Forensic Analysis

• ADF Solutions
  Finding Evidence After an App Is Deleted

• Alexis Brignoni at LEAPPs Blog

  • The VLEAPP Revival. Reading the Whole Head Unit.
  • Powerlog Timestamps, Offsets, and a Clock That Thinks It’s 1971
  • You down with MMKV?

• Andrew Garrett & Owen Garrett
  Are You Receiving the Native File or a Curated Version in Discovery?

• Ian Whiffin at DFIR Review
  BrowserState.db last_viewed_time?

• Forensafe

  • Android Privacy Dashboard
  • Windows Setup Installation Logs

• Kenneth G. Hartman at Lucid Truth Technologies
  Share Link Forensic Artifacts: What a Share Link Records, and What It Doesn’t

• Kevin Pagano at Stark 4N6
  Pouring Pints – Untappd for Android Analysis

• MII Cyber Security

  • Turning Linux Host Data into Forensic Evidence with UAC (Unix-like Artifact Collector) and DFIR…
  • Hunting the Evil : A Practical Guide to Linux Threat Hunting — Part 3

• Ovie Caroll
  SAIDI in the Inbox: When the Account Sent It, but the Person Did Not Write It

• S.Nakano
  Don’t Make AI Your Forensic Analyst

• The DFIR Report
  BengalSEO Part 1: Anatomy of the Operation

• ThinkDFIR
  Are we going to stop calling it Amcache??

• Tim Korver at ‘Thesis Friday’
  Thesis Friday #27: Backward reasoning from a provable endpoint

Threat hunting/threat intelligence

• 0xMatheuZ
  Singularity Rootkit: Evading Elastic Defend Module Load Detection

• Hunter Schwartz at Aikido
  The dark figure of supply chain detection

• Larry Cashdollar at Akamai
  Analyzing a Go-Based IoT Self-Propagating DDoS Botnet

• ASEC

  • Kim Sooki again? This time, it was disguised as a request for seafood ingredients
  • Attack Cases in Korea Involving the Installation of Radmin and UltraVNC

• Ayelen Torello at AttackIQ
  Updated Response to CISA Advisory (AA25-071A): #StopRansomware: Medusa Ransomware

• AWS Security

  • Incident response guide for AWS CloudTrail investigations – Part 1
  • Incident response guide for AWS CloudTrail investigations – Part 2

• Rebecca Harpur at BlackFog
  The State of Ransomware: August 2026

• Mayank Parmar at BleepingComputer
  Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

• Brad Duncan at Malware Traffic Analysis

  • 2026-09-01: Essential macOS Stealer infection
  • 2026-08-31: Files for an ISC diary (Guildma/Astaroth infection)

• Brian Krebs at ‘Krebs on Security’
  FBI Probes Service Selling 153M+ Drivers Licenses

• BushidoToken
  UK Cybercrime Journal: ExfilSquad Emerges

• Alex Gartner at Censys
  So Your CFO’s Phone Has Been Pwned: A DFIR Journey

• CERT-AGID

  • Falso rimborso TARI sfruttato nelle nuove campagne di phishing ai danni di PagoPA
  • Sintesi riepilogativa delle campagne malevole nella settimana del 29 agosto – 4 settembre

• Check Point

  • Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
  • 31th August – Threat Intelligence Report
  • Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

• Reegun Jayapaul, Mohammed Fayiz, Hodlur Shravan, and Brian Hussey at Cyderes
  Inside an Indian Data Brokerage Running on Unauthorized KYC Access

• Cyfirma
  Weekly Intelligence Report – 04 Sep 2026

• Dark Atlas
  DragonForce Ransomware Analysis: Inside a Verified Windows Locker

• Martin McCloskey at Datadog Security Labs
  Password spraying campaign targets AWS root user accounts across 150+ organizations

• Brian Donohue and Oren Biderman at Daylight Security
  A Defender’s Guide to the Hugging Face Intrusion

• Disconinja
  Weekly Threat Infrastructure Investigation(Week35)

• Dzianis Skliar
  Internal OSINT: Post-Compromise Reconnaissance Beyond BloodHound

• Elastic Security Labs

  • How to correlate Kubernetes audit logs with container runtime data
  • REVSTEALER ramps up: analysis of up-and-coming infostealer
  • Linux Detection Engineering – Fileless Execution

• Eric J. Taylor at Barricade Cyber Solutions

  • Netflix Look-Alikes on GitHub.io: What Executives and IT Teams Should Know About GitHub Pages Phishing
  • Inside Department No. 4: How Russia’s GRU Trains Cyber Operators, and Why It Matters for US Business

• Erik Hjelmvik at Netresec
  OT Networks Still Need Monitoring

• Martin Chlumecký and Luis Corrons at Gen
  The NDA Was the Payload: Inside Phantom Deal, a Fake Acquisition Fraud Campaign

• Google Cloud Threat Intelligence
  Financially Motivated Threat Actor BREEZE COMET Targets Brazil

• Viacheslav Shevchenko and Brandon Tan at Group-IB
  The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action

• Ryan Voit at GuidePoint Security
  Attacking and Defending SCOM: Management Server Relay and Obtaining Run As Credentials

• Halkyn Security

  • How the Stack Works in Assembly Language
  • Building a Threat Hunting Business Case
  • Insider Threat Investigation: Evidence and Process
  • SSH Forensics: What an Intrusion Leaves Behind
  • Writing a Threat Hunting Hypothesis That Works
  • Investigating Self-Hosted LLM Systems on Linux
  • Building a Quick Linux Host Timeline
  • Autopsy Plugins for Linux Evidence

• Hunt IO
  Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

• Loay Salah at InfoSec Write-ups
  WebStrike Blue Team Lab (CyberDefenders)

• Intel 471
  Chinese-speaking threat actors targeting Mexican Android users with remote access Trojan

• Invictus Incident Response
  AI-Generated BEC Phishing from a Compromised Mailbox | Invictus Incident Response

• Andrew Heller at Lares
  Technical Analysis of the Rockstar Games Compromises: Exploit Chaining and Zero Trust Failures (2018–2026)

• Chris Botelho at LimaCharlie
  Threat Hunting to Detection Engineering, Part 2: Validating Rules Against Live Malware with Claude and LimaCharlie

• Microsoft Security

  • Counterfeit installers to system compromise: Tracking a deceptive software download campaign
  • Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
  • ASCII smuggling crosses over from AI prompt injection to phishing evasion

• Roberto Rodriguez and Neha Hudait at NVIDIA
  Building an Adaptive Agentic Cybersecurity System with NVIDIA Nemotron

• Palo Alto Networks

  • An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
  • Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

• Recorded Future
  H1 2026 Malware Vulnerability Trends

• Reversec Labs
  Virtual//Attack

• Ridgeline Cyber
  The Ransomware Step That Happens Before the Encryption

• SANS Internet Storm Center

  • YARA-X 1.20.0 Release, (Sun, Aug 30th)
  • The Coding-Agent Trap: When a “Free” LLM Endpoint Is the Adversary, (Mon, Aug 31st)
  • Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)
  • Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
  • numbat – AI agent observability, (Fri, Sep 4th)

• Sansec
  StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack

• Securelist

  • Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
  • Angry Birds: Toy Ghouls’ new toys

• Security Alliance
  SEAL weekly stats: August 25-31, 2026

• Securonix
  Clop Never Left: Inside the PTC Windchill Data Theft Campaign

• Siddhant Mishra
  Unmasking SideCopy and Mshta-Based Staging in South Asian Espionage

• Simone Kraus

  • Rhysida in Germany – From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat…
  • The Vishing Factory Behind ShinyHunters

• Sophos
  Ungentlemanly behavior: Insights into a ransomware operation

• Evelyne Diaz Araque at Stairwell
  From ClickFix to SilentEncryptor: A Simple Yet Destructive Path to Ransomware Deployment

• Start With Linux
  Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint

• Sygnia
  Fire Ant Evolves: From Hypervisors to Trusted Infrastructure

• Symantec Enterprise
  Node.js: Old Technique Makes a Comeback

• Quentin Roland at Synacktiv
  Simuler des services Active Directory légitimes sur un réseau interne : le cas de l’exploitation de GPO

• System Weakness

  • I Got Linux Logs Into Splunk. Then I Had to Prove They Were Actually Useful.
  • A 12-Step Process for IIoT (Industrial Internet of Things) Forensics (Kebande, IT Professional…
  • Memory Forensics with Volatility 3 — No Linux Required: TryHackMe’s “Profiles” Room

• Lefebvre Fabien and Vincent Fournier at Tehtris
  Threat Intelligence report – September 2025

• The Hunter’s Ledger
  Carrier Credential Harvesting Through a Customer’s Router

• ThreatMon
  Pakistan Cyber Threat Landscape Report 2026

• Adam G. Tomeo at Trellix
  The Invisible Office Break-In: Understanding Kerberoasting Attacks and SPN Exploits

• Lilly Mayo at TrustedSec
  waf-fu, or Some Log Replay Nonsense

• Lucie Cardiet at Vectra AI
  The Credentials Were Rotated. They Still Worked.

• VMRay
  Pivoting in MISP: From Individual Indicators to Broader Threat Context

• Блог Solar 4RAYS
  Solar 4RAYS: хроники DFIR в первом полугодии 2026 года

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-09-08

• Huntress
  Tradecraft Tuesday | Borrowed Faces, Borrowed Certs: Inside a Post-DEF CON Malware Campaign

• Magnet Forensics

  • Cyber Unpacked S3:E5 // What to expect when you’re (not) expecting an incident
  • From tip to action: Managing NCMEC cyber tips at scale

Presentations/podcasts

• Dr Josh Stroschein
  In-Memory Unpacking & PE-Sieve Analysis | Packing & Obfuscation Lesson 04

• Endace
  Integrating CrowdStrike NG SIEM with Endace Always-on Packet Capture

• Huntress

  • BREAKING: Rogue ScreenConnect Installations Across Unrelated Hosts
  • The Incident Report Timeline in Huntress ITDR

• Magnet Forensics

  • From footage to evidence: Introduction to video forensics and media authentication
  • Ask Me Anything: Strengthening eDiscovery with digital forensics

• Monolith Forensics

  • 5 Customer-Favorite Monolith Features: Relay, Task Dashboard, and Analytics [Monolith Mondays]
  • Editor Templates – Monolith Settings

• MSAB
  #MSABMonday – Exclude Keywords

• MyDFIR
  You Built the Lab. Can You Investigate the Alert?

• Paraben Corporation

  • Micro Webinar – Transforming Data into Intelligence with Report Generator AI
  • AI Report Generator Tutorial – Free Tool

• Proofpoint
  Intercepted: How Hackers Take On the Cloud

• Richard Davis at 13Cubed
  Windows Forensics on a Mac?! You Have to See This!

• SANS Cyber Defense
  Keynote: GenAI as an OSINT Force Multiplier

• Team Cymru
  Ironbridge CISO Consulting’s Jim Almerico on the end of AI euphoria and the flaws emerging

• Three Buddy Problem
  Three Secret AI Civilizations Rose and Fell. Nobody Checked the Logs.

• Watson Infosec
  COPILOT HUNTS A RAT

Malware analysis

• ASEC
  “Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing

• Chamindu Pushpika at ChamX
  Anatomy of SystemOptimizer – A BYOVD EDR Killer with a UAC Bypass

• Julio Guapo Menezes and Miguel Salazar at Group-IB
  Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

• Allen Golbig at Jamf
  Contagious Interview steps outside the developer workflow

• Netskope

  • Python NodeStealer: AI-Assisted to Full Spyware
  • Malware on the Blockchain: An Ongoing Campaign’s New WebRTC Twist

• Rapid7
  DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

• Pavel Bukhtenko at Securelist
  ValleyRAT masquerading as adware

• Shubho57
  Analysis of a sample leads to the activities atrributed to a Wiper

• Kush Pandya at Socket
  13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

• ThreatFabric
  Uncovering StreamRat: From Meta Ads to Full Device Takeover

• Zhassulan Zhussupov

  • Malware shellcode delivery via signal – part 5. Physics-guided AI demodulator. PyTorch example
  • Malware development trick 66: TLS callbacks before main. Simple C example

• Шифровальщики-вымогатели The Digest “Crypto-Ransomware”
  TargetZimbra, Elock

Miscellaneous

• Chris Tappin at 5∩6
  A New Model of Incident Response

• Amnesty International Security Lab
  Strengthening the tools behind consensual forensics investigations: Mobile Verification Toolkit & Android Quick Forensic Secure Design Assessment 

• Cellebrite

  • How To Build Digital Twin Sensors Using Agentic AI with AWS Kiro
  • Mobile App Compliance Without Compromise: Faster Testing with Confidence
  • Embedded Debugging with Arm DS IDE: Secure Tools & Techniques for App Developers
  • Virtualize Raspberry Pi 4: Arm Virtual Hardware Quickstart Guide

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 08/31/26

• Mike Nichols and Jamie Hynds at Elastic Security Labs
  Data access: the hidden cost of security vendor lock-in

• Forensic Focus

  • Techno Security & Digital Forensics Conference Returns To San Diego October 20–22, 2026
  • Digital Forensics Round-Up, September 02 2026
  • Semantics 21 Asks The Uncomfortable Question Every Review Team Should Be Asking
  • Cellebrite Genesis: Turn Digital Evidence Into Actionable Leads In Minutes
  • Belkasoft Named A Major Player In The IDC MarketScape: Worldwide Digital Forensics Platforms 2026 Vendor Assessment
  • “The Skills And Resilience To Do One Of The Hardest Jobs In Policing” — Why This DFIR Recruitment Language Gets The Evidence Wrong
  • Forensic Focus Digest, September 04 2026

• Jurjen Harskamp at Hunt & Hackett
  Recent cyberattacks show how little organisations really know during an incident

• IC3
  Communicating Under Pressure: Best Practices for Service Providers

• Kevin Pagano at Stark 4N6

  • Forensics StartMe Updates (September 2026)
  • The Evidence Locker v2 – Now with File Search

• Steve Gemperle at Magnet Forensics
  Digital fraud in a connected world: how it works and how to prevent it

• Matthew Plascencia
  Belkasoft X vs Oxygen Forensic Detective vs ADF Pro…

• NSB Cyber
  #NSBCS.140 – What Policing Taught Me About Ransomware Investigations

• Rob T. Lee
  Investigation template defined for AI accidents? (Hugging Face OpenAI Updates, Risks)

• Sysdig
  Defending the battlefield: Stateful detections for an agentic threat landscape

Software releases/updates

• 13Cubed
  Abeebus 2.1

• Arsenal Recon
  Swap Recon Changelog – v1.0.0.16

• Belkasoft
  Meet Belkasoft X v2.12! This release brings SQLite database classification and offline translation with BelkaGPT, refined Android acquisition, deeper artifact extraction across platforms, and a range of other powerful improvements.

• Canadian Centre for Cyber Security
  Assemblyline 4.7.4.17

• David Augros
  sigwood v1.0.0

• DFIRe
  1.8.1 — September 2, 2026

• Elcomsoft
  Elcomsoft Quick Triage 2.2 adds a timeline, a plugin system, and file system snapshots

• Exterro
  FTK Imager 8.3

• Get-Sybers
  DX_DFIR v0.6.0 — materialized MITRE CAR

• Ghassan Elsman
  Crow-Eye v0.13.0 Registry Depth & Timeline Coverage

• LEAPPs
  VLEAPP v2026.3.2

• Metaspike
  Forensic Email Intelligence 2.3.916

• vol-rs v1.0.0

• North Loop Consulting
  Maps! Galleries! Speed! Sedgwick Version 2.0!

• OpenCTI
  7.260904.0

• Xways

  • X-Ways Forensics 21.9 Beta 3b
  • NSRL RDS hash sets