Forensic Analysis

• Christopher Eng at Ogmini
  Examining Tailscale Artifacts – Part 8

• Brian Carrier at Cyber Triage
  DFIR+AI: Making Tool Decisions in a GenAI World

• Elcomsoft

  • Special macOS Firewall: Safe Sideloading of the EIFT Extraction Agent
  • The iOS 27 Recovery Menu: What It Means for Forensics

• Forensafe
  iOS BeReal

• Hal Pomeranz at ‘Righteous IT’
  Workaround For Duplicate LVM Names

• Intrinsec
  AI Agents X Digital Forensics 03 – ClaudeCode

• LEAPPs Blog

  • Every Step You Take, Eight Years Later: Android UsageStats and Recent Tasks
  • Telegram System Events: The Cross-Platform Reference
  • Telegram on Both Sides: New iOS and Android Coverage in iLEAPP and ALEAPP
  • Using AI Effectively in Digital Forensics

• Mohit Dhabuwala
  The email said it was from HR but the headers said something else.

• Tim Korver at ‘Thesis Friday’
  Thesis Friday #23: The anchor comes from outside the log

Threat hunting/threat intelligence

• Abnormal Security
  Introducing Matrix: A Microsoft 365 AiTM Platform Overlapping the Sneaky2FA Lineage

• Christian Papathanasiou at AllSecure
  ClickFix, EtherHiding & a DPRK Wallet Trail

• Any.Run
  Major Cyber Attacks in July 2026: US and EU Organizations Hit by Phishing, RATs, and Stealers

• Arctic Wolf
  Payroll Pirates: Strange New Tides in Business Email Compromise

• ASEC

  • Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor
  • Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

• Ayelen Torello at AttackIQ
  Analyzing Nova Ransomware: A Rust-Based Encryptor with Multi-Layered Microsoft Defender Evasion Techniques

• Azeemnow
  APT41’s Dodgebox: Defense Evasion and Detection Strategies

• Eric J. Taylor at Barricade Cyber Solutions
  Threat Actor Profile: NightSpire Ransomware

• Rebecca Harpur at BlackFog
  The State of Ransomware: July 2026

• Brian Krebs at ‘Krebs on Security’
  Canadian Man Pleads Guilty in Snowflake Extortions

• BushidoToken
  UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026

• CERT Polska
  Follow-Up Report of the December 2025 Energy Sector Incident

• CERT-AGID

  • Phishing a tema SPID in corso
  • Phishing a tema “multe” sfrutta il nome della Polizia di Stato e di pagoPA
  • Phishing ai danni di ARERA utilizza il tema “bonus sociale idrico”
  • Sintesi riepilogativa delle campagne malevole nella settimana del 1 – 7 agosto
  • XSS2Shell: nuova vulnerabilità nel core di WordPress può portare all’esecuzione di codice remoto

• Check Point
  3rd August – Threat Intelligence Report

• Nick Biasini, Dmytro Korzhevin, Jaeson Schultz, Vanja Svajcer, Vitor Ventura, and Arnaud Zobec at Cisco’s Talos
  “Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

• CloudSEK
  Access For Sale: Inside a Russian-Speaking Access Broker’s Dual Operation

• CrowdStrike

  • CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates
  • CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX

• CTF导航
  Hackers Use Fake API Documentation to Trick AI Agents Into Sending Crypto Payments

• Cyble

  • From Stolen Credentials to Full Breach: The 72-Hour Timeline
  • Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors

• Cyfirma
  Weekly Intelligence Report – 7 Aug 2026

• Christophe Tafani-Dereeper, Nick Frichette, Sebastian Obregoso, and Martin McCloskey at Datadog Security Labs
  Worm compromises hundreds of popular npm packages

• Detect FYI

  • Attackers Don’t Need Your Devices Anymore They Just Need Your Identity.
  • When Attackers Hijack Your Inbox: Detecting Mailbox Forwarding Rules with Microsoft Defender XDR
  • Ultimate Threat Hunting Playbook for Russian Cyber Operations in a Hybrid Threat Environment

• Dirk-jan Mollema
  Borrowing Windows Hello keys for authentication and persistence

• Elastic Security Labs

  • Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
  • The security signal log tailing can’t see: tracking npm cooldown removals with Elastic Agent
  • Living off the coding agent: Two tales of tunnels and LaunchAgents

• Eric Lawrence at text/plain

  • Attack Techniques: Fake Captive Portals
  • Security is Hard, Y’all

• Aaron Walton at Expel
  Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates

• FalconFeeds

  • Threat Intelligence in the Era of Fragmented Cybercrime: The Transition from Monolithic RaaS Syndicates to a Post-Trust Ecosystem
  • Threat Actor Operational Mistakes: The Small Errors That Lead to Attribution
  • Cyber Threat Intelligence as Geopolitical Intelligence: Early Warning Indicators of Macro-Stability and Conflict
  • The Internet’s Forgotten Infrastructure: Why Old Servers Still Matter

• Flare
  FirewallFalcon Manager: Supply-Chain Backdoors in Underground VPN Infrastructure

• GitGuardian

  • Credential Harvesting Explained: How Attackers Collect Secrets From Developer Machines
  • Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets

• Tyler McLellan and Austin Larsen at Google Cloud Threat Intelligence
  UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

• Hunt IO
  The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

• LevelBlue SpiderLabs

  • Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems
  • Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect

• Ax Sharma and Cody Nash at Manifold Security
  77 “evil twin” Open VSX extensions: 19 copy private repo and CI data to a new domain

• Microsoft Security

  • 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET 
  • ChainDrop supply chain compromise: Anatomy of a self-propagating worm
  • From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

• Netskope

  • Developers in the Crosshairs: Fake AI Tools Deliver Infostealer
  • npm Stealer Reads Its C2 From an Ethereum Contract
  • Fake CAPTCHA, Real Business: Traffic Distribution for Hire

• Swachchhanda Shrawan at Nextron Systems
  Detecting Certighost (CVE-2026-54121): Sigma Coverage Across the Full Attack Chain

• Jeremy Kirk and Mathew Woodyard at Okta
  Free tokens for sale: How fake signups drive AI fraud

• Oleg Skulkin at ‘Know Your Adversary’

  • 407. That’s How Paper Werewolf Obtains Credentials
  • 408. Adversaries Disable Updates for Compromised Systems

• OpenSourceMalware

  • New npm Worm Hits 400+ Packages Including Keyv, Cachable
  • Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

• Moshe Siman Tov Bustan at OX Security
  A New Infostealer Worm Hits npm, affecting Keyv and Cacheable

• Palo Alto Networks

  • Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
  • Almost Half of Malware Samples Communicate Direct to IP
  • Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
  • ChainDrop: Inside a Self-Propagating npm Worm

• Resecurity
  ExfilSquad Targets New Victims, Shares Data via Torrents

• Ridgeline Cyber
  The Hunt That Found Nothing

• Ron Ben Yizhak at Safebreach
  Forgotten but Not Gone: Unauthenticated RCEs and Privilege Escalations in Legacy Linux Services

• SANS Internet Storm Center

  • Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th)
  • Don’t Revoke That Token Yet: Inside the keyv/cacheable npm Worm, (Wed, Aug 5th)
  • 22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary], (Thu, Aug 6th)
  • Linux Shell Forensic: Let’s Dive Into Atuin!, (Fri, Aug 7th)

• Securelist

  • An analysis of incidents at Brazilian educational institutions
  • How legitimate cloud platforms enable phishers to bypass MFA

• Security Scorecard
  Inside CanOworms: The 633-Server Proxy Network Hiding Criminal and State-Linked Activity

• Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee at Securonix
  Analyzing SMOKE#SCREEN: ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures

• Shayan Ahmed Khan
  From Alert to Answer: AI-Driven DFIR with Claude Code & Velociraptor

• Ian at Shells.Systems
  Abusing Extended Attributes to Bypass Application Control For Business

• Socket
  Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

• SOCRadar

  • Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
  • Dark Web Market: Vortex Market
  • Dark Web Profile: Mustang Panda

• Sergio Bestulic, Andrew Bonwell, Karla Soler, and Michael Warner at Sophos
  Interlock ransomware gang creates volatile situation

• Step Security
  ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2

• Sygnia

  • Shai-Hulud Returns: When Software Trust Becomes the Attack Surface
  • The Crypto Threat Environment 2026

• System Weakness
  SOC153 – Suspicious Powershell Script Executed | LetsDefend Walkthrough

• Team Cymru
  Behind the Panels: Validating ShinyHunters Cluster A Infrastructure Through Network Telemetry

• The Hunter’s Ledger
  CloudSync: An Assembler’s Intrusion Toolkit

• The Raven File
  CRPX0 — SCAMMER TURNED RANSOMWARE OPERATOR

• The Shadowserver Foundation
  Shadowserver Critical Community Infrastructure Cyber Resilience Project

• ThreatMon
  The Threat No Longer Writes Code. It Thinks

• Edwin David at TrustedSec
  The Art of Hunting Azure Cloud Secrets

• Umut Bayram at Picus Security
  Dropping Elephant (Patchwork): Espionage APT Tactics and Tools

• Wiz

  • keyv and cacheable npm Package Hijacked in Supply Chain Attack
  • Cloud Threat Highlights: H1 2026

• Victor M. Alvarez at YARA-X
  Beware of the wildcard

• ZScaler

  • Targeted Attack on Government Entities in the Middle East | Part 2
  • Ransomware Moves up the Org Chart: Managers Are Prime Targets
  • ThreatLabz 2026 Report: Frontier AI and Enterprise Readiness

• Блог Solar 4RAYS
  AI-Killchain в нынешних реалиях

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-08-10

• Rebecca Harpur at BlackFog
  WEBINAR: The First Half Of 2026 In Ransomware – Register Now!

• Amy Ciminnisi at Cisco’s Talos
  [Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents

• Huntress
  Tradecraft Tuesday | Fake Claude install guide, real macOS stealer

• Magnet Forensics
  AI Unpacked S2:E4 // The art and science of AI prompting in digital investigations

• Spur
  Beyond the Great Firewall

Presentations/podcasts

• ADF Solutions

  • How to Collect Specific Files in ADF Pro and MDI
  • The 7 Biggest Mistakes Investigators Make at Crime Scenes
  • How to Create an Acquisition of iOS and Android Devices in ADF Pro and MDI

• Adversary Universe Podcast
  Unpacking the CrowdStrike 2026 Threat Hunting Report with CrowdStrike’s Katie Blankenship

• Belkasoft

  • iOS Agent-Based Acquisition: Full File System and Keychain Extraction with Belkasoft X
  • iOS Acquisition Methods Explained: iTunes, Checkm8, Agent-Based, and iCloud
  • iOS Forensics: The Good, the Bad, and the Ugly—Acquisition, iCloud, and System Artifacts
  • Forensics In The Cloud: How To Conduct An Office 365 Investigation
  • Distribute AI Forensic Processing Across Your Network | BelkaGPT Hub

• Black Hat

  • Black Hat USA 2026 Keynote: The End of Rare Defending When Offense Is Cheap
  • Black Hat USA 2026 Keynote: Vulnerability Research in the Agentic Age

• CySecK
  Cyber Aware Karnataka | Email Phishing Attack | Ep. 01

• Endace
  Secure Networks Ep 67 – The Packet Forensics Files – with Erik Dove from Cisco

• InfoSec_Bret
  IR – SOC333 – Denis Malware Activity Detected (APT32)

• Magnet Forensics

  • From extraction to courtroom: Accelerating digital evidence review and case preparation
  • Mobile Unpacked S4:E7 // Analyzing Android Auto evidence

• Monolith Forensics

  • Analytics Reports [Monolith Mondays]
  • Creating a New User Role in Monolith

• MSAB
  #MSABMonday – Exporting Hashes

• MyDFIR

  • Build a SOC Lab with Wazuh: Deploy the Server (Part 1)
  • Build a SOC Lab with Wazuh: Connect Agents + Sysmon (Part 2)
  • Build a SOC Lab with Wazuh: Generate + Read Telemetry (Part 3)

• Open Source Forensics Lab
  Android XML Analysis |xml2abx Overview

• OpenSourceMalware
  The OpenSourceMalware Show #16

• Proofpoint
  Half-Click, Full Compromise: Inside Russia’s TA458 and TA488 Espionage Playbook

• Team Cymru
  Agentic Escapes and Spyware Fingerprints

• The Weekly Purple Team
  Certighost: Certificate Authority Exploitation & Detection | Weekly Purple Team

• Three Buddy Problem
  Inside OpenAI’s Black Hat Confession

Malware analysis

• ExaTrack
  Under the Hood – StealNui a new linux RAT clipper

• Fortinet
  QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

• Ferdous Saljooki at Jamf
  Fake Zoom installer uses .NET dropper to deliver Overlord RAT on macOS

• Baran S at K7 Labs
  Octagon: Technical Analysis of a Fake Bahrain Civil Defense Application

• Shayan Ahmed Khan
  Autonomous Reverse Engineering: Evaluating AI with Interactive Disassembly

• Shubho57
  Analysis of JavaScript File leads to NetSupport RAT

• Liran Tal and Lion Kontorer at Snyk
  Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks

• Paolo Tresso at Wordfence
  PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

• YUCA
  A Practical Primer for the Mach-O Binary Format

Miscellaneous

• CCL Solutions
  A LEAPP forward for web browser forensics

• Daniel Wyleczuk-Stern
  Stop Making Your Detection Engineers Triage Alerts

• Decrypting a Defense
  Authoritarian Data Collection, Search Warrants in the Digital Age Still Require Probable Cause, Jumana Musa Answers 5 Questions & More

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 08/03/26

• Forensic Focus

  • How To Perform Targeted Mobile Extraction In ADF Pro
  • From Backlogs To Breakthroughs: How The Metropolitan Police Service Triaged 6,000 Devices
  • Ticking A Box, Missing The Person – Reflections From FEE 2026
  • Digital Forensics Round-Up, August 05 2026
  • Unmasked: Exposure Is A Workflow Choice
  • Practical AI In Digital Forensics: Running Offline AI On Your Own Evidence With BelkaGPT
  • The Evolution Of Atola TaskForce: Eight Years Of Non-Stop Innovation
  • Forensic Focus Digest, August 07 2026

• Ihsan Alamal Ahmad at Intellibron
  The Detection Engineer’s New Best Friend

• Jeffrey Appel
  Microsoft Defender Threat Intelligence: Native Defender Integration and API Access

• Kevin Pagano at Stark 4N6
  Forensics StartMe Updates (August 2026)

• Magnet Forensics
  Forensic Early Case Assessment: is eDiscovery collecting the right data?

• Oxygen Forensics
  How to export and transfer public sector annotations from Oxygen Review Center to Oxygen Forensic® Detective

• Salvation DATA
  Vehicle Data Acquisition: The Role of EDR and OBD in Digital Forensics

• Security Onion
  Security Onion Documentation Printed Book Now Updated for Security Onion 3.2!

• UltimaCybr
  WRAITH — Part 1

• Eli Rozen at Vega
  Vega Introduces Detection Skills: The New Open Standard for AI Reasoning in Agentic Cyber Defense

Software releases/updates

• ACELab

  • New version of the PC-3000 Mobile PRO 2.12x has been released
  • The New PC-3000 Flash Software Ver. 9.4.6 has been released!

• Alexandre Borges
  Malwoverview 8.1.0

• Arsenal Recon
  Arsenal Image Mounter Changelog – v3.13.368

• Doug Burks

  • ohmypcap v3.1.0
  • so-crates v3.1.0

• Elcomsoft
  EIFT Firewall: a new free tool for controlled agent sideloading

• Ghassan Elsman
  Crow-Eye v0.12.7

• Metaspike
  Forensic Email Collector (FEC) Changelog – 4.5.888.111

• MOBILedit
  MOBILedit Forensic 9.8.1 released

• OpenCTI
  7.260807.0

• radare2
  6.2.0

• WithSecure Labs

  • Chainsaw v2.16.3-beta.2
  • Chainsaw v2.16.3

• Yamato Security

  • Hayabusa v4.0.0 – BlackHat Arsenal USA Release
  • suzaku v2.0.0 – Black Hat Arsenal USA Release