Forensic Analysis

• Eoghan Casey and Francesco Servida at DFRWS
  Introducing Container Hashes for AFF4-L

• Dr. Neal Krawetz at ‘The Hacker Factor Blog’
  SEAL Tested, Hardened, and Honest

• Michael Karsyan at Event Log Explorer blog
  7 Best Windows Event Viewer Alternatives for Log Analysis in 2026

• Flare
  Sisterhood of the Traveling Packets: How 1,300 Practitioners Hacked a Ransomware Gang’s Leak Site (Flare CTF Writeup)

• Forensafe

  • iOS Life360
  • iOS App Snapshots

• Satyender Yadav at ThreatBreach
  Story of a ZIP File

• Tim Korver at ‘Thesis Friday’
  Thesis Friday #28: What a busy phone forgets

Threat hunting/threat intelligence

• Abdulrehman Ali
  Charming Kitten APT Adversary Simulation

• Ryan Devendorf at Abnormal Security
  ORAX Conducts AiTM Without a Reverse Proxy

• Acronis
  Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

• ASEC

  • August 2026 Dark Web Issue Trend Report
  • August 2026 Dark Web Threat Actor Trend Report
  • August 2026 Dark Web Breach Incident Trend Report
  • August 2026 Threat Trend Report on APT Groups

• Eric J. Taylor at Barricade Cyber Solutions
  NightSpire Ransomware: Threat Actor Profile

• Ben Kapon at KELA Cyber

  • Could The Belsen Group Be Associated With ZeroSevenGroup?
  • Black Basta Leak: New Findings Reveal Victim Details
  • Anubis: A New Ransomware Threat

• BI.Zone
  Hunting Feral Wolf: new tools and techniques

• Bishop Fox

  • MikroTrick: Inside the RouterOS Takeover Chain
  • From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion

• Blackpoint Cyber

  • Threat Snapshot: LabubaRAT
  • ChainScript: Tracing a Node.js RAT Through the Blockchain

• Lawrence Abrams at BleepingComputer
  ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

• Brian Krebs at ‘Krebs on Security’
  Data Broker Radaris Loses Domains in Privacy Fight

• Bruno Oliveira at SVA Security Log

  • Inside TerminalFix: When “Prove You’re Human” Becomes Step One of a Ransomware Attack – Part 1
  • Inside TerminalFix: When “Prove You’re Human” Becomes Step One of a Ransomware Attack – Part 2

• Censys
  Mythic C2 Activity at Internet Scale

• CERT-AGID

  • Falso “Bonus Vacanze” dell’Agenzia delle Entrate ruba dati personali
  • Sintesi riepilogativa delle campagne malevole nella settimana del 12 – 18 settembre

• Chainalysis
  DPRK and Iran are Leading a 5.2x Surge YoY in Blockchain-Assisted Cyberattacks

• Check Point

  • 14th September – Threat Intelligence Report
  • Fake Voicemail Transcript Emails Target 7,800+ Organizations in Large-Scale Credential Phishing
  • AI Threat Landscape Digest: July–August 2026

• Takahiro Takeda, Jordyn Dunk, Michael Szeliga at Cisco’s Talos
  Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin’s AI use

• CloudSEK
  GHAPPIER – One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK’s PolinRider campaign

• Josh Varden at Cofense
  Chatbot Conundrum: Phishing Attempts of OpenAI’s ChatGPT

• Maddie Stewart at CrowdStrike
  PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

• CTF导航
  夜鹰转向：APT-Q-95组织被曝攻击俄罗斯企业，Exchange后门GhostContainer再度现身

• Cyfirma
  Weekly Intelligence Report – 18 Sep 2026

• Damien Lewke
  Harness Racing

• Datadog Security Labs

  • Mapping out your unknown: A threat hunter’s guide to GitHub
  • Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

• Sergio Albea at Detect FYI
  Threat Hunting with JA4/JA4S (+ Practical KQL Queries)

• Disconinja
  Weekly Threat Infrastructure Investigation(Week38)

• Elastic Security Labs

  • The extension you never installed: KREMLIN forges Chrome’s own integrity checks to steal banking sessions
  • One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless

• Esentire
  GhostCode: Dissecting a Novel Device Code Phishing Kit

• Ryan Marshall at Foregenix
  Magento “StyleSmuggler” Zero-Day (CVE-2026-75650): Patch Guide

• g0njxa
  Approaching stealers devs: a brief interview with Remus

• Gen

  • Free AI, at the Price of Your Prompt
  • Is Your Home Internet Feeding the AI Data Race?

• Group-IB

  • Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
  • The Adversary We Are Fighting Is Now a Full-Force Industry: Inside cybercrime’s new economy
  • HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

• Jean-Pierre Mouton at GuidePoint Security
  EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight

• Halkyn Security

  • Reading Control Flow in Disassembly
  • What a Threat Hunting Capability Really Costs
  • Access Logs and Intent in Insider Cases
  • eBPF Runtime Security Tools: A Responder’s View
  • Intelligence-Driven Threat Hunting in Practice
  • Shadow AI Discovery: Finding Inference Endpoints
  • Rolling Your Own IOC Scanner

• HP Wolf Security
  HP Wolf Security Threat Insights Report: September 2026

• Hunt IO
  SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia

• Shivangi Pandey and Matt Anderson at Huntress
  How Attackers Abuse VSS, and How Huntress Detects It

• IC3

  • Update on Government of Iran Cyber Actors’ Deployment of Telegram C2 to Push Malware to Identified Targets
  • North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe

• Kevin Hoganson and Mateusz Krzywicki at iVerify
  Proliferation of Coruna and DarkSword

• Yuval Moravchick at JFrog
  ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

• Keisuke Shikano at JPCERT/CC
  TSUBAME Report Overflow (Apr-Jun 2026)

• LastPass
  Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign

• Serhii Melnyk and Timmy Lister at LevelBlue SpiderLabs
  One Patch Behind: Nightmare-Eclipse’s ShieldCrash and the Defender Bypass That Won’t Stay Fixed

• Maltego
  Mapping North Korea’s Illicit Shipping Networks with GEOINT and Maltego

• NCSC
  Iranian cyber targeting of dissidents, activists and journalists

• Brandon Schwartz at Nebulock
  Hunt Mode: Your Network’s Adversary Might Be Poor Hygiene

• Obsidian Security

  • The OAuth Grants That Survive Offboarding
  • How Long Does It Take to Revoke SaaS Access After a Breach?
  • Open Weight Model Security Risks: What Kimi K3 Actually Changes for Defenders

• Ohad Zaidenberg
  The Attacker Is Not a Group. It Is a Supply Chain.

• Rafa Bono at Okta
  Detecting shadow AI agents with advanced posture checks

• Oleg Skulkin at ‘Know Your Adversary’
  415. Threat Actors Abuse IronPython to Deliver Malware

• Palo Alto Networks

  • Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
  • Atomic macOS (AMOS) Stealer Activity

• Recorded Future
  Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group

• Ridgeline Cyber
  Your Logs Have a Gap. That Is Not Evidence Anybody Deleted Them.

• Casey O’Brien at S-RM
  From AI to incidents: What the first half of 2026 tells us about the cyber threat landscape

• HuiSeong Yang and SeungHo Lee at S2W Lab
  Ransomware Landscape in H1 2026: Statistics and Key Issues

• SANS Internet Storm Center

  • Apple Updates Everything, (Mon, Sep 14th)
  • MacOS 27 – First Boot, (Tue, Sep 15th)
  • Scans Targeting Hospitality Applications, (Wed, Sep 16th)
  • HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
  • LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)

• Sansec
  Brevo supply chain attack hits 100k+ sites with WordPress backdoors and Clickfix malware

• Securelist

  • NightEagle targets Russian companies
  • The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents

• Security Alliance
  SEAL weekly stats: Sept. 8-14, 2026

• SentinelOne

  • Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
  • Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

• Silent Push

  • Silent Push Exposes North Korean IT Worker Recruiting Facilitators Through Discord Servers
  • Silent Push Tracks a Mass Phishing Operation Through Fast Flux

• SOC Fortress

  • Fill Your Threat Intel Graph and Run a Real Investigation in OpenCTI
  • The Rise of AI-Enhanced Phishing and Cloud Identity Theft
  • Make OpenCTI Catch Threats Live: Wiring Your SIEM to Your Threat Intel

• Socket

  • PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  • Happy Birthday, Shai-Hulud

• SOCRadar
  Agentic Ransomware: From Human-Operated to AI-Operated Attacks

• Marchelle David at Sophos
  ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

• Stephan Berger

  • Field Notes: From AV Alert to Impacket
  • Living Inside the Shell: zsh Modules on macOS

• Marco A. De Felice aka amvinfe at SuspectFile
  EXCLUSIVE: Storm introduces automated ransomware negotiations: AI enters the process, but humans remain behind the scenes

• Team Cymru
  From the Disk to the Flows: Ransomware Infrastructure Analysis

• The Raven File
  SETTRA RANSOMWARE

• Josh Rickard at THOR Collective Dispatch
  Open Season: Domain Profiling

• James McMurry at ThreatHunter AI
  AiTM Phishing: Scoring Identity Risk Is Not the Same as Stopping the Session

• ThreatMon
  Xan-RAT A Closer Look at Its Capabilities and Inner Workings

• Trellix

  • Impersonating the Boss: How Attackers Drain Your Active Directory
  • SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

• Elad Ghvarh at Varonis
  TrustSink: How a Rogue External MFA Provider Steals Passwords

• Yali Gottlib, Matan Haim, Itay Harel, and Tal Moriah at Wiz
  Building an AI Detection Engine That Understands Agent Intent

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-09-21

• John Hammond
  Payload Podcast 011 – Reunion

• Magnet Forensics

  • Using image classifiers to focus on what matters in investigations
  • Updating event-driven collections for faster DFIR investigations

• SANS

  • Launch Party: Dynamic Incident Response Book
  • Takedowns Are Not Kills: Inside the Cybercrime Infrastructure Supply Chain

• Spur Intelligence
  Beyond Human vs. Bot

Presentations/podcasts

• Behind the Binary by Google Cloud Security
  EP29 Binary Similarity in the LLM Era with Jonas Wagner and Endre Bangerter of ThreatRay

• Belkasoft
  AI in Forensics: Why the Human Investigator Still Makes the Call | BelkaGPT

• Blue Team بالعربي

  • Understanding Kerberos Authentication: From Login to Ticket
  • Phishing Analysis: Emails & URLs & Attachments

• InfoSec_Bret
  IR – SOC153 – Suspicious Powershell Script Executed

• John Hammond
  My Browser Cache Got Infected

• Magnet Forensics

  • Legal Unpacked S1:E12 // Presenting the proof: Incorporating digital evidence into opening statements and closing arguments
  • Ask Me Anything: Running faster, defensible internal investigations with digital forensics

• Monolith Forensics

  • 5 Evidence Tracking Pitfalls Monolith Helps Solve [Monolith Mondays]
  • Item Number Formats – Monolith Settings

• Mostafa Yahia

  • Investigating Microsoft Windows Threats – Agenda
  • investigative pivoting – SOC

• MyDFIR
  He Applied to Hundreds of SOC Jobs | Here’s What Finally Changed

• OpenSourceMalware
  The OpenSourceMalware Show #21

• Parsing The Truth: One Byte at a Time Podcast
  TN vs Amad Gatlin: Part 2

• Proofpoint
  Once in a BlueMoon: Inside the Exploit Chain Four Espionage Groups Adopted in Days

• SANS Cyber Defense

  • OSINT for Crisis Response: Investigating Assassination
  • Build Your Own Search Engine: Flip the Script on Dorking

• Secure View

  • DATAPILOT Lightray: Triage entire text chains in seconds.
  • How to bypass Apple’s Stolen Device Protection for Mobile Forensics

• Stephan Berger
  BSides Frankfurt: Deconstructing Modern macOS Initial Access Vectors

• Team Cymru
  Efani’s Mark Kreitzman on the SIM swap that cost Marks and Spencer 350 million euros

Malware analysis

• Ashwath Ram at K7 Labs
  From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

• OpenSourceMalware
  WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

• Ransom-ISAC
  MacOS ClickFix AMOS Campaign

• Shubho57
  Analysis of OpnKey Ransomware

• Scott Nusbaum at TrustedSec
  Unpacking a laZzzy Donut

• Alexandre Côté Cyr and Romain Dumont at WeLiveSecurity
  Beware the SparroWock: The backdoor that bites, the commands that catch

• Zhassulan Zhussupov
  MacOS malware persistence 13: man.conf. Simple C example

• Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega at Zimperium
  RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts

• Sudeep Singh at ZScaler
  Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Miscellaneous

• Adam at Hexacorn
  Win11_26H2 build xta phantom libraries

• Emi Polito at Amped
  How to Prepare Compelling and Safe Digital Multimedia Evidence for Court with Amped Replay

• Berla

  • iVe Generation 5: New Acquisition Platform
  • iVe Generation 5: Hardware Deployment System
  • iVe Generation 5: Redesigned Resources
  • iVe Generation 5 Hardware: Built to Adapt

• Cellebrite
  Cellebrite Expands Global Digital Community, ‘The 101,’ for Digital Forensics and Investigative Professionals

• CyberBoo
  Microsoft Defender for Office 365 Part 14: Migrating to MDO from a Third-Party Secure Email Gateway

• Decrypting a Defense
  Fighting Beyond Flock, Cell Tower Dump Decision, Government Subpoenas for Digital Corporate Records & More

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 09/14/26

• Disconinja
  CAPEsoloをWindows 11で構築してみた / Getting Started with CAPEsolo on Windows 11

• Forensic Focus

  • Forensic Imaging Is A Workflow Problem, Not Just A Speed Problem
  • The Excluded Evidence Problem Semantics 21 Is Exposing
  • Semantic Search Vs Keyword Search In Digital Forensics – Why It Matters | BelkaGPT
  • Steganos Data Safe Evolves – New Shortcuts for Decryption
  • A Stab Vest Is Protection. DFIR “Resilience” Is Not.
  • Forensic Focus Digest, September 18 2026

• Jason Yung
  由Azure Sentinel＋Logic App＋AI砌一套自動化 SOC Playbook — 第一篇：架構設計

• Kate Carruthers
  When the Test Becomes the Threat Model

• Magnet Forensics

  • Drone forensics: a guide for investigators
  • Introducing PDF Analysis in Magnet Verify: Authenticity and provenance for document evidence

• Amber Schroader at Paraben Corporation
  The Four Foundation Questions of Digital Forensics

• Rob T. Lee
  Secure What Is Already Here: The doom scenarios deserve an investigation

• Ryan Benson at Hindsight Foundry
  Introducing Hindsight Foundry

• Salvation DATA
  CDR Analysis: Finding Patterns and Investigative Leads in Communication Data

• Sekoia
  AI in the SOC: EU AI Act and Technology Sovereignty

• Taggart Tech
  Everone Is Lying To You For Money

Software releases/updates

• Berla
  Introducing iVe Generation 5

• Brian Maloney
  OneDriveExplorer v2026.09.15

• Canadian Centre for Cyber Security
  Assemblyline 4.7.4.20

• DFIRe
  1.9.0 — September 15, 2026

• Digital Sleuth
  winfor-salt v2026.12.5

• GCHQ
  CyberChef v11.5.0

• LEAPPs

  • ALEAPP v2026.4.1
  • iLEAPP v2026.4.2
  • RLEAPP v2026.4.1
  • VLEAPP v2026.4.1

• Metadata Forensics
  HEART Version 2.2.0.0

• Olaf Hartong
  Sysmon Modular, a new toolkit for building and tuning your configuration

• OpenCTI
  7.260917.0

• Passware
  Steganos Data Safe Evolves – New Shortcuts for Decryption

• Ryan Benson
  unfurl v2026.09

• Volatility Foundation
  Volatility3 Volatility 3 2.28.2

• Xways
  X-Ways Forensics 21.9 SR-1

• Yamato Security
  Hayabusa v4.1.0 – Suzumushi Release

• Yaniv Radunsky
  DFIR Companion v0.37.0