking Capabilities - Dr Josh Stroschein
- Pei Han Liao at Fortinet
SEO Poisoning Attack Targets Chinese-Speaking Users with Fake Software Sites - Maurice Fielenbach at Hexastrike
ValleyRAT Exploiting BYOVD to Kill Endpoint Security - Nicole Fishbein at Intezer
Frankenstein Variant of the ToneShell Backdoor Targeting Myanmar - Ferdous Saljooki and Maggie Zirnhelt at Jamf
ChillyHell: A Deep Dive into a Modular macOS Backdoor - Marc Messer and Dave Truman at Kroll
FANCY BEAR GONEPOSTAL – Espionage Tool Provides Backdoor Access to Microsoft Outlook - Sean Shirley at LevelBlue
AsyncRAT in Action: Fileless Malware Techniques and Analysis of a Remote Access Trojan - Palo Alto Networks
- Pulsedive
Thorium 101: Inside CISA’s Open Source Malware Analysis Platform - Ashlee Benge at ReversingLabs
Ransomware 2025: Infostealers on the March - Securelist
Notes of cyber inspector: three clusters of threat in cyberspace - Seqrite
- Shubho57
Analysis of a SuStealer Variant - System Weakness
- ThreatFabric
The Rise of RatOn: From NFC heists to remote control and ATS - Martin Smolár at WeLiveSecurity
Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass - Wordfence
- ZScaler
- Шифровальщики-вымогатели The Digest “Crypto-Ransomware”
Obscura - بانک اطلاعات تهدیدات بدافزاری پادویش
Backdoor.Win32.Remcos
MISCELLANEOUS
- Atola Technology
Capture the Flag: New DFIR Challenges to Improve Your Skills - Belkasoft
Empowering Non-Forensic Experts with Intuitive Tools to Bridge the DFIR Talent Gap - Brett Shavers
DF/IR Isn’t About Computers. It’s About Hunting Humans. - Cellebrite
- The Ultimate Guide to Navigating Incident Response with Digital Forensics Solutions
- Bridging the Gap Between Mobile Data Collection and eDiscovery
- Conquering the Data Frontier of eDiscoveryKey Steps to Set Yourself Up for Success
- From Pocket to Courtroom: The Legal Significance of Mobile Data
- Performing Collection from Mobile Devices in an MDM Environment
- Decrypting a Defense
Surveillance of NYCHA Residents, Facial Recognition False Arrest, Karen Read Trial Evidence, Deleted Messages & More - Josibel Mendoza at DFIR Dominican
DFIR Jobs Update – 09/08/25 - Forensic Focus
- Hannah Bailey, Founder, Blue Light Wellbeing
- GMDSOFT Tech Letter Vol 14. Data Analysis Using WhatsApp Backup Feature
- Halfway Through The S21 Global Alliance Database & Investigator Wellbeing Spotlight Session
- Digital Forensics Round-Up, September 10 2025
- UK Policing On The Edge: Lessons From The 2025 Oscar Kilo Well-Being Survey
- Eric Schoedon – Certified Expert In IT, Automotive Engineering, And Emerging Forensic Technologies
- Detego Global Champions South Wales Police And Falcons Rugby Teams With 2025/26 Sponsorship
- Debbie Garner at Hexordia
A Shift in Strategy: Why Law Enforcement Executives Must Prioritize Digital Forensics Now - Hunt IO
From Malpedia to Metalcore: Daniel Plohmann Talks Malware Research and Music - Magnet Forensics
- Paraben Corporation
The Silent Witness in the Sky: A Deep Dive into Drone Forensics for Criminal Investigations - Salvation DATA
Amcache vs Shimcache: Understanding the Key Differences in Digital Forensics - Antonio Sanz at Security Art Work
¿Quieres aprender DFIR? ¡Practica con CTF! - Shantaciak
Incident Response: Where Cybersecurity Reputation Lives or Dies - Ryan G. Cox at The Cybersec Café
Lack of SOAR and AI Agents isn’t Killing Your SOC. Poor Alerts Are.
SOFTWARE UPDATES
- Digital Sleuth
winfor-salt v2025.10.9 - Metaspike
Forensic Email Collector (FEC) Changelog – 4.2.556.1124 - MISP
MISP 2.5.21 released with a new recorrelate feature, various fixes and updates. - OpenCTI
6.7.19 - Phil Harvey
ExifTool 13.36 (production release) - Xways
X-Ways Forensics 21.6 Beta 3
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 