Forensic Analysis

• Belkasoft
  Apple Biome Forensics: Artifacts, Locations, and SEGB format

• Dr. Neal Krawetz at ‘The Hacker Factor Blog’
  Validation Workflows

• Elcomsoft

  • IoT Forensics on the Rise: Extracting More Apple Watch, Apple TV 4K Devices
  • Low-Level Extraction of the Apple Watch S4/S5
  • Low-Level Extraction the Apple TV 4K 2nd Generation

• Kenneth G. Hartman at Lucid Truth Technologies
  How to Prove a Document Existed on a Given Date

• LEAPPs Blog

  • Reading the iPhone Knowledge Graph, and Checking Its Work
  • Meet GLEAPP, Media Triage Built for the Backlog

• Jamie Mamroe and Matt Arbaugh & Joel Bowers at LevelBlue SpiderLabs
  File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)

• S.Nakano
  How Do You Investigate Windows Event Logs?

• Ahmad Zaidi Said, Elsayed Elrefaei, Kaspersky Security Services at Securelist
  Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

• Tim Korver at ‘Thesis Friday’
  The stop rule: absence needs proven coverage – Thesis Friday #29:

Threat hunting/threat intelligence

• Adam at Hexacorn

  • 1 little known secret of WinCsFlags.exe
  • 1 little known secret of aidd.dll
  • 1 little known secret of UIEOrchestratorStub.exe

• Oliver Smith at Aikido
  Graphalgo campaign spreads to Terraform providers and Go Modules

• Any.Run
  CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access

• Arctic Wolf
  The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

• ASEC

  • August 2026 Infostealer Trend Report
  • Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)

• Jon Williams at Bishop Fox
  Master Key Included: Detecting SolarWinds ARM CVE-2026-28326

• Nevan Beal, Sam Decker & Andi Ursry at Blackpoint Cyber
  RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser Theft

• Brad Duncan at Malware Traffic Analysis

  • 2026-09-17: Seven days of scans and probes and web traffic hitting my web server
  • 2026-09-15: SmartApeSG ClickFix to unidentified RAT to MeshAgent
  • 2026-09-14: Backdoor using ScreenConnect from malicious emailt
  • 2026-09-24: Files for an ISC Diary (Macfinger ClickFix activity)

• Brian Krebs at ‘Krebs on Security’
  U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

• BushidoToken
  UK Cybercrime Journal: Manchester Airport Group Breached by FulcrumSec

• Censys
  Introducing Censys CLI Skills: AI-Assisted Investigations at Scale

• CERT Polska

  • Inside a multi stage toll fraud operation targeting Poland
  • MikroTrick: technical analysis, disclosure process, and the use of LLM agents

• CERT-AGID

  • In corso un phishing a tema “bollo auto” ai danni di ACI
  • MintsLoader via PEC: falsi solleciti di pagamento per diffondere malware
  • Falso sito del Servizio Sanitario Nazionale distribuisce StreamRat su Android e XWorm su Windows
  • Sintesi riepilogativa delle campagne malevole nella settimana del 19 – 25 settembre

• Check Point
  21st September – Threat Intelligence Report

• Iris Suaner at Cofense
  From Payment Plan to Ransomware – Inside a Global Group Attack

• Ctrl-Alt-Intel
  Russian and Allied Government Systems Compromised in Targeted Campaigns

• Cyble
  Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions 

• Andrea Draghetti at D3Lab
  An Italian Phishing Campaign Delivering an iOS Exploit Chain

• Dark Atlas
  Rokarolla Android Banking Trojan: Analysis & Detection

• Darktrace

  • Detecting Rogue AI Agents: When Enterprise Agents Turn to Hacking
  • Agent Hijacks: How Conversation History Poisoning Can Turn AI Agents Into Attackers

• Detect FYI

  • The Sound of Silence: SAP SM49/SM69 and the OS Commands Your SIEM Never Hears
  • Hunting Invisible Unicode in Emails (+ KQL Queries)

• Elastic Security Labs
  Cloud Threat Emulation on Autopilot: Context is Everything

• Erik Hjelmvik at Netresec
  Unmasking Malware Families

• Esentire
  AI Attacks Now Move With Little Human Involvement. Controlled Autonomy Is How Defense Moves Just As Fast.

• Eyal Sela at Gambit Security
  Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign

• Eye Research

  • AI vulnerability discovery using the Kitten process: How we found CVE-2026-75754
  • Rise of the Jev-Clones

• FalconFeeds
  CL0P: From Zero-Day Weaponization to Pure Extortion and the Underground War with ShinyHunters

• Flare

  • TWEAKOS Uncovered: A Telegram-Driven Stealer and C2 Ecosystem for Discord and Telegram Tokens
  • Real-World Impact of Takedowns on the Infostealer Market

• Flashpoint
  Process Parameter Poisoning: Inside a Novel EDR Evasion Technique

• Fortinet
  Cloud Intrusions Now Move at Machine Speed

• g0njxa
  Approaching stealers devs: a brief interview with Warden

• Gaetan Ferry at GitGuardian
  GitHub App Private Keys: 474 Leaked Keys Exposed

• Google Cloud Threat Intelligence
  ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

• Andrew Thompson, Mark Mager at GreyNoise
  Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

• Halkyn Security

  • Arithmetic Instructions and CPU Flags
  • Threat Hunting Workflow and Governance
  • Reading Prompt History as Evidence
  • Reading the Linux Process Tree During Triage
  • Network Threat Hunting: Beacons, DNS and TLS

• Huntress

  • The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
  • Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
  • OAuth Token Theft Through Microsoft’s Front Door | Huntress
  • Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
  • The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

• Evgen Blohm at InfoGuard Labs
  Iranopasmigirim – Unmasking an ever-evolving Espionage Campaign Against Iranian Dissidents – Part 1

• Intel 471
  2026 SANS Threat Hunting Survey: Adversaries Prizing Stealth over Speed? Defenders Cooling on AI?

• Adam Goss at Kraven Security
  Detection as Code: A Pipeline That Won’t Flood Your SOC

• Matthew Coady at LevelBlue SpiderLabs
  Enumerating Users and MFA via Microsoft’s Password Reset Portal

• Manifold

  • Ask: human approval on every AI coding agent
  • third-party.com Placeholder Domain Now Serves ClickFix
  • Placeholder Domains Whose Ads Serve Scams

• Microsoft Security

  • Unmasking EvilTokens: Getting to the root of device code phishing
  • Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
  • Storm-3168: Agentic-driven cloud attacks using compromised service principals

• Eugenio Benincasa at Natto Thoughts
  HuWang—“Protect the Network”: Inside China’s Largest Nationwide Live-Fire Cyber Exercise

• Ohad Zaidenberg
  What Attackers Actually Do With AI

• Oleg Skulkin at ‘Know Your Adversary’
  416. A Curious Case of Inhibit System Recovery

• OpenSourceMalware
  PolinRider is A/B Testing its Way Past Your Detections

• Margaret Kelley at Palo Alto Networks
  From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies

• Proofpoint
  Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts

• Push Security
  The numbers behind ClickFix attacks in H2 2026

• Recorded Future
  The Lure Isn’t The Malware. It’s Your Logo.

• Robin Dost at Synaptic Systems
  North Korea’s Hangro Revisited

• Ryan Fetterman at Cisco’s Talos

  • The Closed Quorum: Inside the first reported autonomous AI C2 implant
  • Introducing CAIRN: Frontier tracking for AI-integrated malware

• SANS Internet Storm Center

  • TerminalFix: PNG Steganography, (Mon, Sep 21st)
  • Macfinger ClickFix campaign, (Tue, Sep 22nd)
  • The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
  • One URL, Three Different Tricks, (Thu, Sep 24th)
  • A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

• Security Alliance
  SEAL weekly stats: Sept. 15-22, 2026

• Akshay Gaikwad and Aaron Beardslee at Securonix
  TASK#STOMP: PowerShell Backdoor for Document Theft and Remote Access

• Sekoia
  Exvicy: A Copycat of the ErrTraffic Malware Distribution Framework

• SOCRadar

  • Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures
  • Dark Web Profile: Blue Locker Ransomware

• Spur Intelligence
  Mellowtel: The Hidden Proxy Network Inside Everyday Browser Extensions

• Stephan Berger
  The .zshrc.zwc You Forgot to Check

• Sygnia
  When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group

• Crystal Morin at Sysdig
  Risky identities continue to plague cloud infrastructures

• The Hunter’s Ledger
  Gotenberg CVE-2026-42589 Mass Exploitation and Cryptomining

• James McMurry at ThreatHunter AI
  Living Off the Land: A Valid Signature Is Not a Business Reason

• Jack Cable, Daniel Chiu, Francisco Pernice, Selena Zhang, James Anthony, Tetiana Bas, Gary Shen, Conrad Stosz, and Jacob Steinhardt at Transluce
  Early rogue AI agent activity and attempts to hack found on urlquery.net

• Trellix

  • The Hidden Risk: How Attackers Target Your Active Directory (And How to Stop Them)
  • Geopolitical Volatility and Infrastructure Resilience
  • The Industrialization of Deception: AI-Driven Threats
  • When the Directory Becomes the Weapon: Understanding NTDS.dit Theft

• Daniel Kelley at Varonis
  Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

• Damien Cash and Tom Lancaster at Volexity
  Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

• Sina Kheirkhah (@SinSinology) at watchTowr Labs
  Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

• ZScaler

  • Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation
  • Threat Actors Use Google Ads To Target Ledger Users

• Блог Solar 4RAYS
  Blockchain и ВПО: децентрализованное зазеркалье

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-09-28

• John Hammond
  Payload Podcast 012 – Yarden Shafir

• Magnet Forensics
  Mobile Unpacked S4:E9 // Siri-ous intelligence: What iOS 27 means for digital forensics

• Sygnia
  When IT Support Is the Attack: Defending Law Firms Against Silent Ransom Group

Presentations/podcasts

• Adversary Universe Podcast
  China’s 15th Five-Year Plan: What You Need to Know

• CQURE Academy
  CQURE Hacks #83: Attack on Active Directory Certificate Services (AD CS) – ESC16

• Huntress

  • Device Code Phishing Explained in 3 Minutes
  • How macOS Infostealers Trick Users Into Installing Them

• InfoSec_Bret
  IR – SOC154 – Service Configuration File Changed by Non Admin User (2026)

• Insane Forensics
  Water Attacks, Typhoons, and Worst-Day Planning in OT | OT Office Hours

• Magnet Forensics

  • Using image classifiers to focus on what matters in investigations
  • Updating event-driven collections for faster DFIR investigations

• Monolith Forensics

  • Strategies for Effective Expert Witness Testimony
  • Case Types – Monolith Settings

• Mostafa Yahia
  Module 4: Investigating Network Threats – Agenda

• MSAB
  #MSABMonday – Limited Extraction

• MyDFIR
  Why You Still Don’t Feel Ready for a SOC Job

• Open Source Forensics Lab
  Extracting iOS Devices Using Oxygen Forensic Device Extractor (Archived)

• OpenSourceMalware

  • The OpenSourceMalware Show #21
  • The OpenSourceMalware Show #22

• Paraben Corporation
  Micro Webinar Apple Watch Data

• SANS Cyber Defense

  • OSINT Video Forensics: Conducting Video Investigations
  • Method Over Madness: The OSINT Targeting Revolution

• Three Buddy Problem
  Kernel Exploits in the iOS App Store, ShinyHunters Inside the FBI

Malware analysis

• DCSO CyTec
  Sauron Loader: A New Loader Lurking in Underground Forums

• Xiaopeng Zhang at Fortinet
  Uncovering a SectopRAT Variant Embedded in Legitimate Software

• Karsten Hahn at G Data Software
  OpenSUpdater Hides in Recompiled 7zip SFX

• Bruno Bijelić at Group-IB
  RemControl: AI Built the Overlays. Victims Lose their PINs

• Itochu Cyber & Intelligence
  PureRAT and PureLogs Campaign Targeting Japanese Organizations

• Jamf
  PamStealer adapts again: a move to Swift with a server-side decryption chain

• Deepa B at K7 Labs
  The Stealer Factory: Unpacking a Python-Based MaaS Infostealer Builder

• Karlo Zanki at Socket

  • MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
  • Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts
  • Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud

• Lenny Zeltser
  AI-Assisted Malware Analysis Tips

• Gabriele Orini at Malwarebytes
  Kothamine malware uses Tailscale’s tailcat to evade network detection 

• Rhys Downing at Ontinue
  Lunex Unmasked: A New Information Stealer Deployed Through BYOVD

• Ellis Stannard, Nick Smart, and Yashraj Solanki at Ransom-ISAC
  XCTDH Adopts Hash Hiding

• Lucija Valentić at ReversingLabs
  Malicious npm campaign targets developers integrating Twilio

• Sergey Puzan at Securelist
  MacSync under the microscope: new delivery methods and a new payload

• Shubho57
  Analysis of a VBScript Downloader

• Rohan Prabhu at Step Security
  Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes

• Janet Katile at Wordfence
  Inside a Malicious, Stealthy WordPress Must Use Plugin

• Zhassulan Zhussupov
  Malware analysis: part 12. Section entropy from scratch in pure C: a tiny packed/encrypted detector.

Miscellaneous

• Christopher Eng at Ogmini
  CISA IR Training – Ransomware Threat Hunting Workshop (IR309)

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 09/14/26

• Elan at DFIR Diva
  Techno Security & Digital Forensics Conference: October 20-22, 2026

• Forensic Focus

  • Finding Answers Faster: Genesis For Private Sector Investigations
  • Magnet Forensics Expands Collaboration With NCMEC To Strengthen Victim Identification
  • Radim Motycka, Founder, Proofsnap
  • How Semantics 21 Is Calling Time On Add-On Culture In Digital Forensics
  • Corrobora – Cross-Artifact Consistency Analysis For Windows Digital Forensics
  • Go Beyond The Basics With XRY Kiosk From MSAB

• Google Cloud Threat Intelligence
  Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure

• Jason Yung
  Building an Automated SOC Playbook with Azure Sentinel, Logic Apps, and Microsoft Defender — Part 1

• Jeffrey Appel
  How to track browser extension installations with Microsoft Defender

• Jesse Spangenberger at ‘Cyber Fenix DFIR & Technology’
  Metadata (Part 1): A Brief History

• Magnet Forensics

  • Collecting evidence faster than an alibi
  • 7 pitfalls of digital forensics (and how to avoid them)
  • From collection to clarity: Why Axiom and Griffeye Advanced are better together
  • A consistent DFIR approach to ransomware, BEC, data breaches, and threat hunting

• Matthew Plascencia
  Extracting Phone Data With Oxygen Forensic Device Extractor

• MII Cyber Security

  • Collecting and Reviewing Endpoint Logs with SentinelOne, Before Going Deep
  • SentinelOne Singularity Onboarding: Tenant Creation, Agent Deployment and a Lab Test

• Bineesh P at Seqrite
  Best Malware Analysis Platforms for Security Teams

• Kim Zetter at ZERO DAY
  US-Based Digital Forensics Firm Hid its Russian Ownership from U.S. Government Customers

Software releases/updates

• Alexandre Borges
  Malwoverview 8.2.0

• Binalyze
  Binalyze AIR 5.27

• Canadian Centre for Cyber Security
  Assemblyline v4.7.4.stable21

• DFIR-IRIS
  IRIS-Web v3.0.0-beta.2

• DFIRe
  1.10.0 — September 22, 2026

• Digital Sleuth
  winfor-salt v2026.12.6

• Doug Burks

  • ohmypcap v4.2.0
  • so-crates v4.2.0

• Elcomsoft
  iOS Forensic Toolkit 10.11: bootloader extraction for Apple Watch Series 4 and 5, Apple TV 4K 2nd Gen

• Halil Öztürkci
  DFIR Swarm

• Marco Neumann

  • crush-forensics v0.20.0
  • peach-forensics v0.9.0

• Martin Korman

  • Regipy 6.4.0
  • Regipy regipy-rs-0.1.0a2

• Microsoft
  msticpy ScanMalware TI Provider, Python 3.14 and dependency updates

• OpenCTI
  7.260921.0

• Ryan Benson at Hindsight Foundry
  Parsers for Gmail, Outlook Safe Links, Social Media IDs added in Unfurl

• SigmaHQ
  pySigma v1.5.1

• Stark4n6
  Arc2Lite v3.2.0

• Yaniv Radunsky
  DFIR Companion v0.38.0