| Stop scaling headcount. Scale your SecOps. Most security teams don’t have a talent problem, they have a noise problem. Material Security unifies your cloud workspace, providing detection and response across email, files, and accounts. From automating phishing remediation to revoking risky OAuth permissions and auditing file shares, we eliminate manual toil. Stop fighting fragmented consoles. Simplify your workspace security with Material. |
| Sponsored by Material Security |
As always, thanks to those who give a little back for their support!
Forensic Analysis
-
Hal Pomeranz at ‘Righteous IT’
jq For Forensics -
Elizabeth McPherson at Hexordia
The Android Googlfication Spectrum -
Kenneth G. Hartman at Lucid Truth Technologies
How to Authenticate Social Media Evidence: Screenshots Are Not Enough -
Mohit Dhabuwala
The $MFT — the one artifact I check first on every Windows investigation -
North Loop Consulting
Enjoy the Bounty – Proactive Harvesting in Apple Biomes
Threat hunting/threat intelligence
-
Abnormal Security
-
Ilyas Makari at Aikido
GlassWorm goes native: New Zig dropper infects every IDE on your machine -
ASEC
-
Ayelen Torello at AttackIQ
Emulating the Concealed Sinobi Ransomware -
Axel Z at Victory Road
Threat Actors are playing the META -
Jade Brown at Bitdefender
Bitdefender Threat Debrief | April 2026 -
Blackpoint Cyber
Defending What Attackers Already Trust: 2026 Annual Threat Report -
BleepingComputer
-
Brad Duncan at Malware Traffic Analysis
2026-04-06: SmartApeSG activity -
Brian Krebs at ‘Krebs on Security’
-
Daniel Whitcombe, Alex Jones, Joshua Penny, and Nathan Richards at Bridewell
Intelligence Insights: March 2026 -
Censys
Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs -
CERT-AGID
-
Check Point
-
Cisco’s Talos
- The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
- Year in Review: Vulnerabilities old and new and something React2
- New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
- From the field to the report and back again: How incident responders can use the Year in Review
- The threat hunter’s gambit
-
Alberto Giust, Alessandro Strino, and Federico Valentini at Cleafy
Mirax: a new Android RAT turning infected devices into potential residential proxy nodes -
CloudSEK
-
Cofense
-
Christian Feuchter at Compass Security
Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration -
Ctrl-Alt-Intel
Supply-Chain Attacks, TP-Link devices & a pair of socks -
Cybersec Sentinel
BYOVD Ransomware Attacks Now Capable of Defeating Every Major EDR Product -
Disconinja
Weekly Threat Infrastructure Investigation(Week15) -
FalconFeeds
From Shadows to Sanctions: Unmasking 35 Iranian Cyber Operatives Driving State-Sponsored Warfare -
Flare
-
Gambit Security
The AI-Assisted Breach of Mexico’s Government Infrastructure -
Gaetan Ferry at GitGuardian
Renovate & Dependabot: The new Malware Delivery System -
GreyNoise
-
Anastasia Tikhonova at Group-IB
Cyber Saga: In the Footsteps of the DPRK IT Workers -
Grumpy Goose Labs
Threat Detection Engineering: Precision & Recall -
Hunt IO
Canis C2 Exposed: Previously Undocumented Cross-Platform Surveillance Framework Targeting Japan -
Huntress
-
Infoblox
-
Bert-Jan Pals at KQL Query
Unlock Different Security Perspectives with Kusto Graph Functions -
LayerX
-
Lookout Threat Lab
Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire Operation Linke | Threat Intel -
Microsoft Security
- Inside an AI‑enabled device code phishing campaign
- Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations
- SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
- Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk
- The agentic SOC—Rethinking SecOps for the next decade
- Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees
- Inside an AI‑enabled device code phishing campaign
-
Maretta Morovitz at MITRE Engage™
From Idea to Capability: Making Living Off the Land Repeatable -
Natto Thoughts
Cybersecurity Strategy in China’s 15th Five-Year Plan -
NCSC
APT28 exploit routers to enable DNS hijacking operations -
Eric Brown at Nebulock
Hunt Mode: Supply Chain Compromises LiteLLM & Axios -
Nik Alleyne at ‘Security Nik’
-
Carina Schwabe at NVISO Labs
Security’s Blind Spot: Physical Keyloggers That Bypass Antivirus Entirely -
Jeremy Kirk and Mathew Woodyard at Okta
BreachForums logs reveal anonymizers of choice for shady characters -
Oleg Skulkin at ‘Know Your Adversary’
386. Ransomware Affiliates Abuse Bandizip for Data Collection -
OpenSourceMalware
Velora (formerly ParaSwap) SDK Version 9.4.1 Compromised And Installing Malware -
Eyal Rafian and Bill Batchelor at Palo Alto Networks
Understanding Current Threats to Kubernetes Environments -
Eric Carey, Olivia Henderson, and Noah Hemker at Rapid7
FortiGate CVE-2025-59718 Exploitation: Incident Response Findings -
Robin Dost at Synaptic Systems
Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer -
SANS Internet Storm Center
- How often are redirects used in phishing in 2026?, (Mon, Apr 6th)
- A Little Bit Pivoting: What Web Shells are Attackers Looking for?, (Tue, Apr 7th)
- Number Usage in Passwords: Take Two, (Thu, Apr 9th)
- TeamPCP Supply Chain Campaign: Update 007 – Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory, (Wed, Apr 8th)
- More Honeypot Fingerprinting Scans, (Wed, Apr 8th)
- Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
-
Sansec
-
Securelist
-
Security Alliance
Advisory on DPRK (UNC1069) Fake Microsoft Teams and Zoom calls -
Sekoia
EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud – Part 2 -
SentinelOne
Edge Decay: How a Failing Perimeter Is Fueling Modern Intrusions -
Kartikkumar Jivani at Seqrite
Advisory: Middle East Conflict & Cyber Escalation -
Siddhant Mishra
When the Tool Is the Weapon: Security Lessons from Agent Skills -
Socket
-
SOCRadar
Dark Web Profile: TeamPCP -
Step Security
@velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence -
Manish Rawat at System Weakness
Hunting APT29 Part 3: I Traced the Process Tree Back to the Beginning -
Tenable
What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure -
The Hunter’s Ledger
-
Mohideen Abdul Khader F at Trellix
Masjesu Rising: The Commercial IoT Botnet Built for Stealth, DDoS, and IoT Evasion -
Trend Micro
-
TrustedSec
-
Wiz
Cloud Threats Retrospective 2026: What AI Changed (and What It Didn’t) -
Блог Solar 4RAYS
Мертвые души в инфраструктуре — атака Shedding Zmiy на здравоохранение
Upcoming events/webinars
-
ADF Solutions
-
Arctic Wolf
止まらないランサムウェア被害 – Qilinの事案から読み解く、検知、対応と経営判断 -
Black Hills Information Security
BHIS – Talkin’ Bout [infosec] News 2026-04-13 -
Cellebrite
Advancing Digital Access: Unlock Capabilities & Roadmap for Belgian Law Enforcement -
Amy Ciminnisi at Cisco’s Talos
Talos Takes: 2025’s ransomware trends and zombie vulnerabilities -
Huntress
Tradecraft Tuesday | npm install axios: Software Supply Chain Threats -
Magnet Forensics
-
Emma Burdett at Rapid7
A First Look at Our Speaker Lineup and Agenda for the Rapid7 2026 Global Cybersecurity Summit -
Sandfly Security
Agentless Linux EDR for Government and Critical Infrastructure -
Sygnia
A Tale of Two Incidents: Same Threat Actor, Different Outcomes
Presentations/podcasts
-
Adversary Universe Podcast
Hunting Supply Chain Attacks with Jared Myers, Director, CrowdStrike OverWatch -
Archan Choudhury at BlackPerl
BlackPerl Certified Advanced Defender V2 -
Black Hills Information Security
BHIS – Talkin’ Bout [infosec] News 2026-04-06 -
Cellebrite
Tip Tuesday: Data Interpreter -
Hazel Burton at Cisco’s Talos
[Video] The TTP Ep. 22: The Collapse of the Patch Window -
Cloud Security Podcast by Google
-
CQURE Academy
CQURE Hacks #77: From SQL Login to Full System Compromise -
Dr Josh Stroschein
01 – The Build Environment, Required Tools, and Series Resources -
Endace
- Webinar: Why are APTs so hard to Find, Investigate and Resolve?
- What’s hiding in your DNS and other traffic?
- Secure Networks Ep 31 – The Packet Forensics Files – Kamal Khlefat, LinkShadow
- Don’t be the Next Target – how to prepare for the next supply chain attack
- Introducing EndaceProbe Cloud
- The Packet Forensic Files, Ep 65 with Andrew Cook, CTO Recon Infosec, on SecOps and Threat Hunting.
- Building Cyber Investigation Skills with Immersive and Endace’s Always-on Packet Capture
- Integrating Always-On Packet Capture with Google SecOps
-
FBI
Ahead of the Threat Podcast: Season 2, Episode 5 — Joe Levy -
Huntress
-
InfoSec_Bret
IR -SOC281 – System Network Configuration Discovery Detected -
Jai Minton at Breach Log
Ep4: Think Twice Before You Fix It with Cameron -
Adam Goss at Kraven Security
Threat Profile: Scattered Spider -
Magnet Forensics
-
Microsoft Threat Intelligence Podcast
Ransomware: From Isolated Attacks to Global Criminal Ecosystem -
Monolith Forensics
-
MSAB
#MSABMonday – CTF Q&A Part 3 | Advancing Your Investigative Workflow -
MyDFIR
How to Actually Use MITRE ATT&CK as a Beginner (Not Just Memorize It) -
Parsing the Truth: One Byte at a Time
Karen Read: Special Guest Ian Whiffin -
Sumuri
-
Team Cymru
-
Three Buddy Problem
The Claude Mythos, Project Glasswing Shockwave
Malware analysis
-
Bob Rudis
[un]prompted Spring 2026: Threat Hunting In The Matrix -
Darktrace
New Chaos Malware Variant found Exploiting Misconfigurations in the Cloud -
Esentire
STX RAT: A new RAT in 2026 with Infostealer Capabilities -
Vojtěch Krejsa and Jan Rubín at Gen
Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer -
Howler Cell
-
Evgen Blohm at InfoGuard Labs
Slithering Through the Noise – Deep Dive into the VIPERTUNNEL Python Backdoor -
Andrey Pautov at InfoSec Write-ups
Android APK Analysis Tool: AI-Powered Static Malware Analysis in Your Terminal -
Jamf
-
Jason Reaves at Walmart
-
Joe T. Sylve, Ph.D.
ida-mcp 2.1: Progressive Tool Discovery, Background Analysis, and Batch Operations -
LevelBlue SpiderLabs
-
Moonlock
Notorious hacker returns with a new Mac stealer targeting $10K+ crypto wallets -
Jan Michael Alcantara at Netskope
From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel -
Zhassulan Zhussupov
MacOS malware persistence 9: emond (The Event Monitor Daemon). Simple C example -
ZScaler
Miscellaneous
-
Jason Garman and Vaishnav Murthy at AWS Security
A framework for securely collecting forensic artifacts into S3 buckets -
Belkasoft
Automatic Speech Recognition in DFIR Investigations -
Brian Maloney
Creating a Fuji/WinFE external drive -
Brian Carrier at Cyber Triage
How to Let AI Access Your DFIR and SOC Investigation Data -
Decrypting a Defense
Age Verification Laws, Buying Data to Violate Your Rights, ID Case and Facial Recognition, Tracking Down Phone Callers & More -
Fabian Mendoza at DFIR Dominican
DFIR Jobs Update – 04/06/26 -
Forensic Focus
- GMDSOFT Tech Letter Vol.20 – Health App Data Analysis
- Making The Case For Triage: Transforming Your Digital Forensics For Smarter Investigations
- Digital Forensics Round-Up, April 08 2026
- Cellebrite Spring Release: New Industry-Leading Device Access And Multi-Cloud Expansion
- DFIR Backlogs, Burnout And Cognitive Fatigue: The Silent Operational Risk
-
Horizon3
Incident Response Remediation: How to Eliminate Attack Paths After a Breach -
Invictus Incident Response
SaaS Security Risks: Defending Against OAuth Abuse & Shadow -
Magnet Forensics
-
Malfind Labs
Testing local LLMs: Qwen 3.5 vs. PowerShell Obfuscation
Software releases/updates
-
AppliedIR
Valhuntir v0.6.0 -
Arkime
v6.1.1 -
Darksp33d
HyperHives macOS Infostealer — Full Technical Analysis -
Digital Sleuth
winfor-salt v2026.6.7 -
GCHQ
CyberChef v10.23.0 -
IntelOwl
v6.6.0 -
MobilEdit
-
Obsidian Forensics
unfurl v2026.04 -
Open Source DFIR
Plaso 20260119 released -
OpenCTI
-
Phil Harvey
ExifTool 13.55 (production release) -
Rapid7
-
Security Onion
Security Onion 2.4.211 Hotfix 20260407 Now Available! -
Toño Diaz
masstin v0.11.0 -
Xways
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!