Forensic Analysis

• Oleg Afonin at Elcomsoft
  The True Meaning of Consent in ‘Consent Extractions’

• Invictus Incident Response
  OpenAI Forensics: Investigating AI Evidence & Logs | Invictus | Invictus Incident Response

• Alexis Brignoni at LEAPPs Blog
  The App Is Gone. The Story Isn’t.

• MII Cyber Security

  • From KAPE to DFIR Companion: A Practical Windows Forensic Investigation Workflow
  • Hunting the Evil : A Practical Guide to Linux Threat Hunting — Part 2

• Monty Shyama
  Freezing the Crime Scene: A Step-by-Step Guide to Container Checkpointing & Forensics on Amazon EKS

• Tim Korver at ‘Thesis Friday’
  Thesis Friday #26: Same unlock, three different stories

Threat hunting/threat intelligence

• Ryan Devendorf and Callie Baron at Abnormal Security
  ZeroTokens Gives Operators Real-Time Control of Phishing Flow

• Hitesh Duseja at Altered Security
  Abusing Azure VMs: When BitLocker Recovery Turns into an Attack Vector

• Any.Run
  A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign

• Arctic Wolf
  Dark Caracal Reloaded: New Malware, Same Hunting Grounds

• ASEC

  • July 2026 Threat Trend Report on Ransomware
  • July 2026 Threat Trend Report on APT Attacks (South Korea)

• Nisha Kashyap at AWS Security
  Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation

• Saravana Govindarajan at Barracuda
  Fake invoices, real scammers: The callback phishing playbook

• Brian Krebs at ‘Krebs on Security’
  Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

• BushidoToken
  UK Cybercrime Journal: ACRO Breach Report

• Silas Cutler at Censys
  Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption 

• CERT-AGID

  • Nuova campagna di phishing ai danni di INPS: falso rimborso per “ricalcolo contributi fiscali”
  • Sintesi riepilogativa delle campagne malevole nella settimana del 22 – 28 agosto

• Check Point
  24th August – Threat Intelligence Report

• CISA
  A Tale of Two SOCs: Insights From Two Red Team Assessments

• CloudSEK
  Caught in 4K: The Aurora Files

• Marie Mamaril at Cofense
  Understanding Browser Trust Abuse: Exploiting Enterprise’s Most Trusted Interface

• Roshan at Confiant
  Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning

• Cyb3rhawk
  As My Agents got Better, their Evidence trails got Quieter.

• Cyfirma
  Weekly Intelligence Report – 28 Aug 2026

• Dan Lisichkin
  A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise

• Darktrace

  • When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar
  • Why Trust is the New Attack Surface: Mid-Year Threat Update 2026

• Denis at D3Lab

  • I cyber criminali sfruttano Free Flow
  • Phishing a danno del Registro delle Imprese

• Detect FYI

  • Online False Positive Reduction via Statistical Process Controls
  • Threat Hunting using Pair Probabilities

• Manuel Winkel at Deyda Consulting
  NetScaler CVE Checklist: Updates, Security Assessment and Incident Response

• Disconinja
  Weekly Threat Infrastructure Investigation(Week34)

• Olaf Hartong at Falcon Force
  I’m in your logs now: deceiving analysts and blinding EDRs

• Flare

  • What is EvilTokens?: The PhaaS Platform That Tells Attackers What to Do After They Get In
  • Unmasking TeamPCP, King of Software Supply Chain Attacks

• GreyNoise
  Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

• Group-IB

  • Tortoiseshell: New Toolset and Operational Infrastructure Exposed
  • Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
  • One Adversary, Two Outcomes: The 0.027% Proof

• Paolo Coba at GuidePoint Security
  Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database

• Halkyn Security

  • Getting Hands-On Threat Hunting Experience
  • Where Persistence Hides on Linux
  • Inside the Memory Layout of a Linux Process
  • Auditd Incident Response: Rules That Matter
  • Converged Security: When Cyber Attacks Open Doors
  • Hunting Suspicious Logins on Linux

• Hudson Rock
  Inside a Syrian Interrogation Room: The Detainee Files an Infostealer Stole From a Military Police Unit

• Hunt IO
  Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities

• Huntress

  • RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress
  • Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  • A Detection Engineer’s Guide for Delegating Work to AI
  • Insights into Suspected DPRK Workers
  • PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
  • The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

• IC3
  China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems

• Itochu Cyber & Intelligence

  • Analysis of Suspicious Emails Targeting the Hotel Industry (Part 1: Campaign Overview)
  • Analysis of Suspicious Emails Targeting the Hotel Industry (Part 2: Technical Details)

• iVerify

  • Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps
  • Android Intrusion Logs

• Jeffrey Bell at CatchingPhish
  ClickExfil: My iteration on ClickFix and FileFix

• Adam Goss at Kraven Security
  Sigma Rules Explained: Architecture, pySigma, Modifiers, & Correlation

• LevelBlue SpiderLabs

  • Energy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat
  • Still Circling: Inside the Operator Behind Blind Eagle’s GitHub Loader

• Cody Nash at Manifold Security
  OpenAI & Hugging Face: Why The Chain-of-Thought Police Won’t Save You

• MDSec
  When it Snows it Pours – Anatomy of a ServiceNow Red Team

• Microsoft Security

  • When AI infrastructure becomes the target: Securing gateways and control points
  • TerminalFix campaign deploys a reverse tunnel through multistage intrusion

• Brad LaPorte at Morphisec
  When Your AI Coding Assistant Becomes the Attack: The Hades Supply Chain Campaign

• Natto Thoughts
  From the Frontier AI Arms Race to AI-enabled Defense-in-Depth: Qi An Xin Chief Outlines His Vision

• Ankur Chadda at Netskope
  Detection Isn’t Proof: The 72-Hour-Evidence Problem

• Oleg Skulkin at ‘Know Your Adversary’
  413. Threat Actors Abuse Multiple Services for System Location Discovery

• OpenSourceMalware
  NPM Isn’t Prepared For North Korean PolinRider Attack

• OSINT Team

  • RaaS (Ransomware-as-a-Service): The Corporate Restructuring of Cybercrime
  • Operation Paper Rabbit: A Phishing Kit With a Live Operator Console

• OX Security

  • ClickFix Phishing Pages Discovered in 24 npm Packages
  • Shai-Hulud – Trinitite: Sponsored by Preview 2 Effects

• Sara McBroom at Palo Alto Networks
  The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

• Patrick Wardle at Objective-See
  Detecting (Evil) Dylibs

• Itai Boublil at Profero
  WindowsAudit, Part Three: How an IR Investigation Ended in a Police Arrest

• Dani [Varys] Z, Ellis Stannard, Eric Taylor, Nick Smart, Rakesh Krishnan, and Yashraj Solanki at Ransom-ISAC
  CRPx0 ClickFix Ransomware Analysis

• Rapid7

  • Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
  • Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

• Recorded Future
  BlueDelta Targets Defense and Diplomacy with HOOKEDGE

• Ryan Greenblatt at Redwood Research
  Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident

• ReliaQuest
  Gryxa: The AI-Built Toolkit That Watches How You Remove It

• Zaria Vuksan at ReversingLabs
  Infostealers highlight malware-as-a-service trend

• Ridgeline Cyber
  Your Secret Rotation Ran Correctly. Both Credentials Are Still Valid.

• Rob T. Lee
  “Permadeath,” Persistence, Delegation, Coordination: the OpenAI postmortem & METR indepentent review

• SANS Internet Storm Center

  • DOUBLECUP’s PNG Payload, (Mon, Aug 24th)
  • Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
  • A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
  • Who Has Admin Rights in your Entra ID Directory?, (Wed, Aug 26th)
  • Some Malicious PE Stats, (Thu, Aug 27th)

• Securelist

  • Exploits and vulnerabilities in Q2 2026
  • Threat landscape for industrial automation systems. Q2 2026

• SentinelOne
  Edge Infrastructure Under Siege: What Two Independent Datasets Reveal About Who’s Exploiting Your Perimeter

• Silent Push
  Danglegeddon: The Full Research Report Is Now Available

• Simone Kraus
  THE HUMAN EXPLOITATION ECOSYSTEM

• Socket

  • Open VSX Unblocks Extension IDs Used in Malware Campaign
  • 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads
  • OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

• SOCRadar
  Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain

• Mitch Pronschinske at Sophos
  The State of Ransomware in Education 2026

• Alastair Parr at Spur Intelligence
  Law Enforcement Playbook​ for Investigating Residential Proxies

• Step Security

  • The State of Open Source Supply Chain Attacks
  • @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow

• Sucuri
  Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk

• Marco A. De Felice aka amvinfe at SuspectFile
  1.4 TB of Data and Thousands of Patients: PEAR Claims Attack on South Plains Rural Health Services (SPRHS)

• Tenable
  Edge infrastructure under siege: what two independent datasets reveal about who’s exploiting your perimeter

• ThreatMon

  • The Rise and Fall of BreachForums: A Cybercrime Empire Collapses
  • Iran-Linked Cyberattack Disrupts UK Power Generation Facility

• Maulik Maheta and Henry Bernabe at Trellix
  No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

• Umut Bayram at Picus Security
  ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT

• Kenneth Kinion at Valdin
  Inhospitable: Tracking Russian Cyber Espionage Infrastructure

• Vasilis Orlof at Cyber Intelligence Insights
  Behind the Leak

• Wiz

  • Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
  • Inside 90 days of attacks on AI infrastructure

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-08-31

• Cellebrite

  • Beyond the Prompt: Modern Investigative Workflows with Cellebrite Genesis
  • A drone breaches your protected perimeter. Now what?
  • One Device Is Not the Case

• Magnet Forensics

  • From footage to evidence: Introduction to video forensics and media authentication
  • Ask Me Anything: Strengthening eDiscovery with digital forensics

• Off By One Security
  Watching Offensive AI Agents Work

Presentations/podcasts

• Alexis Brignoni
  Digital Forensics Now Podcast S3 – 7

• Behind the Binary by Google Cloud Security
  EP28 macOS Security Internals: Kernel Exploitation, PAC Defenses, and the Rise of macOS Infostealers with Olivia Gallucci

• Belkasoft
  Fully Offline AI for Digital Forensics – No Cloud, No Data Leaks | BelkaGPT

• Black Hat

  • Black Hat Asia 2026 | Exploiting DFIR Agents Through Adversarial Manipulation
  • Black Hat Asia 2026 | WhisperPair: A Security Analysis of Google Fast Pair

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-08-24

• Dr Josh Stroschein
  Defeating Modified UPX Packers | Packing & Obfuscation Lesson 03

• FIRST
  FIRSTCON26

• Huntress
  How Huntress Phishing Simulations Work (Live ClickFix Demo)

• InfoSec_Bret
  IR – SOC189 – VBScript Suspicious Behavior Detected

• John Hammond
  GitHub Hacker EXPOSED BY HIS CAT

• Magnet Forensics

  • Hybrid agents for DFIR: Cloud-scale endpoint management, on-prem evidence control
  • Legal Unpacked S1:E11 // No surprises on the stand: Pretrial preparation for investigators and examiners

• Microsoft Threat Intelligence Podcast
  JADEPUFFER: An End-to-End Agentic-Led Ransomware Attack

• Monolith Forensics

  • Monolith Settings [Monolith Mondays]
  • Crimes Against Children Ontology: A Common Language for Connecting Investigation Data
  • Monolith Notifications

• MSAB
  #MSABMonday – Exclude Function

• MyDFIR
  Cybersecurity SOC Analyst Lab: SmartApeSG PCAP Analysis (ClickFix)

• Open Source Forensics Lab
  Oxygen Forensic Detective Overview

• OpenSourceMalware
  The OpenSourceMalware Show #19

• Parsing The Truth: One Byte at a Time Podcast
  S2 E10: When nothing is all you got

• SANS Cyber Defense
  PromptINT: Using Prompt Leaks as a New OSINT Source

• SOC Fortress
  How I Caught a certutil Attack on My Open-Source SIEM

• THE Security Insights Show
  The AI & Security Insights Show Episode – 000 | Just the Security Savages you know.

• Three Buddy Problem
  A Thousand Agents Walk Into Hugging Face

Malware analysis

• Darrel Virtusio and Subhajeet Singha at Acronis
  Cambodia-focused cluster uses multistage infection chain with localized lures

• Ilyas Makari at Aikido
  Popular code generator for TanStack Query hit by supply chain worm

• Cellebrite
  Intro to Android Mobile Reverse Engineering

• James Hodgkinson at Cisco’s Talos
  JavaScript obfuscation: From party trick to phishing kit

• Dominik at R136a1
  SLEEPWALKER: A Passive Backdoor With Its Own Command Language

• Andrey Pautov at InfoSec Write-ups
  Assembly for Malware Analysis

• Vini Egerland at Netskope
  EtherHiding in the Browser: ClickFix Chain Ends in Amatera

• Proofpoint
  Carry-On Compromise: TA4922 Packs PackClient

• Shubho57
  Analysis of a javascript file leads to a highly malicious stealer

• Zhassulan Zhussupov

  • Malware development trick 63: modifying PE version metadata and icon. Simple C example
  • Malware development trick 64: PE file bloating and overlay data. Simple C example

Miscellaneous

• Anton Chuvakin
  Stop Building a 2003 SOC with AI: Local Context, Failure Modes and Your Path (Part 3)

• Cellebrite
  Cellebrite Brings Battlefield Intelligence to the Armed Forces with Launch of Portable Tactical Extraction Kit (C-TEK)

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 08/24/26

• Eoghan Casey at DFRWS
  Digital Forensics Conference USA 2026 Highlights

• Dr. Neal Krawetz at ‘The Hacker Factor Blog’
  C2PA and Pixel Glitter Milk

• Forensic Focus

  • Speed Against The Backlog: What’s Slowing You Down And How To Fix It
  • 10 Best Practices For AI-Assisted Investigations: A Guide For Legal And Compliance Teams
  • Digital Forensics Round-Up, August 26 2026
  • How Semantics 21 Are Using Global Intelligence To Pre-Categorise Up To 70% Of Investigations
  • Walk A Mile In Their Shoes: The Hidden World Of The Digital Forensic Investigator

• Heather Barnhart at Smarter Forensics
  AI-Assisted. Human-Led. Why DFIR Needed Its Own AI Frameworks. 

• Josh Brunty
  CTF Training

• Magnet Forensics
  Investigating at scale: Lessons from three DFIR leaders

• Raju Chekuri at Netenrich
  The Feedback Loop: Empowering Detection Engineering

• Sekoia
  AI Agents in the SOC: 5 Production Questions To Ask Beforehand

Software releases/updates

• Binalyze
  Binalyze AIR 5.25

• Canadian Centre for Cyber Security
  Assemblyline 4.7.4.13

• David Augros
  sigwood v0.6.0

• Didier Stevens
  Update: base64dump.py Version 0.0.31

• Digital Sleuth
  winfor-salt v2026.12.2

• Doug Burks

  • ohmypcap v4.1.0
  • so-crates v4.1.0

• Elcomsoft
  Elcomsoft System Recovery 8.38: Built-In BitLocker TPM Exploit Library, Browser Artefact Extraction, and Imaging Checksums

• Foxton Forensics
  Browser History Examiner — Version History – Version 1.23.5

• Get-Sybers
  DX_DFIR v0.5.0 — minimal hardened containers, offline packaging, CAR logic + per-OS validation

• Joey Victorino
  phylaram PhylaRAM v0.1.0-alpha (pre-release)

• LEAPPs

  • ALEAPP v2026.3.2
  • iLEAPP v2026.3.2
  • RLEAPP v2026.3.1
  • VLEAPP v2026.3.1

• Marco Neumann at ‘Be-binary 4n6’
  Introducing Peach: A Companion for crush forensics, Built for Logs

• Metadata Forensics
  HEART by Metadata Forensics Version 2.1.0.2

• MISP
  MISP v2.5.45 released – Overmind Everywhere, LDAP Reworked, Security Hardened and Many Fixes

• OpenCTI
  7.260828.0

• Renzon Cruz
  irflow-timeline IRFlow Timeline 1.0.12

• WithSecure Labs
  Chainsaw v2.16.5

• Yamato Security
  suzaku v2.0.1 – El Niño Release

• Yaniv Radunsky
  DFIR Companion v0.36.0