Forensic Analysis

• Brian Carrier at Cyber Triage
  AI in DFIR 101: Why AI isn’t Good for DFIR Collections

• Digital Forensics Myanmar

  • What happens when you delete files on an Android Devices ?
  • Signal Application Uninstall

• Oleg Afonin at Elcomsoft
  Write Blockers in Forensics: What Controls How You Use Them?

• Forensafe
  Apple Screen Time

• Kevin Pagano at Stark 4N6
  Tracking Timezone Changes in Digital Wellbeing

• Synacktiv
  Forensic AWS EKS : sources de données et méthodes d’investigation

• Tim Korver at ‘Thesis Friday’
  Thesis Friday #25: Proximity is not causality

Threat hunting/threat intelligence

• Abnormal Security

  • Nation-State Hiring Fraud: Fake IT Workers, Laptop Farms, and Background-Check Blind Spots
  • iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets

• Any.Run

  • Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US
  • North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

• ASEC

  • Beware of phishing emails disguised as requests to review quotes (PhantomStealer)
  • Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea
  • Beware of Phishing Emails Disguised as Transaction Receipts
  • July 2026 Threat Trend Report on APT Groups
  • July 2026 Infostealer Trend Report

• Ayelen Torello at AttackIQ
  Response to CISA Advisory (AA26-222A): #StopRansomware: Gunra Ransomware

• Christine Barry at Barracuda
  The Gentlemen ransomware: Inside one of the fastest-growing extortion operations

• Bishop Fox
  No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

• Martin Zugec at Bitdefender
  SilkParasite: Tracking a China-Nexus APT Across Central Asia

• Brad Duncan at Malware Traffic Analysis
  2026-08-21: SmartApeSG ClickFix campaign leads to two RATs

• BushidoToken
  UK Cybercrime Journal: Carding Tactics & Youth Money Muling

• CERT-AGID

  • Falso “rimborso farmaci” sfruttato per un phishing a tema Fascicolo Sanitario Elettronico
  • Phishing ai danni del Ministero della Salute sfrutta un falso “rimborso ticket sanitario”
  • Sintesi riepilogativa delle campagne malevole nella settimana del 15 – 21 agosto

• Check Point

  • 17th August – Threat Intelligence Report
  • Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
  • BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

• CISA
  Defending Against an Active Threat to Siemens S7 Series PLCs

• Cisco’s Talos

  • Describing attacks with crime script analysis
  • UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
  • UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

• CloudSEK
  BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer

• Joseph Hoggle at Cofense
  Phonescams: Casting a Wide Net in an Orchard of Low-Hanging Fruit

• Cyble
  Endpoint Blind Spots: The 5 Places Ransomware Hides Before It Detonates

• Cyfirma
  Weekly Intelligence Report – 21 Aug 2026

• D3Lab

  • Furto di identità via phishing Wise
  • Phishing Klarna: crescita vertiginosa

• Zander Mackie at Datadog Security Labs
  N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled “go-titan,” and how to hunt for it

• Dream
  The Intelligence Factory: How AI Is Replacing the Nation-State Back Office

• Erik Hjelmvik at Netresec
  CNCMachineRMS C2 Protocol

• Esentire
  Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra – Killing Your EDR Since 2025

• Andréanne Bergeron at Flare
  1 in 20 Stealer Log Victims are Threat Actors

• Flashpoint
  Insider Threat Report: Dark Web Recruitment & Access Trends

• Google Cloud Threat Intelligence

  • Staying Ahead of Adversarial AI Through Agentic Source Code Review
  • Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

• Group-IB

  • Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking
  • One Adversary: Fraud Is a Network, Not a Payment

• Justin Timothy at GuidePoint Security
  Beware the Ransomware Rescuer: Ransom Busters

• Hudson Rock

  • From CI Pipeline to Ransomware & Breaches: 6 High-Profile Breaches in the LiteLLM/Trivy Attack
  • Analyzing Stripe Vendors Breach: Confirmed Vendor Exposure and Claims of 20,000 Compromised APIs

• Hunt IO
  Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia

• Huntress

  • MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  • Education Under Attack: The Pattern Behind Recent University Breaches
  • Fake Refund Scam Hits Shopify Shop App Users
  • Akira Hits Safe Mode: Ransomware Rebooting Around EDR

• IC3
  #StopRansomware: Medusa Ransomware

• Intel 471
  A New Era of Bulletproof Hosting Providers Emerge

• Keith McCammon
  Intrusion observations mid-2026

• Serhii Melnyk and Timmy Lister at LevelBlue SpiderLabs
  Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking

• Stefan Dasic at Malwarebytes
  41 deceptive download sites show a real link, then send you somewhere else

• Ax Sharma and Cody Nash at Manifold Security
  What to think about curl | bash now that AI agents run it

• Aayush Tyagi at McAfee Labs
  WeedHack Returns: How SEO Poisoning is Leading Minecraft Fans to Malware

• Microsoft Security
  Hunting MacSync Stealer infrastructure through behavioral pivots

• Nebulock

  • TRACE Graph: the behavioral system of record for your environment
  • Detecting a ScreenConnect RMM Attack with Agents

• Oleg Skulkin at ‘Know Your Adversary’

  • 411. Ransomware Actors Control Systems in Safe Mode Using AnyDesk
  • 412. Threat Actors Abuse Deno to Run Remote JavaScript Payloads

• Bill Batchelor at Palo Alto Networks
  Identity Abuse Through Trusted Communication Channels

• Practical Security Analytics
  How to Build Threat Emulation Workflows

• Dani [Varys] Z, Ellis Stannard, Eric Taylor, and Nick Smart at Ransom-ISAC
  Infrastructure Destruction Squad / BLACKNET-00: Ransomware, Firebase and ICS Tooling

• Anna Širokova and Jan Recinsky at Rapid7
  Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

• Recorded Future
  CopyCop Targets AI Investment in Armenia

• Red Canary
  Intelligence Insights: August 2026

• John Dilgen and Connor Short at ReliaQuest
  Clop Returns with Custom Implant in Mass-Extortion Campaign

• Rob T. Lee
  Both Sides of One Breach: The OpenAI and Hugging Face autonomous agent incident, plotted on one timeline and graded by evidence

• SANS Internet Storm Center

  • Wireshark 4.6.8 Released, (Sun, Aug 16th)
  • Apple Patches iOS and macOS, (Mon, Aug 17th)
  • Apple Screen Sharing Security, (Mon, Aug 17th)
  • Using Microsoft Graph and Powershell to Mine for Information – Stale Accounts and Licenses, (Thu, Aug 20th)
  • Simple Scans for Cloud Metadata Service, (Wed, Aug 19th)
  • Using Microsoft Graph and Powershell – Risk Detection Commands, (Thu, Aug 20th)
  • Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!, (Fri, Aug 21st)
  • Even MOAR Powershell, looking at Entra logins – the good, the bad and the password sprays, (Fri, Aug 21st)

• Dmitry Kalinin at Securelist
  The invisible passenger in your car

• Silent Push
  New Research: How Peer2Profit and Astroproxy Turn Your Bandwidth Into Someone Else’s Product

• Tarek Mostafa
  Payload Ransom Group Profiling

• The Hunter’s Ledger
  Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion Campaign

• The Raven File
  VEEAM UNDER FIRE: Understanding CVE-2026–44963 & Ransomware Group Exploit Claims

• ThreatFabric
  Manic: Blend between Banking Malware & Spyware

• ThreatMon
  Azure Credential Theft Campaign

• Trellix

  • When Agents Go Rogue: The OpenClaw Supply Chain Crisis
  • Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation
  • Signed, sealed, injected: The mechanics of DCRat in 2026
  • Weaponized AI: The Commoditization of Cybercrime
  • Now You See It, Now You Don’t: Inside the Ghost SPN Attack Bypassing Your Security

• Lior Adar at Varonis
  CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower

• WeLiveSecurity
  How QR-code phishing can slip past corporate security measures

• Wiz

  • How to Spot and Stop Rogue Device Joins
  • Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  AI-Assisted Network Threat Hunting: See It, Enrich It, Ask It-BHIS Webcast

• Cellebrite
  Meet Cellebrite Genesis: From Digital Overload to Investigative Clarity

Presentations/podcasts

• ADF Solutions

  • How to Connect a Mobile Device Using the Connection Wizard in ADF Pro and MDI
  • How to Scan a Mobile Device in ADF Pro and MDI

• Anuj Soni
  Skip the Disassembly: Malware Analysis Without Reading Every Line of Code

• Black Hat
  Black Hat Asia 2026 | Tropic Trooper Reloaded: Unraveling the Invisible Supply Chain Mystery

• Cellebrite
  Training Offerings for Cellebrite Genesis

• DEFCON
  DefCon 34 – Stalking the Wily Hacker: 40 years later – Cliff Stoll

• Dr Josh Stroschein
  Inspecting Packed PE Sections & Entropy | Packing & Obfuscation Lesson 02

• Dr. Meisam Eslahi at ‘Nothing Cyber’
  Cyber Threat Hunt 101: Part 8 – Data Preparation, Scripting, and Visualization!

• Huntress
  RMM Guard: Map Every RMM Tool Across Your Endpoints

• InfoSec_Bret
  IR – SOC149 – Index Page Changed Unexpectedly

• Monolith Forensics

  • Monolith Initial Setup Part 2 [Monolith Mondays]
  • Workshop Wednesdays Q2 2026 Supercut: WhatsApp, Docker, and AI in Forensics
  • Set Up Organization Info in Monolith

• MSAB
  #MSABMonday – Exporting RAM

• MyDFIR
  CyberDefenders SOC Analyst Lab – l337 S4uc3 (PCAP & Memory)

• Off By One Security
  Enforcing User-Kernel Separation on Windows SMAP, User Mode Accessors, and more

• Open Source Forensics Lab
  Mobile Forensics Certification Overview: ICMDE

• OpenSourceMalware
  The OpenSourceMalware Show #18

• Sygnia
  Shai-Hulud in the Wild: What Security and IR Teams Need to Know

• THE Security Insights Show
  The AI & Security Insights Show Episode 298 | Julian Kusenberg – Purview, Agents and AI! oooh my!

• Three Buddy Problem

  • A tiny 12 KB Windows backdoor, one victim, and a dead domain
  • Inside the EncroChat law-enforcement implant, Irregular’s AI sandbox failure

Malware analysis

• Acronis
  Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign

• Ilyas Makari at Aikido
  Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack

• BI.Zone
  Arsenal revamped: Core Werewolf hits Russian organizations with CoreRAT

• Marcus Hutchins at Expel
  SynkLoader: when you throw in everything but the kitchen sink

• Joselyn Canuela and Alfed Samonteza at G Data Software
  Projextor: Abusing Electron in Trojanized Productivity Applications

• Vojtěch Krejsa at Gen
   WordlistLoader Delivering Amatera via ClearFake Campaigns

• Allen Ace at InfoSec Write-ups
  Behavioral Malware Analysis: Investigating a Multi-Stage Malware Sample Inside an Isolated Lab

• OpenSourceMalware

  • StubMaker RubyGems Campaign Delivers a Windows Infostealer
  • Windows Infostealer Hits npm and Ruby

• Priya Patel at Seqrite
  Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor

• Shubho57
  Analysis of a JavaScript leads to LxBase RAT

• Socket

  • 77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
  • Popular Rust Crates Compromised in Build-Time Supply Chain Attack

• Colin Cowie, Rafe Pilling, and Ryan Westman at Sophos
  Fake AI, real malware: Attackers impersonating AI brands

• ZScaler
  C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Miscellaneous

• Anton Chuvakin

  • So Is Your SOC AI-Ready? Part 3: API or Die Audit!
  • The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)

• Elif Kurt at Binalyze
  What did the AI actually do?

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 08/17/26

• Forensic Focus

  • AI Image Classification For Forensics – Build Custom Detectors In Seconds | BelkaGPT
  • Investigations Don’t Arrive In One Tidy Format 
  • New DFIR Mental Health Training Webinar (CPD-Accredited)
  • £2.4 Million For UK Police Well-Being – What Will It Actually Buy?
  • Cellebrite Genesis For Enterprise Now Generally Available, Regional Availability Expands To More Global Markets
  • Unmasked: Throughput Is Not Prioritisation
  • Digital Forensics Round-Up, August 19 2026
  • Impact, Coping And Support – Further Reflections From The DFIR Well-Being Study
  • Forensic Focus Digest, August 21 2026

• Gary Katz and Jason Deyalsingh at Detect FYI

  • Choosing the Right Detection Approach
  • Where do Detection Ideas Come From?

• Jeffrey Appel
  Auditing Microsoft Defender and Intune Configuration Changes

• Keibidrop
  Triage a remote machine without a VPN

• Magnet Forensics

  • More tools, more friction: why DFIR toolkits need a connective layer
  • The data-driven approach: Drafting cloud search warrants around the data providers actually keep
  • Protecting the people doing the hardest jobs

• Matthew Plascencia
  Cert Savvy: ICMDE

• N00b_H@ck3r
  Extracting System Files (e.g SAM and SYSTEM hives) with 7-Zip

• Salvation DATA
  [Case Study] Does Logging Out Delete Your Data? A Mobile App Security Look at Local Data Residue — And What It Means for Mobile Forensics

• Steven Folek at UltimaCybr

  • WRAITH — Part 1
  • WRAITH — Part 2
  • WRAITH — Part 3

• Rena Stern at Sygnia
  Incident Response vs. Crisis Management: Why Treating Them as the Same Thing Is Dangerous

• Yacin Nadji at Corelight

  • The Cure for Exceptional Zeek Package Testing (Part 1) | Corelight
  • The Cure for Exceptional Zeek Package Testing (Part 2) | Corelight
  • The Cure for Exceptional Zeek Package Testing (Part 3) | Corelight

Software releases/updates

• Apache
  Tika Release 4.0.0 – 8/18/2026

• Arkime
  v6.7.0

• Belkasoft
  Belkasoft X 2.12: A Sneak Peak

• Brian Maloney
  OneDriveExplorer v2026.08.19

• Cellebrite
  Cellebrite Genesis for Enterprise Now Generally Available, Regional Availability Expands to More Global Markets

• Costas K
  Jumplist-Browser LNK & Jumplist Browser

• Crowdstrike
  Falconpy Version 1.6.5

• David Augros
  sigwood v0.4.0

• Digital Sleuth
  winfor-salt v2026.12.1

• Doug Burks
  so-crates v4.0.0

• GCHQ
  CyberChef v11.4.0

• Get-Sybers
  DX_DFIR v0.2.0 — dxdfir CLI + get_sybers.dfir collection

• IntelOwl
  v6.8.0

• Joshua Hickman at ‘The Binary Hick’
  Timestamped

• LEAPPs

  • ALEAPP v2026.3.1
  • iLEAPP v2026.3.1

• Nedim Šabić
  fibratus v3.1.1: chore(deps): Bump golang.org/x/net from 0.54.0 to 0.55.0

• OpenCTI
  7.260817.0

• WithSecure Labs
  Chainsaw v2.16.4

• Xways
  X-Ways Forensics 21.9 Beta 2

• Yaniv Radunsky
  DFIR Companion v0.35.1 — release binaries restored