Forensic Analysis

• Christopher Eng at Ogmini

  • Examining Tailscale Artifacts – Part 7
  • Tailscale Security Bulletin (TS-2026-009) and Detection

• Dr. Brian Carrier at Cyber Triage
  SANS vs SKL DFIR AI Frameworks: When to Use Each

• Elcomsoft

  • A12 usbliter8 BootROM sigpatches
  • Two-Factor Authentication and iCloud: A Short History, and What We Fixed in Phone Breaker 11.03
  • The Long, Strange History of PDF (In)Security – And the Arrest That Made It Personal

• Forensafe
  Android Google Pay Account

• LEAPPs Blog

  • Spotting AI Generated Images in iLEAPP and ALEAPP
  • A Trip Through the United iOS App

• Magnet Forensics
  Introducing Time-Based Metadata: Unlocking a new layer of data in media forensics

• Tim Korver at ‘Thesis Friday’
  Thesis Friday #21: Why a single artifact never tells the whole story

Threat hunting/threat intelligence

• Amnesty International Security Lab
  Inside Pegasus: The evolution of the world’s most notorious spyware system

• Any.Run

  • ​​Kratos PhaaS Targets US and EU Companies: How to Reduce Microsoft 365 Account Takeover Risk​
  • Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware 

• Arctic Wolf
  Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer

• ASEC

  • June 2026 Threat Trend Report on APT Groups
  • June 2026 Infostealer Trend Report
  • Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers via Malware Distribution via Network Transmission
  • Not Every Fox is Silver: Inside an AtlasRAT loader chain

• Francis Guibernau at AttackIQ
  Response to CISA Advisory (AA26-194A): Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

• Christine Barry at Barracuda
  None and done? kittykatkrew’s short-lived ransomware play

• Eric J. Taylor at Barricade Cyber Solutions
  CTI Report: BRG-26182 Chains a Fake Human-Check to Microsoft 365 AiTM Session Theft

• Ben Bornholm at HoldMyBeer
  Hunting malware and malicious MCPs in memory on Kubernetes with FleetDM + Osquery + YARA

• BI.Zone
  Leveraging cyber intelligence for threat detection

• Bitdefender

  • Bitdefender Threat Debrief
  • Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR

• Brad Duncan at Malware Traffic Analysis
  2026-05-27: SmartApeSG ClickFix –> Unidentified RAT –> NetSupport RAT

• Brian Krebs at ‘Krebs on Security’

  • Lessons Learned from CISA’s Recent GitHub Leak
  • Microsoft Patches a Record 570 Security Flaws

• Bridewell
  From a Fake IT Ticket to Scattered Spider: Inside a Com-Affiliated Vishing Campaign

• BushidoToken
  UK Cybercrime Journal: University of Nottingham Breached by ShinyHunters

• Censys
  Inside Russia’s Camera-Hacking Espionage Campaign

• CERT Ukraine
  Вектори первинної компрометації UAC-0145 станом на липень 2026 року

• CERT-AGID

  • Sintesi riepilogativa delle campagne malevole nella settimana del 11 – 17 luglio
  • Wp2shell: Vulnerabilità critiche nel core di WordPress. Necessario aggiornare i sistemi

• Check Point

  • 13th July – Threat Intelligence Report
  • AI Security Report 2026

• CISA

  • Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting
  • CISA Urges SharePoint Hardening After New Exploitations

• Cisco’s Talos

  • The serpent’s tongue: Luring the Python out of its den
  • UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
  • The Hunter’s Paradox: Is it time to embrace automated threat hunting?

• Marie Mamaril at Cofense
  When Routine Becomes the Threat: The Evolution of Finance-Themed Phishing

• Ctrl-Alt-Intel
  Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links

• Cyb3rhawk
  Part 1: Measuring LLM Breach Hunters; Sharing, Provenance, and Blind Spots

• Cyfirma
  Weekly Intelligence Report – 17 Jul 2026

• Christophe Tafani-Dereeper, Sebastian Obregoso, and Eslam Salem at Datadog Security Labs
  Compromised AsyncAPI packages on npm deliver malware

• Rohitashokgowd at Detect FYI
  You Assume Your Logs Are Flowing.

• Disconinja

  • Weekly Threat Infrastructure Investigation(Week28)
  • Weekly Threat Infrastructure Investigation(Week25~27)
  • Weekly Threat Infrastructure Investigation(Week29)

• Elastic Security Labs

  • TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
  • New North Korean campaign uses fake coding interviews to steal developer credentials

• Aaron Walton at Expel
  Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

• Oleg Lypko at Flare
  Arrest and Sentencing Disparities Across Russian-Speaking Threat Actors

• Flashpoint

  • Understanding Illicit Ecosystems: How Dark Web Forums Structure Cybercrime
  • Inside Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer

• Sai Molige at Forescout
  SeasonalInvite: New Phishing Campaign Abuses eCards and RMM

• Gen
  Threat Report H1 2026

• Google Cloud Threat Intelligence

  • The Risk of Exposed Cloud Functions and How to Harden
  • Demystifying AI Exploits: A Blueprint for AI-Assisted Vulnerability Management

• Group-IB

  • Inside the Matching Engine: How Distributed Tokenization Identifies Compromised Cards Without Exposing Them
  • The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets
  • ClickLock Stealer: Paste Once, Lose Everything

• Hornet Security
  Kali365-Gerätecode-Phishing verwandelt einen Zahlungsköder in den Diebstahl von Microsoft-365-Tokens

• Reegun Jayapaul, Rahul Ramesh, and Baskar M at Howler Cell
  DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel

• Hugging Face
  Security incident disclosure — July 2026

• Hunt IO
  Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries

• Harlan Carvey and Lindsey O’Donnell-Welch at Huntress
  Threat Actors Achieve Persistence After SQL Injection

• Tom Kopchak at Hurricane Labs
  The DOJ Just Proved that Windows is Spying on You

• InfoSec Write-ups

  • Decoding the Obfuscated Layer: A Playbook Walkthrough of Command-Line Forensics
  • Device Code Phishing: How Attackers Abuse Microsoft’s Legitimate Authentication Page Without…

• Intel 471

  • Threat Hunting Case Study: Scattered Spider
  • Emerging Threat: QuimaRAT
  • Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials
  • Scattered Spider duo sentenced to prison over TfL hack

• Yuma Masubuchi at JPCERT/CC
  Update on Attacks by Threat Group APT-C-60 in 2026

• LevelBlue SpiderLabs

  • Mitigating New Vulnerabilities with owLSM
  • ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites
  • Still Circling: Blind Eagle’s Toolkit Keeps Evolving

• Microsoft Security

  • Defending SaaS-based applications against ShinyHunters OAuth abuse
  • Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
  • Turning threat intelligence into decisive action with Defender Experts
  • ACR Stealer: Two observed intrusion chains amid increased threat activity

• Ariel Parnes at Mitiga
  The Logs We’ve Never Had: J-Space and the Next Layer of Detection

• Moonlock Lab Team at Moonlock
  Moonlock’s mid-2026 macOS threat report

• Eugenio Benincasa at Natto Thoughts
  China’s Cybersecurity Powerhouses Face PLA Procurement Curbs

• Stephanie Kirmer at Nebulock
  Classical ML for threat hunting, not just an LLM

• Yuki Umemura at Nicter
  7-Zip攻撃キャンペーンのインフラ調査によるドメインの発見

• NSB Cyber
  #NSBCS.133 – Who Did It? The Cost of Getting Ransomware Attribution Wrong

• Brett Winterford at Okta
  How to stop attackers from self-serving their way into accounts

• Oleg Skulkin at ‘Know Your Adversary’

  • 401. Threat Actors Abuse Browser Kiosk Mode to Distract Victims
  • 402. Adversaries Keep Actively Using the EtherHiding Technique

• OpenSourceMalware

  • PolinRider Confirmed Footprint Grows 6.5x Since March
  • ChainVeil and ViteVenom are DPRK’s PolinRider Campaign

• Palo Alto Networks

  • AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report
  • Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

• Benjamin Adolphi at Promon
  App Threat Report Q2 2026: Coretax Android Banking Malware

• Rachel Rabin at Proofpoint
  OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration

• Pulsedive
  Blind Spots in the Build: A Supply Chain & SBOM Security Primer

• Qi’anxin X Lab
  NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era

• Jan Blažek at Rapid7
  Investigating Persistence Mechanisms in AWS

• ReliaQuest

  • The Jalisco Toolkit and AI-Powered Phishing Surge
  • Ransomware and Cyber Extortion in Q2 2026

• Resecurity
  From Web Request to Domain Compromise: Understanding the July 2026 SharePoint Attacks

• Ridgeline Cyber
  Your Sigma Rule Converts Cleanly and Still Never Fires. Here’s the Test That Catches It.

• SANS Internet Storm Center

  • Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th)
  • Microsoft Patch Tuesday July 2026 – The AI Acopolypse is Here , (Tue, Jul 14th)
  • Recent DShield SIEM Update, (Tue, Jul 14th)

• Securelist

  • OkoBot: new sophisticated malware framework targets cryptocurrency users
  • GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
  • HelloNet campaign — new malicious modules launched through the ViPNet update system

• Marco Pedrinazzi at SecurityBreak
  The Payload Is in the Header

• Sarah Gooding at Socket
  Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping

• SOCRadar
  Dark Web Profile: Krybit Ransomware

• Sophos
  The State of Ransomware 2026: Payments are dropping but encryption is climbing

• Sujay Adkesar
  Prefetch Alternate Data Stream How Malware Hides Execution

• Marco A. De Felice aka amvinfe at SuspectFile
  Hyflock and Nova: A Private Conversation Provides a Glimpse into Ransomware Group Dynamics

• Sygnia
  Ransomware Incident Response in 2026: What Has Changed and What CISOs Are Still Getting Wrong

• Symantec Enterprise

  • Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
  • Spirals: New Stealthy Ransomware Deployed Against Asian IT Company

• Sysdig
  No single pane of glass: Anatomy of an Azure permission takeover

• Nchiminyi Jezreel at System Weakness
  What Your PHP Logs Actually Look Like During an SQL Injection Attack

• The Raven File
  KUDANKULAM NUCLEAR POWER PLANT LEAK: AN ACCIDENTAL DISCLOSURE

• James McMurry at ThreatHunter AI
  July 2026 Patch Tuesday: 570 Patches, and the One That Matters Is Rated Moderate

• Joseph C Chen, Philippe Lin, Lucas Silva, Vladimir Kropotov, and Fyodor Yarochkin at Trend Micro
  Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet

• Justin Mahon at TrustedSec
  Pandora’s Container Part 1: Unpacking Azure Container Security

• Sean Koessel and Steven Adair at Volexity
  Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

• Martin Smolár at WeLiveSecurity
  Forgotten UEFI shims undermining Secure Boot

• Rami McCarthy and Merav Bar at Wiz
  M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

• Kim Zetter at Zero Day
  Tracking Peter Stokes and The Com: Allison Nixon and Her Work Unmasking Cybercriminals

• Ruchna Nigam at ZScaler
  ClaudeFix: Shared Claude Chats Meet ClickFix

• Блог Solar 4RAYS

  • По README встречают, по малвари провожают: как распознать фейковый репозиторий за 10 секунд
  • Пивотинг без регистрации и СМС: ищем инфраструктуру по открытым источникам

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-07-13

• Cellebrite
  Genesis Live: Clear the Backlog, Find the Lead

• Eclypsium
  Living on the Edge: How Threat Actors Use Network Infrastructure Against You

• Huntress

  • _declassified | Know Your Adversary: Counter Operations that Wreck Global Cybercrime
  • Community Fireside Chat | A Real Incident Walkthrough and the “Breach Coach” Playbook

• John Hammond
  Payload Podcast 009 – Steven Flores

Presentations/podcasts

• ADF Solutions
  Maximizing Efficiency with Preview Mode: A Guide for Digital Forensics Professionals

• Behind the Binary by Google Cloud Security
  EP27 The Challenges of Reversing Modern Languages: From C++ to Go and Rust with Jae Young Kim

• Black Hat
  Black Hat Stories | Shanna Daly, CEO of Torin Cyber Group

• Black Hills Information Security
  What Is WebView2? From “Proxy Execution with Microsoft Edge WebView2 – Matthew Eidelberg”

• Huntress
  The Infostealer Ecosystem Explained in 2 Minutes

• InfoSec_Bret
  IR – SOC327 – Suspicious Docker Image Creation Detected

• Insane Forensics
  The Anatomy of an OT Cybersecurity Flyaway Kit

• Microsoft Threat Intelligence Podcast
  Behind the Book: Threat-Driven Software Development

• Monolith Forensics

  • Evidence: Acquisitions and Storage Items [Monolith Mondays]
  • Log2Timeline + Docker: Consistent Parsing on Any OS
  • Adding a Client to an Inquiry or Case in Monolith

• MSAB
  #MSABMonday – Updated Messages Category

• MyDFIR
  From University to MYDFIR Forge: Jane’s Experience

• OpenSourceMalware
  The OpenSourceMalware Show #13

• Paraben Corporation
  Zandra AI ver 2 Overview

• Sumuri
  Browsing File Search Results | RECON ITR Deep Dive

• Team Cymru
  ORB Networks, Ceasefire Cyber Warfare, and AI Infrastructure Exploits

• The Defender’s Advantage Podcast
  Human-Machine Teaming: Applying AI to Frontline Threat Intelligence Workflows

• THE Security Insights Show
  The AI & Security Insights Show – We’ll be back!

• Three Buddy Problem
  Hugging Face Just Got Hit by the First Fully Autonomous AI Attack

Malware analysis

• 0day in {REA_TEAM}
  [QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India)

• Aikido

  • AsyncAPI npm packages compromised with Miasma variant
  • AsyncAPI npm packages backdoored via GitHub Actions
  • SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

• Esentire
  DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150’s Evolving Tradecraft

• Yurren Wan at Fortinet
  The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

• Genians
  Operation Capsule Vault: EMBED_PAYLOAD_v2 기반 RokRAT 공격 체인 분석

• Thijs Xhaflaire at Jamf
  CrashStealer: C++ macOS infostealer posing as crash reporter

• Chris Navarrete, Asher Davila and Doel Santos at Palo Alto Networks
  TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

• ReversingLabs

  • The tale of ClickFix: 5 takeaways from RL’s new threat report
  • ClickFix doesn’t attack your knowledge. It attacks your trust.

• Sekoia
  Raccoon Stealer v2 – Part 1: The return of the dead

• Seqrite

  • Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers
  • Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

• Shubho57
  Analysis of a VBScript leads to Quima RAT

• Socket

  • Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader
  • 11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload

• Step Security
  Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories

• Zhassulan Zhussupov
  Malware development trick 60: Function stomping (remote process). Simple C example

Miscellaneous

• Gerard Johansen at Black Hills Information Security
  KAPE 101: A Kroll Artifact Parser and Extractor Cheatsheet

• Brett Shavers at ‘The X-Ways Forensics Practitioner’s Guide/2E’
  The X-Ways Forensics Practitioner’s Course Is Retiring

• Damien Lewke
  A Test in Time

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 07/13/26

• Martin Korman at DFIR Dudes
  regipy-rs: Parsing a SOFTWARE Hive in 0.3 Seconds Instead of 12 Minutes

• Magdalena Karwat at EclecticIQ
  EclecticIQ MCP Server: Connect your AI agents directly to your threat intelligence

• Forensic Focus

  • Digital Forensics Jobs Round-Up, July 13 2026
  • Katelyn Rogers, Digital Forensic Analyst, Mississippi Cyber Initiative
  • The End Of Manual Transcription Starts Here
  • Forensic Focus Briefs National Policing and Forensic Bodies on Investigator Well-Being
  • Want To Put An End To Manual Transcribing? Watch S21 Transcriber v2.0 In Action

• Alexis Brignoni at LEAPPs Blog
  Be Careful What You Wish For

• Matthew Plascencia
  The Real Hacking of Forensic Investigation: Hashcat

• Vaishnavi M.A. at Paraben Corporation
  Transition from Traditional Forensic Science to Digital Forensics: Challenges, Lessons, and Opportunities

• Sandfly Security

  • Deprecation of Linux Kernels Prior to 3.2 in Sandfly 5.8
  • How Agentless Linux EDR Detects Rootkits Over SSH

• Seth Enoka
  GCFE vs GCFA: What Actually Changes (and When You’re Ready)

• Ryan G. Cox at The Cybersec Café
  Building an Agentic SOC

Software releases/updates

• Acelab
  The New Software Update: PC-3000 Ver. 7.9.9, Data Extractor Ver. 6.9.6, PC-3000 SSD Ver. 3.9.8 has been released

• Amped
  Amped Replay Update 41290: Report Generation Improvements, Safer Exporting of Bookmarks, and Much More!

• Digital Sleuth
  winfor-salt v2026.11.18

• Doug Burks
  so-crates v2.0.0

• Elcomsoft
  Elcomsoft Phone Breaker 11.03: universal binary for Macs, SMS two-factor authentication restored

• Ghassan Elsman
  Crow-Eye v0.12.5

• Renaud Tabary at MALCAT
  0.9.15 is out: capa scanning at native speed

• Martin Korman

  • Regipy 6.3.0
  • Regipy regipy-rs 0.1.0a1

• Metadata Forensics
  HEART Version 2.1.0.0

• Metaspike
  FEC Remote Authenticator 1.51.2

• Microsoft
  msticpy v3.0.2

• MISP
  MISP 2.5.44: Hotfix release (pull mechanism) and Overmind theme update

• OpenCTI
  7.260715.0

• Xways

  • X-Ways Forensics 21.7 SR-6
  • X-Ways Forensics 21.9 Preview 5

• Yaniv Radunsky
  DFIR Companion v0.32.0