Forensic Analysis

• Massimo Iuliani at Amped
  Deepfake Forensics Workflow for Video Analysis

• Arman Gungor at Metaspike
  Conversation Index Analysis in Email Forensics — Part 2

• Elcomsoft

  • Locked In or Locked Out? Unlocking ZIP, RAR, PDF, and Microsoft Office Passwords
  • When the iCloud Backup Is the Only Copy Left

• Forensafe
  iOS Spotify

• Gaia Calamari at Strange Forensics
  XT_ExtractDocsMail

• Intrinsec

  • AI Agents X Digital Forensics 01 – OpenCode
  • AI Agents X Digital Forensics 02 – Codex

• Kevin Pagano at Stark 4N6
  Script Stash – Hunting SEGB Streams

• LEAPPs Blog

  • Extracting, Processing, and Querying Apple Unified Logs from an iOS Device
  • Apple Unified Log Predicates in iLEAPP: The Reference

• Mattia Epifani at Zena Forensics

  • 84 Streams Later: Exploring the Evolution of Apple Biome in iOS
  • 84 Streams Later, Part 2: Inside Apple Biome
  • After the Signal Fix: Exploring Apple’s notificationAndSuggestionDB.db

• North Loop Consulting
  A Query, who supports Skout & MeetMe?

• Oleg Afonin at Elcomsoft

  • Microsoft Office Passwords: What Comes Off in Seconds, What Takes Longer, and Why
  • How to recover deleted data from your iPhone

• Amber Schroader at Paraben Corporation
  Unmasking the Synthetic: Using Metadata to Spot AI-Generated Images

• Terryn at chocolatecoat4n6
  DFIR Note-Taking and Report Guide

Threat hunting/threat intelligence

• Callie Baron and Ryan Devendorf at Abnormal Security
  ARToken: The Device Code Phishing Platform Built for Full Microsoft 365 Takeover

• Callie Baron and Ryan Devendorf at Abnormal Security
  ARToken: Device Code Phishing for Microsoft 365 Account Takeover

• Aikido

  • Four incident-response decisions from the Hugging Face breach
  • Anthropic’s Fever Dream: Claude’s package that stole real keys

• Anthropic
  Investigating three real-world incidents in our cybersecurity evaluations

• ASEC

  • Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN
  • Not Every Fox is Silver: Inside an AtlasRAT loader chain

• Francis Guibernau at AttackIQ
  Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

• CJ Moses at AWS Security
  Amazon identifies North Korean hacker group behind open-source supply chain attacks

• Axelarator
  We Have Packet Capture at Home Pt. 2

• Sachin Meti at Barracuda
  Threat Spotlight: LogoKit phishing service becomes a cloud-based, real-time deception platform

• Barricade Cyber Solutions

  • Threat Actor Profile: NoMatter Ransomware
  • BRG-26183: A Free Ransomware Kit Aimed at Windows 10, and Why the Weak Ones Matter
  • Threat Actor Profile: SideWinder APT

• BlackFog

  • MedusaHVNC: A Hidden Desktop That Steals Live Windows Sessions
  • 2026 Q2 Ransomware Report
  • BlackFog Q2 2026 Ransomware Report: Undisclosed Ransomware Attacks Surge 40% Year on Year

• Brad Duncan at Malware Traffic Analysis

  • 2026-07-31: Seven days of scans and probes and web traffic hitting my web server
  • 2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT

• Brian Krebs at ‘Krebs on Security’
  Read This Before You Buy That TV Streaming Stick

• Joshua Penny at Bridewell
  Vishing Call to a Shared Com Ecosystem: Full Methodology and Findings

• BushidoToken
  UK Cybercrime Journal: H1 2026 Social Media Fraud Trends

• Censys

  • A Chill in the Air: Cl0p Targets Windchill, Another Enterprise Software Product
  • DarkSword’s Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster

• CERT-AGID

  • Phishing ai danni de “Il Portale dell’Automobilista” indicizzato tra i primi risultati Google
  • Falsa sextortion ShinyHunters: le email arrivano per la prima volta in Italia
  • Sintesi riepilogativa delle campagne malevole nella settimana del 25 – 31 luglio

• Check Point

  • 27th July – Threat Intelligence Report
  • Attackers Are Turning Microsoft’s Trusted Login System Into Their Latest Phishing Weapon

• Lexi DiScola and Dave Liebenberg at Cisco’s Talos
  IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

• Cloud Security Alliance
  Hugging Face Incident Initial Post-Mortem

• CloudSEK
  Tax Season, Open Season: Phishing and Malware Campaigns Targeting Indian Taxpayers

• Micah DeHarty at Cofense
  The Evolution of Remote Access Tool Abuse: From Single Payloads to Multi-Stage Campaigns

• Kevin Ratto at CrowdStrike
  Inside Astaroth’s New Spambot Component

• Cyberdom
  Exploiting Azure IMDS

• Cyble
  APTs Top the List of Most Active Threat Actors in H1 2026

• Cyfirma
  Weekly Intelligence Report – 31 Jul 2026

• D3Lab

  • Inside an N26 Impersonation Campaign: From Vishing and Fake Control 1.0 to the Copybara Android RAT
  • Phishing ai clienti Telepass: non stai pagando una contravvenzione, ti stanno solo frodando

• Dark Atlas
  The Code Is Real. The Device Is Not: The Definitive Guide to Device Code Phishing

• Darktrace
  Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection

• Lorenzo Susini and Matt Muir at Datadog Security Labs
  Detection primitives for eBPF rootkits

• Detect FYI

  • SIEM Bypasses: Diffracting the “CreepyDrive URLs” Sentinel Rule
  • Deep-diving Crowdstrike’s DirectoryCreate

• Disconinja
  Weekly Threat Infrastructure Investigation(Week31)

• Elastic Security Labs

  • Inside Elastic InfoSec’s agentic SOC: How we cut AI agent LLM calls by 60%
  • Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here
  • Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend

• Erik Hjelmvik at Netresec
  PureLogs, PureRAT and misleading zgRAT

• Jorn Pieterse at Eye Research
  AI-powered Phishing-as-a-Service: Inside Two BEC Kits

• Assaf Morag at Flare
  Kali365: The Phishing-as-a-Service Operation Expanding Beyond Microsoft 365

• Flashpoint
  Demystifying The Com and Nihilistic Violent Extremism: What You Need To Know

• Kelli Vanderlee and Stuart Carrera at Google Cloud Threat Intelligence
  Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise

• Hidden Layer
  Dead Drops in Public: What the AI Agent Stashed on Hugging Face

• Hugging Face

  • Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
  • Security incident disclosure — July 2026

• Hunt IO
  Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

• IC3

  • CI Fortify – Advice for isolating vital systems
  • Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers

• InfoSec Write-ups

  • LetsDefend: SOC169 — Possible IDOR Attack Detected (Walkthrough)
  • Static Malware Analysis of Suspicious Windows PE Samples: A Blue Team Investigation

• Intel 471
  Software Supply Chain Attacks: Weaponizing Trusted Developer Workflows

• Gilbert Kallenborn at Intrinsec
  Enterprise LLM Threat Atlas : real-world incidents, research cases, Mitre mappings

• Intrusion Truth

  • Dear Diary, Today I found a Ghost in the Network
  • Turns out the Ghost was the PLA

• Kevin Beaumont at DoublePulsar
  Adform compromised to serve crypto stealer via supply chain attack

• Adam Goss at Kraven Security
  CTI For SMB: When Your Small Business Is Actually Ready For Threat Intelligence

• Lauren Proehl at THOR Collective Dispatch

  • Open Season: Hunting Adversary Infrastructure With Free Data
  • Open Season: Certificate Transparency

• LevelBlue SpiderLabs

  • LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation
  • Release the RAVEN: An Offensive Reconnaissance and Attack Tool on Vulnerable Elasticsearch Nodes

• Microsoft Security
  CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

• MII Cyber Security
  Progression of Remote Access Malware

• Eugenio Benincasa at Natto Thoughts
  UKCT Report: “One Network, Two Systems: The Research Security Risks of UK/China University Cyber Partnerships”

• Asritha Narina at Netenrich
  Deconstructing npm Registry & Supply Chain Attacks | Netenrich

• Thomas Byrne at NetSPI
  Azure VM Command Execution using Third-Party Extensions – Salt Minion

• Nick Thanos at Triskele Labs

  • New Name, Same Threat: How Lynx Ransomware Exploits Trusted Access
  • Banned, Rebranded, Still Ransoming: How LockBit Outlasted Its Own Takedown

• Moussa Diallo at Okta
  Behind the scenes of a vishing operation

• Oleg Skulkin at ‘Know Your Adversary’

  • 405. Adversaries Disable Notifications to Maintain Stealth
  • 406. Threat Actors Embed Malicious HTA into LNK Files

• OpenSourceMalware

  • NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  • PolinRider Caused Dozens of npm and Go Compromises
  • NullReceiver’s Blank Crypto Transfers Solves the Challenges of EtherHiding

• Palo Alto Networks

  • Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
  • The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

• Prodaft
  The Mantis Grip: Endpoint Defenses Pinned Before Encryption

• Proofpoint

  • Notes from Underground: Adversarial Prompt Injection
  • Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

• Ransom-ISAC

  • The Telegram Malware Ecosystem
  • Weaponizing Exposed Data

• RansomNews
  RedACT Report Semestrale

• Resecurity
  When AI Becomes the Attacker: Understanding Autonomous Offensive Security Agents

• Ridgeline Cyber
  The Automation That Reports Success and Does Nothing

• SANS Internet Storm Center

  • Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)
  • Java Spring Boot “heapdump” scans, (Mon, Jul 27th)
  • AutoIT Payload Injector , (Tue, Jul 28th)
  • Apple Patches Everything (July 2026), (Wed, Jul 29th)
  • Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary], (Thu, Jul 30th)
  • zipdump.py: Metadata Encoding, (Fri, Jul 31st)
  • Phishing Campaigns Targeting AI Solutions Providers, (Sat, Aug 1st)
  • Atomic MacOS (AMOS) stealer infection, (Sun, Aug 2nd)

• Securelist

  • Mirage Kitten targets Middle East and Africa region with new malware
  • Network Anomaly Detection in KATA

• Silent Push
  Welcome to Danglegeddon

• Socket

  • Two Joyfill npm Beta Releases Compromised With Blockchain-Backed Remote Access Trojan Loader
  • Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
  • Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic’s Security Tests

• SOCRadar

  • Dark Web Profile: ExfilSquad
  • Dark Web Profile: Section9 Ransomware

• Morgan Demboski at Sophos
  Chaos in Teams vishing

• Splunk
  Phantom Stealer Unmasked: Shellcode, Steganography, and Credential Theft

• Step Security
  Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan

• Stephan Berger
  Field Notes: NSSM – the Non-Sucking Service Manager

• System Weakness

  • LetsDefend | SOC123 — Enumeration Tool Detected
  • Reverse Engineering APIs with Chrome DevTools: A Bug Bounty Practical Guide

• Team Cymru
  From C2 Detection to Possible Victim Identification

• The Hunter’s Ledger
  GOCLOUD: A Commodity Cryptojacking Operation, Captured Whole

• Third Eye intelligence
  Hugging Face “Frontier Lab Model Intrusion”

• ThreatMon

  • TeamPCP Threat Actor Report
  • TeamPCP: How a Cloud Exploitation Group Evolved Into a Supply Chain Threat

• Trend Micro

  • 2026 H1 APT Report – How APTs Are Weaponizing Trust in the Age of AI
  • Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave

• Umut Bayram at Picus Security

  • Vidar Malware: How the Multithreaded Windows Stealer Works
  • FrigidStealer Explained: macOS Infostealer and Gatekeeper Bypass
  • Astaroth (Guildma) Uses Steganography and Ngrok for C2 Resilience
  • HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel
  • INC Ransomware Explained: How It Attacks Healthcare and Education

• UnderDefense
  Inside a ClickFix Attack: How VeiloVPN Hid Its Command Server Inside a Polygon Smart Contract

• Yarix
  French Attack Surge: Unpacking the Drivers Behind the Spike in Data Leak Claims Against French Targets

• Блог Solar 4RAYS
  Обзор сетевых уязвимостей в 2-м квартале 2026 года

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions
  • Validate or Deflect: Practical Triage Workflows for Modern Investigations

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-08-03

• Cellebrite

  • From Seized Device to SyndicateInvestigating Transnational Drug Importation Across the Asia-Pacific
  • One Operating Model, Many Jurisdictions
  • One Chain, Ten Jurisdictions

• Cyfirma
  Frontier AI and Cyber Warfare: How Nation States Are Weaponizing AI

• John Hammond
  Payload Podcast 010 – Olaf Hartong

• Sygnia
  When Ransomware Hides in OneDrive: Inside SafePay’s Exfiltration Play

• XposedOrNot
  You are being watched

Presentations/podcasts

• Cyber Social Hub
  How to Preview Digital Evidence in ADF Pro and MDI

• FIRST
  Episode 63: John Hollenberger, Fortinet, FIRSTCON26 Speaker

• Hacker Valley Blue
  Inside Conti: The Ransomware Gang That Ran Like a Company with Geoff White

• Huntress
  _declassified | Know Your Adversary – Watch Party with Commentary

• InfoSec_Bret
  IR – SOC331 – Zebrocy Malware Activity Detected (APT28)

• Microsoft Threat Intelligence Podcast
  A Farewell from Sherrod: New Season Coming Soon

• Monolith Forensics

  • New Evidence Importer [Monolith Mondays]
  • Creating a User Group in Monolith
  • iOS Biome Data and Forensic Artifacts

• MSAB

  • #MSABMonday – Setting up XRY
  • Forensic Fix Episode 28

• MyDFIR

  • Teacher Learning Cybersecurity: Raymond’s MYDFIR Forge Experience
  • Build a SOC Lab with Wazuh (Free Challenge + Giveaway)
  • Wazuh 101: What is Wazuh?

• Off By One Security
  Building the First Public Linux UEFI Bootkit Framework, with Alejandro Vazquez

• OpenSourceMalware
  The OpenSourceMalware Show #15

• Parsing The Truth: One Byte at a Time Podcast
  S2 E8: The Daubert Standard Part 2

• SANS Cloud Security
  AI Driven DevSecOps Part 4: Observing Microservices with OpenTelemetry and Grafana

• Team Cymru
  Rogue LLMs, Clop’s 8th Zero-Day, and Threat Hunting at Scale

• THE Security Insights Show
  The AI & Security Insights Show Episode 296 | Black Hat and Defcon – Here we come! AI goes Wild! Don’t Hack me bro.

• Three Buddy Problem

  • Validin’s Kenneth Kinion on What Separates Useful Threat Intel From Noise
  • Proofpoint’s Greg Lesnewich on Laundry Bear, ‘Half-Click’ Exploits, and Magnets of Threats

Malware analysis

• Arctic Wolf
  Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection

• Blackpoint Cyber
  Nested Trust: HollowFrame’s Layered Loader and Matryoshka Backdoors

• Qi’anxin X Lab
  Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria

• Shubho57
  Analysis of TokyoCore Ransomware

• Zhassulan Zhussupov

  • Malware development trick 61: Module stomping. Simple C example
  • Malware shellcode delivery via signal – part 4. Embedding Bell 202 FSK into MP3 and recovering the symbol clock. Python and C example

• ZScaler
  Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

• Шифровальщики-вымогатели The Digest “Crypto-Ransomware”
  NBLock Black

Miscellaneous

• Vitaliy Mokosiy at Atola
  Remote drive acquisition using Atola Boot Image

• Abuse.ch
  Introducing the abuse.ch Community Hub: recognition matters

• Dan “Haircutfish” Rearden at Black Hills Information Security
  Report As You Go: Maintaining Good Documentation for SOC Analysts

• Cellebrite
  When a Drone Is Recovered, the Clock Starts 

• Craig Ball at ‘Ball in your Court’
  The AI Protective Order Double Standard

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 07/27/26

• Elan at DFIR Diva
  The Events Site is Being Rebuilt

• Forensic Focus

  • Digital Forensics At The Point Of Contact: Closing The Gap Between Detection And Analysis
  • Passware Kit 2026 v3: BitLocker PIN Recovery For TPM-Protected Devices
  • Digital Forensics Jobs Round-Up, July 27 2026
  • The First 60 Minutes of Digital Evidence: The Investigator Advantage
  • Deepfakes Are Now An Investigative Risk – Unmasked: Authenticity Must Be Assessed
  • Magnet Forensics Invites You To Share Your Thoughts On The Current State Of Enterprise DFIR

• Jeffrey Appel
  How to collect Microsoft Defender Client Analyzer Files via MDE Live Response

• Magnet Forensics

  • Mobile devices and insider threat investigations: Why access keeps getting harder
  • Vehicle forensics: a practical guide
  • Applications now open for the 2027 Magnet Forensics Scholarship Awards

• Chris A at NCSC
  Making forensic observability the norm for network devices

• Nebulock

  • Agentic Detection Engineering Framework, an open source detection engineering memory layer
  • Nebulock Helix: Just-in-Time Data Enrichment for Hunting

• Obsidian Security
  The Frontier Models Were Doing Their Jobs. That’s the Part Enterprises Should Plan For

• Sophena Wilson at sentinel.blog
  Finding Patterns: The Art of Cybersecurity

Software releases/updates

• ACELab
  Direct connection of native USB SSDs without soldering

• ANSSI-FR
  DFIR-ORC v10.3.4

• Brian Maloney
  OneDriveExplorer v2026.07.31

• David Augros
  sigwood v0.2.9

• DFIRe
  1.6.0 — July 29, 2026

• Digital Sleuth

  • WIN-FOR v12.0.0
  • winfor-salt v2026.11.31

• Doug Burks
  so-crates v3.0.0

• Elcomsoft
  Elcomsoft Phone Breaker 11.04: more reliable downloads from iCloud Drive

• Ghassan Elsman
  Crow-Eye 0.12.6

• LEAPPs

  • iLEAPP v2026.2.1
  • RLEAPP v2026.2.0
  • Introducing DLEAPP

• OpenCTI
  7.260728.0

• Security Onion
  Security Onion 3.2.0 Now Available with Agentic AI and Much More!

• SigmaHQ
  pySigma v1.5.0

• VirusTotal
  YARA v4.5.8

• WithSecure Labs
  Chainsaw v2.16.3-beta.1

• Xways
  X-Ways Forensics 21.8 SR-5

• Yaniv Radunsky
  DFIR Companion v0.34.0