Forensic Analysis

• Adam at Hexacorn
  The boring state of stalled timelines…

• Belkasoft
  Analyzing Windows BAM and DAM with Belkasoft X

• Christopher Eng at Ogmini

  • Steam Frame – DFIR First Looks
  • Steam Frame – Chaperone
  • Steam Frame – Account and Network Info

• Forensafe

  • Windows Registry Resource Access
  • Windows Program Compatibility Assistant Records

• Alexis Brignoni at LEAPPs Blog
  Nineteen New Unified Log Artifacts for iLEAPP and DLEAPP

• S.Nakano
  a tale of volatile memories.

• Stephan Berger
  Field Notes: Reconstructing the Attacker’s LSASS Dump

• Tim Korver at ‘Thesis Friday’
  From device to searchable text: how I work with the Unified Log – Thesis Friday #30

• Yogesh Khatri at ‘Swift Forensics’
  Tags in Safari History db

Threat hunting/threat intelligence

• ASEC

  • Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability
  • Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests
  • Beware of phishing emails disguised as quote requests
  • August 2026 Threat Trend Report on Ransomware
  • Security Issues in the Korean & Global Financial Sector in August 2026
  • SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk
  • Beware of SMS messages claiming to protect your Pi Coin account—phishing sites are stealing wallets
  • Beware of Malware infection in Facebook Ads Offering Cryptocurrency Rewards
  • August 2026 Threat Trend Report on APT Attacks (South Korea)

• BI.Zone

  • Using threat intelligence to test security solutions and conduct exercises
  • LxBase RAT first observed in attacks on Russian companies

• Brad Duncan at Malware Traffic Analysis

  • 2026-09-29: Macfinger ClickFix activity
  • 2026-09-30: SmartApeSG ClickFix pushes CNCmachineRMS RAT

• Brian Krebs at ‘Krebs on Security’
  Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

• CERT EU
  Taking ‘execute logging’ a bit too literally – CVE-2026-88771

• CERT-AGID

  • Credenziali GitHub esposte anche nei dataset per l’addestramento dell’IA
  • Sintesi riepilogativa delle campagne malevole nella settimana del 26 settembre – 2 ottobre

• Chainalysis
  How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget

• Check Point
  28th September – Threat Intelligence Report

• Ashley Shen at Cisco’s Talos
  China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

• Cleafy Labs
  From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat

• CloudSEK

  • TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2
  • TOPHIT Part 2: Renting the Attack Surface
  • MALFEX – A malicious npm postinstall no advisory has caught for fourteen months

• Eliya Stein at Confiant
  Opsec Fail Leaks a Rare Look Inside a Media-Buy-Powered Scam Operation

• Ben Reardon at Corelight
  Hunting Citrix NetScaler Zero-Days with Corelight

• CQURE Academy
  The Nightmare Is Over: World’s Longest-Running DDoS Service Finally Shut Down 

• Hananel Livneh at CrowdStrike
  Copy, Paste, Compromised: How ClickFix Attacks Work and How CrowdStrike Stops Them

• Cyfirma
  Weekly Intelligence Report – 1 Oct 2026

• Daniel Koifman

  • Solving ThreatHuntingLabs CTF#1 — Iranian APT Campaign Against Aerodyne Engineering
  • Introducing ADE-Skills — Adversarial Detection Engineering Knowledge Base

• Ialle Teixeira at Debugactiveprocess
  Reverse Engineering as Counterintelligence in 2026: From Malware Artifacts to Defensive Decisions

• Disconinja

  • Weekly Threat Infrastructure Investigation(Week39)
  • Weekly Threat Infrastructure Investigation(Week40)

• Düzgün
  MuddyWater’s Rented Arsenal and Its Traces in the Russian MaaS Market

• Eric J. Taylor at Barricade Cyber Solutions

  • RansoMonitor Weekly Update: September 20 to 26 2026
  • The Gentlemen Ransomware: Threat Actor Profile

• Esentire
  PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578

• FalconFeeds
  Inside the Cybercrime Power Struggle: Rivalries, RaaS Fractures, and Underground Conflict

• Flare

  • The Overlooked Healthcare Attack Surface: 1,057 FHIR Endpoints and 656 HL7 Systems Found Without Sending a Single Packet
  • Hacker-for-Hire Economy: How Cyber Mercenaries Turned Digital Revenge Into a Business
  • The Airport isn’t Online but its Directory is: A Sector-Wide Look at What DNS Reveals About Aviation Infrastructure

• Flashpoint
  Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization

• John Althouse and Sébastien Féry at FoxIO
  Introducing JA4Scan: Active Server Fingerprinting for TLS and QUIC

• Luis Corrons and Jan Rubín at Gen
  Your IP, Their Traffic

• Yoni Gottesman and Noam Kesten at Glow
  PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies

• Google Cloud Threat Intelligence

  • Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
  • Vulnerability Discovery and Exploitation Trends in the AI Era

• GreyNoise
  Swarming Against Citrix 0-Day Exploitation

• Group-IB

  • Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy
  • Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino

• Halkyn Security

  • Bitwise Operations: AND, OR, XOR and Shifts
  • Threat Hunting Metrics That Convince a Board
  • Kunai Threat Hunting Poster: Free A3 Download
  • Model File Formats That Execute Code
  • Insider Data Exfiltration: What It Looks Like
  • LD_PRELOAD Detection: Dynamic Linker Hijacking
  • Identity Threat Hunting in Cloud Environments
  • Investigating MCP Server Compromise

• Huntress

  • Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  • Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  • Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
  • The First 24 Hours: What Happens When Ransomware Lands

• Intel 471
  Insiders for Hire: How the Underground Market for Employee Access is Evolving Insider Risks

• Invictus Incident Response
  Stolen GitHub Token (PAT): Incident Response Guide | Invictus Incident Response

• Mateusz Krzywicki at iVerify
  WeWorm(s) Armageddon: Mobile Edition

• James McMurry at ThreatHunter AI

  • Citrix Confirms Active Exploitation of Two Critical NetScaler Vulnerabilities
  • Q3 2026: Higher Education Got Hammered

• LevelBlue SpiderLabs

  • Citrix NetScaler Zero-Day Exploited Globally
  • Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
  • TIKTOUK: Tracing a WordPress Credential Collection Toolkit

• Ax Sharma at Manifold
  Rogue agents hit US gov sites and a second Australian dashboard

• Manuel Winkel at Deyda Consulting

  • Checklist for NetScaler (Citrix ADC) CVE-2023-3519
  • Checklist for Citrix ADC CVE-2019-19781

• Mat Fuchs
  When CreateProcess Is the Write

• Microsoft Security

  • NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  • Star Blizzard refines phishing and malware delivery with the RedFlick technique
  • ​​Beyond source code: A path to the keys to the kingdom
  • Phishing Abuses RMM Tools for Persistent Access
  • Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
  • Insights from the 2026 Microsoft Digital Defense Report 

• MII Cyber Security

  • Threat Hunting & Compromise Assessment in SentinelOne Singularity Platform
  • Kunai Engineering #1 — Building Linux Threat Detection with Kunai on Ubuntu Server

• Mostafa Farghaly
  Unmasking Lawxsz: Attributing the Developer Behind Valkyrie and Prysmax Stealers

• Alex Hurtado at Nebulock
  The GATES Method: When a Threat Hunt Becomes a Detection

• Florian Roth at Nextron Systems
  New THOR Detection Coverage for Citrix NetScaler CVE-2026-88771 and CVE-2026-88772

• Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko at OX Security
  PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels

• Palo Alto Networks
  Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild

• Promon
  App Threat Report Q3 2026: GPU debugger abuse in Android apps

• Proofpoint

  • From EDU Account Takeover to Job Scam Abuse: West African Fraud Actors Target Universities
  • Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles

• Pulsedive
  Inside The Com: Understanding the Ecosystem Behind Scattered Spider, LAPSUS$, ShinyHunters, and FALCON

• Resecurity
  Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations

• Zaria Vuksan at ReversingLabs
  Restrospective: How Malicious Updates Poison Your Environment

• Robin Dost at Synaptic Systems
  How Russia’s “Media Land” Kept Routing After Sanctions

• SANS Internet Storm Center

  • Wireshark 4.6.9 Released, (Sun, Sep 27th)
  • Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
  • Scans for Wordfence Protected Websites, (Tue, Sep 29th)
  • ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
  • YARA-X 1.21.0 Release, (Sat, Oct 3rd)
  • User Agent Strings Curiosities, (Sun, Oct 4th)

• Security Alliance

  • SEAL weekly stats: Sept. 22-29, 2026
  • From Gmail Compromise to Fake Support Call: A Social Engineering Pattern on the Rise

• Sekoia
  Gotta Breach ‘Em All! The Journey Of ShinyHunters

• SentinelOne

  • Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
  • Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face

• Ayush Singh Sachan at Seqrite
  Inside DragonForce: How a Ransomware Cartel’s Payload Actually Runs

• Sina Kheirkhah at watchTowr Labs

  • Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
  • Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)

• Sarah Gooding at Socket
  New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain Attacks

• Gabriel Barbosa at Sucuri
  SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor

• Marco A. De Felice aka amvinfe at SuspectFile
  ShinyHunters vs. Cl0p: The Attack on the Site, the Dispute, and Qilin’s Position

• Omer Kidron, Roey Bartov, Josh Geise, and Avishay Asido at Sygnia
  Actively Exploited NetScaler Vulnerabilities

• Symantec Enterprise
  Warlock Ransomware Attackers Hit Water and Telecom Operators

• The Hunter’s Ledger
  FACEIT ClickFix Pages Point CS2 Players to a Script URL That VirusTotal Ties to a Steam-Focused Executable

• Sydney Marrone at THOR Collective Dispatch
  Teaching Machines to Be Curious

• ThreatMon

  • 16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves
  • Viva Aerobus-Linked Attacker Infrastructure and Post-Exploitation Findings

• Ugur Koc and Bert-Jan Pals at Kusto Insights
  Kusto Insights – Summer Update

• Lucie Cardiet at Vectra AI
  ShinyHunters Breached the FBI by Bypassing the Fix

• Tomáš Foltýn at WeLiveSecurity
  The devil is still in the email – but wearing a new mask

• Wiz

  • The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  • The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

• ZScaler

  • Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
  • Ransomware Data Theft Surged 275% in 2026: Schools, Hospitals, and Government Agencies Had Some of the Largest Claims
  • From Access to Exfiltration: What Defenders Need to Know

• Блог Solar 4RAYS
  Partisan Zmiy: снова на радаре

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-10-07

• CQURE Academy
  HOT: Uncovering New Identity Theft Vectors and How to Mitigate Them

• Magnet Forensics

  • Magnet User Summit 2027: Bringing together the best in digital investigations
  • Magnet UK Summit 2026: Sharpening the edge in digital forensics
  • AI Unpacked S2:E5 // Research, reality, and the future of AI in digital forensics

• SANS
  Stay Ahead of Ransomware: From Takedowns to Hacking Back

• Silent Push
  Danglegeddon: Find your vulnerable subdomains before AI agents take them over

Presentations/podcasts

• Alexis Brignoni
  Digital Forensics Now Podcast S3 – 8

• Ayush Anand
  Catch the Network Scan 45+ Ransomware Gangs Run

• CQURE Academy
  CQURE Hacks #84: Understanding Event ID 4624 in Action

• InfoSec_Bret
  IR – SOC157 – Suspicious WAR File (2026)

• Microsoft Threat Intelligence Podcast
  From Identity Compromise to AI Defense: Inside Modern Incident Response

• Monolith Forensics

  • Monolith Mobile [Monolith Mondays]
  • Case Statuses – Monolith Settings

• MSAB
  #MSABMonday – Alternative Profiles

• MyDFIR
  Certs vs Labs vs Projects: What SOC Analysts Actually Need

• NVISO Belgium
  NVISO Podcast Episode #1 Attacker & Defender Strategies in a Shifting Threat Landscape

• Open Source Forensics Lab
  How to Acquire Android data with Oxygen Forensic Detective (Archive)

• OpenSourceMalware
  The OpenSourceMalware Show #23

• Paraben Corporation
  Micro Webinar Use AI to Fast Track USN Journal

• Parsing The Truth: One Byte at a Time Podcast
  TN vs Ahmad Gatlin: Part 3

• Proofpoint
  FOMO as an Attack Vector: How Fake Party Invites Are Hijacking Inboxes

• Sandfly Security
  Linux Forensics Tools | Intrusion Detection, Threat Hunting & Malware Detect Linux Commands Cheat Sheet

• SANS Cloud Security
  Beyond MFA: A Defender’s Guide to Token Theft and AiTM

• SANS Cyber Defense

  • Excel and PowerPoint Tips for OSINT Investigations
  • Unmasking Evil: How OSINT Exposed a Dark Web Monster

• Security BSides Dublin
  Security BSides Dublin

• The Cyber Mentors
  DEF CON CTF Walkthrough: Packet Analysis

• The Weekly Purple Team
  Raising the Dead! Bringing Tombstoned Accounts Back to Life

• Three Buddy Problem
  Why is Anthropic Afraid of GLM 5.3?

Malware analysis

• Dr. Web

  • Doctor Web’s Q3 2026 review of virus activity on mobile devices
  • Doctor Web’s Q3 2026 virus activity review

• Thijs Xhaflaire at Jamf
  CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode

• Harihara Sudhan at K7 Labs
  From KMS Auto to Scareware: Tracking a Multi-Stage Intrusion Linked to APT36?

• Lab52
  Backdoors in the Dungeon – TURN & MQTT Abused by DragonForce

• Sophos

  • Jev’s Paradox: The hidden cost of cheap AI decisions
  • TerminalFix and Lorem Ipsum Loader enable covert tunneling

• Zhassulan Zhussupov
  Reversing embedded WebAssembly: part 1. Cracking the WAMR .aot container in pure C.

• Muhammed Irfan V A (Security Researcher II) at ZScaler
  2CLoader: A New Malware Loader Delivering Vidar and Remus

Miscellaneous

• Adam at Hexacorn
  EtwCheckCoverage API

• Brett Shavers

  • Everyone Suddenly Knew Oxygen Forensics Was Guilty
  • I Got the Court File. Here Is What It Actually Says.

• Cellebrite

  • Time to a Verified Finding: The Right Way to Measure Investigative AI  
  • Cellebrite Genesis vs. ChatGPT: Why You Need Purpose-Built Investigative AI
  • ‘He’ll Never Be Able to Do This to Another Girl Again:’ How Phone Evidence Led to a Predator’s 174 Year Sentence in Maricopa County 

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 09/28/26

• F-Response
  F-Response and Windows 11 25H2+, Windows 2025 Server

• Forensic Focus

  • ADF Solutions Named A Major Player In IDC MarketScape For Worldwide Digital Forensics Platforms 2026 Vendor Assessment
  • Green Meets Blue: A Brief RCS Forensic Excursion
  • Belkasoft Releases Belkasoft X v2.12, Adding Offline Translation And AI-Assisted Database Analysis
  • Roadblocks Ahead! Navigating The Major Issues Of Mobile Forensics
  • Berla Introduces iVe 5.0, Adding Support For More Than 38,500 Additional Vehicles
  • Semantics 21’s CCTV Review Tool Is Built For Footage That Cannot Wait
  • Trust Is Not A Feature. It Is The Foundation.
  • Passware Kit Mobile 2026 v5 Decrypts Samsung Galaxy Watch
  • Forensic Focus Digest, October 02 2026
  • Block Hash Scan: Illegal File Triage Completed On Site

• Gaia Calamari at Strange Forensics
  Cloud Forensics

• Matthew Green at InfoGuard Labs
  AI Ate My Velociraptor

• Kevin Pagano at Stark 4N6
  Forensics StartMe Updates (October 2026)

• Chad Gish at Magnet Forensics
  The importance of digital forensics examiner training

• Matthew Plascencia
  News Break: Oxygen Forensics

• MISP
  CRA Requests to MISP Project

• Stanislaw Mrozowski at Nextron Systems
  THOR at Locked Shields 2026: How Teams Used It and What They Told Us

• Amber Schroader at Paraben Corporation
  How Government Buyers Can Verify Digital Forensics Vendor Provenance: A Practical Guide

• Seojun Kim and Kelly Jang at Plainbit
  CrowdStrike Fal.Con 2026 in Las Vegas

• Salvation DATA
  Movement Pattern Analysis in Digital Forensics: From Data Chaos to Case Timeline

• Emad Abedini at System Weakness
  Dumplyzer | Memory Dump Analysis Platform

Software releases/updates

• Apache
  Tika Release 4.1.0 – 9/26/2026

• Arkime
  v6.8.0

• Atlas 1.0.0

• Crowdstrike
  Falconpy Version 1.6.6

• DFIR-IRIS
  IRIS-Web v3.0.0-beta.4

• Didier Stevens
  Update: search-for-compression.py Version 0.0.8

• Digital Sleuth
  winfor-salt v2026.12.9

• Doug Burks

  • ohmypcap v4.3.0
  • so-crates v4.3.0

• Gaia Calamari at Strange Forensics
  WEBCQUISITION

• Ghassan Elsman
  Crow-Eye v0.14.0 — Visualizations & Browser Forensics

• LEAPPs

  • ALEAPP v2026.4.3
  • batch-leapp Batch LEAPP v1.2.0: Disk Images, DLEAPP and the New Release Builds
  • iLEAPP v2026.4.4
  • RLEAPP v2026.4.3
  • VLEAPP v2026.4.3

• Marco Neumann

  • crush-forensics v0.21.0
  • peach-forensics v0.9.1

• MISP
  MISP 2.5.47 released – a major security hardening round, the new database migration system with PostgreSQL support, AI-assisted analysis and Overmind moving forward

• OpenCTI
  7.261002.0

• Passmark Software
  OSForensics V11.1 build 1017 29th September 2026

• Passware
  Passware Kit Mobile 2026 v5 Now Available

• PuffyCid
  Artemis v0.20.0 – Released!

• radare2
  2.5.6

• Yaniv Radunsky
  DFIR Companion v0.41.0