Forensic Analysis

• Brian Carrier at Cyber Triage
  DFIR+AI Primer: How to Combat Hallucinations

• Django Faiola at ‘Appunti di Informatica Forense’
  iOS Foursquare Swarm – Digging Deeper: New Artifacts Unearthed

• Oleg Afonin at Elcomsoft
  Downloading iPhone and iPad backups from Apple iCloud

• Bas van den Berg at Eye Research
  Breaking encryption schemes the lazy way

• North Loop Consulting
  NLC Spectator

Threat hunting/threat intelligence

• ASEC

  • April 2026 Threat Trend Report on APT Attacks (South Korea)
  • Don’t trust ‘secure mail’! malicious Files Impersonating Credit Card Companies Are Being Distributed

• Brian Krebs at ‘Krebs on Security’
  Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks

• Censys
  MCP Servers on the Internet

• CERT-AGID

  • Nuove campagne di phishing a tema SEND
  • Sintesi riepilogativa delle campagne malevole nella settimana del 23 – 29 maggio

• Check Point

  • 25th May – Threat Intelligence Report
  • AI Threat Landscape Digest March-April 2026

• CISA
  Supply Chain Compromises Impact Nx Console and GitHub Repositories

• David J. Bianco at Cisco’s Talos
  Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake

• Emanuel Duss at Compass Security
  SSH Labs

• CrowdStrike
  Disrupting Glassworm: Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

• Crowdstrike
  Disrupting Glassworm: Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

• CTF导航

  • APT组织UNG0002对中国高校发动精准钓鱼攻击
  • AI开发工具链遭SEO精准围猎：针对Claude/Gemini开发者的供应链投毒
  • Living Off the Land Agent – 中转站与Agent 武器化

• Cybersec Sentinel
  TrapDoor Targets 34 Packages Across npm, PyPI and Crates.io to Steal Crypto Keys and Poison AI Assistants

• Cyfirma
  Weekly Intelligence Report – 29 May 2026

• Andrea Draghetti at D3Lab
  B1ack’s Stash Releases 4.6 Million Payment Cards: Web Skimming Leak Analysis

• Ryan Simon at Datadog Security Labs
  From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents

• Detect FYI

  • Use of AI Agents to enrich and generate TI Feeds based on Security News and Reports ( + KQL Query)
  • Hunt Before They Hide -From Device Codes to Fake IT Support Detecting Active Microsoft 365 Identity…
  • The AI-Embedded SOC: An Operating Model for the Asymmetry Era

• Disconinja
  Weekly Threat Infrastructure Investigation(Week22)

• Elastic Security Labs
  Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace

• Esentire
  Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT

• FalconFeeds

  • THE GENTLEMEN: Inside the Russia-Linked Ransomware Operation Rapidly Reshaping the RaaS Ecosystem
  • Shai-Hulud: From npm Worm to Cross-Ecosystem Supply Chain Threat
  • SideWinder: The India-Linked APT Expanding from South Asia to Global Strategic Infrastructure
  • Semiconductor Sanctions & the Cyber Espionage Nexus: How Export Controls Are Reshaping Global Cyber Conflict

• Flashpoint
  Understanding Illicit Ecosystems: The Hybrid Threat of “The Com”

• Luis Corrons and Martin Chlumecký at Gen
  When Hotel Scams Know Your Booking: 350 Compromised Accommodations Across 50 Countries

• Dwayne McDaniel at GitGuardian
  Initial Access Changed, The Attack Path Did Not: Findings From The Verizon 2026 DBIR

• Google Cloud Threat Intelligence

  • Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
  • 2 PhaaS 2 Furious: The Evolution of Chinese-language Phishing Services

• Yuan Huang and Kuvonchbek Yorkulov at Group-IB
  The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament

• Kenneth Yeung at Hidden Layer
  Inside the Prompt: How LLMs Learn Roles, Follow Instructions, and Get Exploited

• Reegun Jayapaul and Sheik Mohamed at Howler Cell
  Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer

• Hunt IO
  Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms Targeted

• Huntress

  • From Cookies to Keys: The Threat of Session Hijacking
  • Your Profile Is a Dossier. Here’s Who’s Reading It.

• IC3
  Silent Ransom Group Impersonating IT Personnel through Social Engineering

• InfoSec Write-ups

  • Extending Wazuh detection capabilities with clickdetect, Opensearch PPL and Sigma Rules
  • How to Detect Data Exfiltration with Elastic SIEM: SOC Analyst Hands-On Lab | Hunt Forward Lab #007
  • SantaStealer Emerges as Advanced MaaS Infostealer Targeting Credentials, Crypto Wallets, and…

• Intel 471
  What CISOs want from Cyber Threat Intelligence

• David Sardinha at Intrinsec
  Pivoting on a malspam infrastructure delivering JS malware backed by bulletproof networks

• Bert-Jan Pals at KQL Query
  EDR Incident Response Playbook: Containing Local Account Incidents

• Lares
  The Lowdown on Lateral Movement

• Maor Gabay at LevelBlue SpiderLabs
  Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign

• Matt Suiche

  • Supply-Chain Attacks Cluster: 230,000 Advisories, Five Patterns
  • autoextdetector: A Self-Improving Detection Agent for Supply-Chain Attacks
  • Building autoextdetector: A Loop-Driven Framework for Supply-Chain Detection

• Microsoft Security

  • From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
  • Typosquatted npm packages used to steal cloud and CI/CD secrets
  • The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
  • Malicious npm packages abuse dependency confusion to profile developer environments

• Oleg Skulkin at ‘Know Your Adversary’

  • 394. Hunting for PySoxy: Another Tool Delivered via ClickFix
  • 395. Using Folders Associated with Cloud Atlas for Threat Hunting

• Moshe Siman Tov Bustan and Nir Zadok at OX Security
  Malware-Slop: New Malicious npm Package Leaks Its Own GitHub Private Token

• Matt Brady and Justin Moore at Palo Alto Networks
  Out of the Crypt: The Evolving Cyber Extortion Economy

• Andi Ahmeti at Permiso
  ChatGPhish: The Page Is the Payload

• Proofpoint
  More CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild

• Keanu Maharaj at Push Security
  LLMShare: using shared chatbot pages to distribute malware

• Red Canary

  • Intelligence Insights: May 2026
  • Investigating suspicious AI workflows in Microsoft Entra Agent ID: Autonomous agents

• Robin Dost at Synaptic Systems
  IIM Feed: Attack Pattern Mapping for Adversary Infrastructure (5/7)

• SANS Internet Storm Center

  • TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)
  • TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)
  • Wireshark 4.6.6 Released, (Sun, May 24th)
  • Possible ACR Stealer From Page Impersonating Claude, (Tue, May 26th)
  • Microsoft Access VBA, (Mon, May 25th)
  • Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs, (Wed, May 27th)
  • Analysis of a Year of Files Uploaded to DShield Sensors, (Wed, May 27th)

• Silent Push

  • Preemptive Cyber Defense Blueprint for Incident Response Teams
  • Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

• Socket

  • TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io
  • Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrate Banking Certificates and Passwords

• SOCRadar
  Dark Web Profile: CoinbaseCartel

• Marco A. De Felice aka amvinfe at SuspectFile
  Universitat de València Targeted by Nova Group: 300GB Data Exfiltration Claimed, Initial $500,000 Ransom Demand Revealed

• Michael Clark at Sysdig
  AI agent at the wheel: How an attacker used LLMs to move from a CVE to an internal database in 4 pivots

• Ron Popov at Tenable
  Download pumping: New npm deception technique for supply chain attacks

• Josh Rykowski at Todyl
  Kali365 PhaaS: Inside the Attack Infrastructure

• Trend Micro

  • Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet
  • Pwning Agentic AI Part I: Your AI Agent Is Already Compromised
  • Hunt Them All: An AI-Powered Vulnerability Sweep of 19,000 MCP Servers

• Jean-Francois Gobin at Truesec
  Installation of a Syslog Log Collector

• WeLiveSecurity

  • BTMOB: A stealthy RAT burrowing deep into Android devices
  • ESET APT Activity Report Q4 2025–Q1 2026

• Shira Ayal, Eden Abergil, Andre Maccarone, Yuval Dan, and Benjamin Read at Wiz
  Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry’s Software Development Infrastructure

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security

  • BHIS – Talkin’ Bout [infosec] News 2026-06-01
  • Why You Should Care About SQL Injections in 2026 w/ Fernando Panizza

• Cellebrite
  Meet Cellebrite Genesis: From Digital Overload to Investigative Clarity

• Magnet Forensics

  • Cyber Unpacked S3:E3 // The burnout equation: Sustaining your SOC and IR teams for the long game
  • Drowning in data…Practical cloud storage and data migration strategies

Presentations/podcasts

• Hexordia
  Truth in Data: S2E9: Beyond the Button: Writing Forensic Reports That Hold Up in Court

• Richard Frawley at ADF Solutions
  Triage Smarter, Not Harder: Leveraging the Uniqueness in Your Case for Optimal Results

• Alexis Brignoni
  Build chat conversations in LAVA

• Amped
  Deepfake Forensics Workflow for Image Analysis

• Cellebrite
  Tip Tuesday: Using Cellebrite Genesis

• Cloud Security Podcast by Google
  EP279 Native Cloud Security: Is ‘Good Enough’ Actually Winning?

• Cyber Secrets

  • Video Capture and Analysis using the CSI Linux Case Management System
  • IP Address Analysis with the CSI Linux Case Management System

• Dr Josh Stroschein
  [Workshop] Symbol Renaming & Namespace Flattening

• Endace
  Secure Networks, Ep 66 with IR practioner Cody Spooner, Principal Sales Engineer, Corelight

• Gerald Auger at Simply Cyber
  What Separates Good SOC Analysts From Great Ones

• InfoSec_Bret
  IR -SOC281 – System Network Configuration Discovery Detected

• John Hammond

  • Payload Podcast 007 with Andy Piazza (klrgrz)
  • Google served me Malware

• Magnet Forensics
  Mobile Unpacked S4:E5 // Millings on Modes – Exploring the other Modes of iOS and Android

• Matthew Plascencia
  How to Find and Access Linux Logs | Linux Forensics

• Monolith Forensics

  • Filters and Data Search in Monolith Forensics – Monolith Mondays
  • Monolith UI – Tables

• MSAB

  • #MSABMonday – XRY New Installers.
  • Forensic Fix Episode 27

• MyDFIR

  • How to Use AI as a SOC Analyst (Without Destroying Your Career)
  • Cornelius’s Story: Inside the MYDFIR Forge

• Off By One Security
  AI Agents as Confused Deputies with Niki Aimable Niyikiza

• OpenSourceMalware
  OpenSourceMalware Show Episode #4 – May 5, 2026

• Parsing The Truth: One Byte at a Time Podcast
  S2 E2: Digital Forensics Now Cross Over Event

• Proofpoint
  “Always Intentional”: A CISO’s Pragmatic Take on the Agentic Era

• SANS
  Still Getting Cloud Wrong. Here’s what to Fix. With Simon Vernon

• SANS Cyber Defense

  • AI Agents: I Get By With a Little Help from My Tools
  • Detecting Malware via HTTPS Analysis

• Sumuri
  How to use Global Timeline | RECON ITR Deep Dive

• THE Security Insights Show
  The Security Insights Show Episode 292 – Sentinel Graph and data lake

• The Weekly Purple Team
  Herding Katz to Steal Creds

• Three Buddy Problem

  • Federico Kirschbaum on XBOW, AI Hackers, and the Future of Pen Testing
  • Jordan Wiens on AI, Offense vs. Defense, and the Dying CTF Pipeline
  • Perri Adams on Proof Engines, LLMs, and the New Era of Verifiable Code
  • Find 50,000 Bugs, Fix Zero: Gabriel Bernadett-Shapiro on the AI Vuln Trap
  • Aaron Portnoy on Pwn2Own, the End of Easy Bugs, and AI-Fueled Offense
  • Microsoft Threatens Vuln Researchers; Shadow Brokers Revisited

Malware analysis

• Cyble
  OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight

• Dark Atlas
  Behind .payload: In-Depth Technical Analysis of Payload Ransomware

• Darktrace
  Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

• Xiaopeng Zhang at Fortinet
  Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

• John Dador & Mathew Dela Cruz at G Data Software
  Deceptively Sweet: DonutLoader Reloaded in a modern Remcos RAT Infection

• Harsh Gupta at K7 Labs
  RVTools Masquerade: How a Signed Fake Installer Deploys a Modular Python RAT  

• Manasi Joshi at Paraben Corporation
  Behind the Scenes of ClickFix: Blockchain-Based Dead Drop C2 Resolver

• Profero
  The War Between Wars: How an IRGC Cyber Front Runs Destructive OT and IT Attacks Under Cover of a Ceasefire

• Pulsedive
  SolyxImmortal – Analysis of a Python-based Information Stealer

• Robert Simmons at ReversingLabs
  Researcher’s Notebook: Hunting Megalodon Fossils

• Diyar Saadi at Secjuice
  Malware Analysis: Is It About Tools or Mindset?

• Konstantin Krasilnikov, Valery Akulenko, and Artem Snegirev at Securelist
  Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years

• Seqrite

  • Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan
  • Operation Dragon Weave : Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2

• Shubho57
  Analysis of Pay2Key Ransomware

• Zhassulan Zhussupov

  • Malware shellcode delivery via signal – part 1. FSK Basics. Simple python script
  • Malware shellcode delivery via signal – part 2. The Linux receiver (Goertzel Algorithm). Simple C example
  • Malware shellcode delivery via signal – part 3. Fix straddling, ALSA buffer overrun, and sub-bit alignment. Simple python and C examples

Miscellaneous

• Abdul Mhanni
  Implementing Impacket’s Newest Protocol: MS-RAA

• Brett Shavers
  Don’t Marry the Suspect

• BushidoToken
  UK Cybercrime Journal: £102 million Lost to Scams in 2025

• Cellebrite
  The Access Gap Is Closed: What Cellebrite Can Unlock in 2026

• Dr. Neal Krawetz at ‘The Hacker Factor Blog’
  SEAL Unbundled

• Florian Roth
  Why I Built My Own LLM Benchmark for THOR Finding Triage

• Forensic Focus

  • Advanced SQLite Queries: Free On-Demand Course From Belkasoft
  • Digital Forensics Round-Up, May 27 2026
  • From Seizure To Investigation In Minutes: What’s New In ADF Pro v6.3
  • When Familiar Tools Fail, MSAB XRY Pro Gets The Data

• Kevin Beaumont at DoublePulsar
  Microsoft’s stance on zero day exploits is a dumpster fire of their own making

• Magnet Forensics

  • The scariest sentence you’ll ever hear in a digital forensics lab
  • Tackling deepfakes: Let’s focus on authentication, not detection
  • What is SOCMINT? Social media intelligence in investigations

• OSINT Team
  I Built an AI SOC Analyst in n8n That Triages Wazuh Alerts For Me — Here’s Every Node, Explained

• Rob T. Lee
  The Glasswing numbers should change what you do this week, not how well you sleep.

• Salvation DATA
  SSD Data Recovery: Why SSD Recovery Is Harder Than HDD

• Security Onion
  Security Onion Documentation Printed Book Now Updated for Security Onion 3.1!

• Steve Whalen at Sumuri
  Apple Never Published the Full APFS Spec

• Ryan G. Cox at The Cybersec Café
  The Skill Stack of a Detection & Response Engineer

• Valdin
  Validin Python SDK for Threat Monitoring

Software releases/updates

• Alexis Brignoni

  • ALEAPP v3.6.0
  • iLEAPP v2.5.0

• Apache
  26 May 2026: Apache Tika Release 3.3.1

• Arsenal
  Hibernation Recon Changelog v1.2.3.96

• Belkasoft
  Meet Belkasoft X v2.11! This release brings AI-powered topic detection, extended acquisition coverage, deeper artifact extraction across platforms, and a range of powerful improvements.

• Canadian Centre for Cyber Security
  Assemblyline v4.7.4.stable3

• Datadog Security Labs
  GuardDog Release v3.0.0a1

• Digital Sleuth
  winfor-salt v2026.9.4

• Doug Burks
  ohmypcap v4.0.0

• Elcomsoft
  Elcomsoft Phone Breaker 11.1: reliable iCloud backup extraction

• Erik Hjelmvik at Netresec
  CapLoader 2.1.0 Released

• Hasherezade
  tiny_tracer 4.0

• LEAPPs Org
  LAVA v0.13.0

• MISP
  MISP 2.5.38 – UI and security update

• OpenCTI
  7.260529.0

• Phil Harvey
  ExifTool 13.59

• Security Onion
  Security Onion 3.1.0 Hotfix 20260528 Now Available!

• Xways
  X-Ways Forensics 21.8 SR-1