Forensic Analysis

• Belkasoft
  Burning Fridges, Cold Evidence: The French Supermarket Attack From a Forensic Perspective

• Dr. Neal Krawetz at ‘The Hacker Factor Blog’
  C2PA and Consistently Inconsistent Validators

• Matthew Plascencia
  Forensic Photobook: GLEAPP Overview

• Kilian Neumair at NVISO Labs
  Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device

• Matthew Stern at Paraben Corporation
  Blockchain Forensics Is Only the Beginning

• S.Nakano
  Do Local LLMs Dream of Forensic Investigators? — Part II

• Tim Korver at ‘Thesis Friday’
  A hit is not a trace: search terms that mislead – Thesis Friday #31

Threat hunting/threat intelligence

• Andrea Fortuna
  The eBPF forensics gap and what your EDR cannot see

• Any.Run
  What’s Really Attacking Your Industry? Insights From 74K Sandbox Analyses

• ASEC

  • September 2026 Dark Web Breach Incident Trend Report
  • September 2026 Dark Web Issue Trend Report
  • September 2026 Dark Web Threat Actor Trend Report
  • Beware of Phishing Emails Disguised as Purchase Orders
  • Q3 2026 Statistical Report on Malware Targeting Windows Web Servers
  • Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026
  • Q3 2026 Statistical Report on Malware Targeting Windows Database Servers
  • Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email
  • September 2026 Threat Trend Report on APT Groups
  • An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies
  • Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat

• Tony Burgess at Barracuda
  Malware Brief: How infostealers turn stolen identities into cybercrime currency

• BI.Zone
  The rise of AI-powered infostealers: threat actors automate victim profiling

• Martin Zugec at Bitdefender
  Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134)

• Faan Rossouw at Black Hills Information Security
  The Threat Hunting Flywheel: Why Threat Hunting Isn’t About Finding Bad Things

• Nevan Beal, Sam Decker, and Andi Ursry at Blackpoint Cyber
  Variola: From ClickFix to a Modular Implant

• Brian Krebs at ‘Krebs on Security’

  • Microsoft Patches More Than 1,400 Security Flaws
  • U.K. Sanctions Cryptomus for RU Money Laundering

• Daniel Whitcombe at Bridewell
  UK CNI Infostealer Threat Insights

• Censys

  • Frostbitten in France: A Danfoss StoreView Internet Exposure Report
  • 5 Key Takeaways From Censys’ State of the Internet Report

• CERT-AGID

  • Smishing a tema multe: SMS fraudolenti sfruttano il nome della Polizia di Stato per richiedere pagamenti urgenti
  • Sintesi riepilogativa delle campagne malevole nella settimana del 10 – 16 ottobre

• Check Point

  • 12th October – Threat Intelligence Report
  • When LLM Gateways Go Wrong: Findings from LiteLLM
  • Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For
  • Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign
  • Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages
  • Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation

• Ashley Shen at Cisco’s Talos
  Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

• Willmar Cheng at Cofense
  RSVP to Disaster: How One Click Installs a RAT

• Confiant
  ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming

• CrowdStrike
  U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance

• Cyble
  The GhostX Ecosystem: Forged in Transit, Licensed to Deceive

• Cyfirma
  Weekly Intelligence Report – 16 Oct 2026

• Dark Atlas
  Qilin Ransomware: Inside a Rust Encryptor and Its Affiliate Ecosystem

• Alex Teixeira at Detect FYI
  A Little More Logic in Splunk: Introducing SPL2’s if Command

• Disconinja
  Weekly Threat Infrastructure Investigation(Week42)

• Lesley Carhart and Jan Hoff at Dragos
  Practical Considerations for Legacy Commodity Malware Cleanup in OT

• Jia Yu Chan and Daniel Stepanic at Elastic Security Labs
  Auditing the auditor: Unmasking Apex Accelerator

• Eric J. Taylor at Barricade Cyber Solutions
  DragonForce Ransomware: Threat Actor Profile

• Erik Hjelmvik at Netresec
  Detecting AtlasRAT C2

• ExaTrack
  APT28’s PixyNetLoader campaign Update

• James Parsons and Christine Billie at Expel
  QuartzLine: A working PDF viewer with a backdoor inside

• Bas van den Berg and Jos Huiting at Eye Research
  Cooldown or compromise: the three-day rule for npm and PyPI

• Nandakishore Harikumar at FalconFeeds
  Yemen’s Cyber Front in 2026: Houthi Spyware, Iranian Enablers, and a Hacktivist Tit-for-Tat

• Adrian Cheek at Flare
  Analysis After the Refrigeration System Attack in France: Two Thirds of Exposed Refrigeration Controllers Share an Address with Cameras, Remote Desktop, and VPNs

• Sai Molige and Amine Amri at Forescout
  From ClickFix to C2: Comparative Analysis of Two Malware Loaders

• Yun Zheng Hu at Fox-IT
  Releasing the Cobalt Strike Beacon Corpus

• Genians
  Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War

• Google Cloud Threat Intelligence

  • ARMORY CASTLE Exploits BeyondTrust
  • Investigating Ephemeral Supply Chain Tampering

• GreyNoise
  skynox7: Proxyjacking Edge Devices Into Residential Proxies

• Alpomish Asadov and Razvan Raducu at Group-IB
  KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize

• Halkyn Security

  • Linux System Calls at the Assembly Level
  • Open Source Honeypots: Choosing the Right One
  • Departing Employee Evidence: The Leaver Window
  • Linux File Attributes Attackers Rely On
  • The Unified Audit Log: A Responder’s Guide to Microsoft 365
  • Poisoned Model Triage: Provenance First

• Hudson Rock
  The 2026 Infostealer Index: How 34 Threat Intelligence Vendors Stack Up

• Hunt IO
  Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries

• Huntress

  • ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress
  • Fake WatchGuard VPN Site Steals Credentials
  • Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
  • ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

• Infoblox
  Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection

• Insinuator
  Token Theft in Microsoft Entra ID (Part 3 of 4): Token Protection

• iVerify
  Coruna, DarkSword and the Enterprise iPhone: Key Takeaways from Packet Protector

• Bert-Jan Pals at KQL Query
  CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting

• Kroll
  August Threat Intelligence Spotlight Report

• Microsoft Security
  The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

• Amy L. Robertson at MITRE ATT&CK
  ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber

• Alex Hurtado at Nebulock
  Detection Versioning: The evolution of logic and intent

• Jan Michael Alcantara at Netskope Threat Labs
  XWorm Reborn: From infostealer to surveillance platform

• Oleg Skulkin at ‘Know Your Adversary’
  418. An Interesting Case of Registry Modification

• Ontinue
  The Biggest Cybersecurity Threats of 2026 Are Hiding in Plain Sight

• OpenSourceMalware

  • GhostAction Phishing Campaign
  • GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

• Palo Alto Networks

  • The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
  • Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
  • AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  • Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026

• Lathashree Karunagaran at Point Wild
  Android Q3 2026 Malware Trend Report

• Proofpoint
  Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus

• Recorded Future

  • Malware Indicators of Compromise (IoCs) | Recorded Future
  • TAG-193’s Regional Espionage Operations
  • TAG-217 Targets South Korean Financial Services with ARTEX

• Resecurity
  Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem

• Ridgeline Cyber
  The Accounts That Can Take Your Domain Aren’t on Your Admin List

• Robin Dost at Synaptic Systems
  Russia’s UN Claims vs. Its Own Registry: Tracking DPRK Ownership in EGRUL

• SANS Internet Storm Center

  • Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
  • October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
  • Panchan’s Mining Island [Guest Diary], (Wed, Oct 14th)
  • Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)

• Sansec
  BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

• Oliver Jones at Secjuice
  Attackers Write Your Logs. Your SOC’s AI Assistant Reads Them

• Security Alliance

  • 3Q 2026 Threat Intel Summary
  • SEAL weekly stats: 6-13 Oct, 2026
  • Introducing SEAL Labs

• Amruta Wagh at Seqrite
  WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack

• Simone Kraus
  The Attack Nobody Claimed: #OpFrance, Cyber-Physical Sabotage and Europe’s Food Supply

• SOC Fortress
  An Exploratory Evaluation of TypeSafe Jev with Sysmon Telemetry

• Stephan Berger
  Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow

• Sujay Adkesar

  • Where Was This Laptop? Device Geolocation Hiding in WebCacheV01.dat
  • Where Is This Access Point? Geolocating a WiFi BSSID, the Forensic Way

• Symantec Enterprise
  Aoki: Infostealer Targets AI Coding Assistant Credentials

• System Weakness

  • The Evidence-First SOC Investigation Method I Use in My Home Lab
  • The Cyber Kill Chain: A Technical Deep Dive

• SystemHelpDesk
  Malware Families Catalog

• Team Cymru
  LegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers

• The Citizen Lab
  Exposing AdFection

• ThreatFabric
  Hirudo: From Fake Updates to Patched Banking Apps

• ThreatHunter AI
  October 2026 Patch Tuesday: 1,411 fixes and counting

• ThreatMon

  • ASTRO C2 Technical Analysis
  • Four Days to Pay: How Fast Ransomware Gangs Leaked Data in September 2026
  • Wallstreet Ransomware: A Closer Look at Sweden’s Unusual Victim Cluster
  • Mosad Threat Actor Report

• Nicholas Koken at Todyl
  Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App

• Haowei Ren at Trellix
  The Unseen Credential Surface: How AI Agents Expose Secrets

• Richard Grainger at Triskele Labs
  State of Cyber 2026 – DFIR

• Ron Bennatan at Varonis
  IBM’s Cost of a Data Breach Report 2026: AI Is Now the Attacker and the Target

• VMRay
  Hunting a Global Formbook Campaign with Machine Learning

• Volexity

  • A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
  • Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

• Wordfence

  • 600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
  • PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads

• ZERO DAY

  • Who Is Planting Backdoors in Ledger Crypto Wallets?
  • Trezor Wallets Also Compromised with Implants

• Zero Salarium
  PhantomBuffer: Effective EDR Evasion Through Stealth Injection

• ZScaler

  • Uncovering Executables that Trigger DLL Sideloading Attacks with Endpoint Context
  • Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
  • Ransomware at Machine Speed: How GenAI Shrinks the Path after Initial Access
  • CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-10-19

• Doug Metz at Baker Street Forensics
  From Strings to Techniques: Catch Me at ATT&CKcon 7.0

• Magnet Forensics

  • Magnet Autokey: Accelerating your vehicle investigations
  • Ask Me Anything: Accelerating incident response with digital forensics at scale

Presentations/podcasts

• Adversary Universe Podcast
  Inside the Cyber Superintelligence Lab with CrowdStrike’s Bartley Richardson

• Anuj Soni
  REM: Essentials Skills – Session 4b & 5 (Sept 2026)

• Behind the Binary by Google Cloud Security
  EP30 The Golden Age of macOS Malware: Evolution, Stealers, and AI Workflows with Christopher Lopez

• Black Hills Information Security
  BHIS – Talkin’ Bout [infosec] News 2026-10-12

• CQURE Academy
  CQURE Hacks #85: CQUSNDeepAnalyzer: Turn the USN Journal into a Forensic Timeline

• Hacker Valley Blue
  Voice Phishing Is the New Front Door

• Huntress

  • Tradecraft Tuesday | Advanced Phishing for Entry-Level Attackers
  • How Huntress Catches ClickFix, Token Theft, and Business Email Compromise

• InfoSec_Bret
  IR – SOC128 – Malicious File Upload Attempt (2026)

• Magnet Forensics

  • Leading the Digital Path to Justice
  • Legal Unpacked S2:E1 // From Device examination to evidence: Direct examination of the digital device examiner

• Marcus Hutchins
  How I Became A Hacker And Got Arrested By The FBI – Keynote Interview with @TheRainmakerReport

• Monnappa K A
  Webinar Recording: Threat Hunting with Endpoint Telemetry & AI-Driven Hunting

• Monolith Forensics

  • Monolith v4.25 and v4.26 Release Highlights [Monolith Mondays]
  • Evidence Types – Monolith Settings

• MyDFIR
  Why I Turned Down a SOC Analyst Promotion

• Open Source Forensics Lab
  Triage Photo Datasets With GLEAPP

• OpenSourceMalware
  The OpenSourceMalware Show #25

• Paraben Corporation

  • Micro Webinar Advanced Keyword Indexing, Regex, and Emoji Search Strategies
  • Micro Webinar Accelerated Mobile Device Data Triage with AI

• Proofpoint
  Germany’s Cybercrime Chief on Disrupting Cybercrime’s Biggest Adversaries

• SANS
  Patched Is Not Evicted: Inside CCB’s Threat Actor Profile of The Gentlemen

• Tate Pannam

  • DNS Tunneling Detected RDP Brute Force, Chrome Credential Harvest & Exfil | LetsDefend SOC272
  • APT32 Denis Malware — Phishing ZIP, PowerShell Staged Download & C2 Confirmed | LetsDefend SOC333
  • Unauthorized Port Connection — Loki Infostealer, Outlook Harvest & SMTP Exfil | LetsDefend SOC208

• The Cyber Mentors
  Purple Team Incident Adventure | TCM Community Live | Cybersecurity

• The Weekly Purple Team
  Does DLL Side Loading work in 2026?

• Three Buddy Problem

  • Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI
  • NCSC’s Ollie Whitehouse: ‘The Biggest Correction of Technical Debt Ever’

Malware analysis

• Countercraft
  Hiding in node_modules: a CVE-2025-55182 implant that rewrites Next.js so the app relaunches it

• Stefan Dasic at Malwarebytes
  Fake Calendly “Meta Careers” pages steal Facebook and Google logins

• Navneet

  • Pupkin: A Simple .NET Info-Stealer Exfiltrating Data via Telegram
  • A Deep Dive Into a Multi-Stage Malware Campaign Potentially Linked to DPRK’s Konni Group
  • Exploring LNK Malware Loaders: A Casual Analysis

• Karl Hiramoto at VirusTotal
  Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections

• Zhassulan Zhussupov
  Reversing embedded WebAssembly: part 2. Recovering function names from a WAMR .aot in pure C.

• Arden Trace at Блог Solar 4RAYS
  HypeAgent: Вредонос из эпохи, когда один троян должен был уметь все

Miscellaneous

• Brett Shavers
  DON’T FOLLOW THE NARRATIVE. FOLLOW THE EVIDENCE.

• CyberBoo
  Microsoft Defender for Cloud Apps Deep Dive: Part 3 – Connected Apps, SSPM and Sensitive Data

• Fabian Mendoza at DFIR Dominican
  DFIR Jobs Update – 10/12/26

• Forensic Focus

  • From Hours To Minutes: Accelerating Digital Investigations With Detego Global In The City Of Johannesburg
  • MD-LIVE: Mobile Forensic Triage Solution, From First Connection To Final Report
  • Analyzing Driver Behavior Using Vehicle Data
  • Beyond Blur: Decision-Making In Complex Licence Plate Examination And Enhancement Casework
  • Semantics 21 Is Calling Time on Outdated Investigation Tools
  • Magnet Autokey: Accelerating Your Vehicle Investigations
  • The Forensic Focus State Of DFIR Survey Is Now Open

• Forensic Focus
  Forensic Focus Digest, 16 Oct 2026

• Magnet Forensics
  How digital forensics reveals the full scope of a data breach

• MISP

  • MISP Modules
  • MISP Warning Lists

• Simson Garfinkel at Open Source DFIR
  The Future of the DigitalCorpora

• Pepe Berba
  Silently Install VSCode Extensions

• Rob T. Lee
  Just released: 2026 [un]prompted State of AI Cybersecurity Report

• Phil Muncaster at WeLiveSecurity
  What to do when a data breach notice doesn’t say much

Software releases/updates

• Sergiy Pasyuta at Atola
  TaskForce 2026.10 update: Compare module and Seagate FARM log

• Amped
  Amped FIVE Update 42578: Encrypted File Formats, Atom Viewer, Multiscale Segments, Bezier Curve, and Much More

• Apache
  Tika Release 3.3.3 – 10/09/2026

• AppliedIR
  Valhuntir v0.6.4.1

• Atola Technology

  • iscsi-targets 1.3
  • Download Atola Boot Image

• C.Peter
  UFADE 1.0.5

• David Augros
  sigwood v1.1.0

• DFIRe
  1.13.3 — October 16, 2026

• Didier Stevens
  Update: onedump.py Version 0.0.3

• Digital Sleuth
  winfor-salt v2026.12.12

• F-Response
  F-Response 8.8.1.15 Now Available

• Google
  Timesketch 20261014

• Mandiant

  • Capa v10.0.0
  • flare-floss v3.2.0

• Marco Neumann

  • crush-forensics v0.23.0
  • peach-forensics v0.10.0

• Martin Korman

  • Regipy 6.5.0: Fix crafted hive and log bounds
  • Regipy regipy-rs 0.1.0a3

• MISP
  MISP Modules v3.0.12 Released – richer threat intelligence enrichment, improved interoperability with MISP objects, new enrichment capabilities, and increased reliability across existing modules.

• OpenCTI
  7.261016.0

• Rory Wagner
  Hayabusa-Bulk-Runner v0.9.0

• Ryan Benson
  unfurl Web build 20261007.post1

• WithSecure Labs
  Chainsaw v2.17.1

• Yamato Security
  Hayabusa v4.2.0 – Autumn Release