Forensic Analysis

• Belkasoft
  Case Study: Investigating WhatsApp Desktop Activity on Windows with Belkasoft X

• Brian Carrier at Cyber Triage
  How To Investigate with Automated DFIR Tools

• Forensafe

  • Windows SetupAPI Log
  • Windows Error Reporting

• Alexis Brignoni at LEAPPs Blog
  KDL and AppWalk, two tools that work with the phone itself

• Steve Gemperle at Magnet Forensics
  Investigating a remote IT worker scam: A field guide for DFIR teams

• Paraben Corporation

  • Paraben Corporation Why Digital Evidence Needs a Behavioral Read, Not Just a Technical One
  • Paraben Corporation Blockchain Forensics Is Only the Beginning
  • Paraben Corporation Avoiding AI Slop: A Digital Investigator’s Checklist for Quality Tools
  • Paraben Corporation Building an Autonomous Network Honeypot & Deception Matrix

• Mato Vlajčić, Luka Bračun, and Dino Bezić at Protokol-7
  Defender’s hidden flight recorder: decrypting mpenginedb.db

• Ryan Benson at Hindsight Foundry
  New Course: Browser Forensics for Security Analysts

• S.Nakano
  The World Ends with ETW

• Will DePue at Unemployment Labs
  Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs

• Yogesh Khatri at ‘Swift Forensics’
  Siri app conversations

Threat hunting/threat intelligence

• Abnormal Security

  • The Return of Kratos: How Its Phishing Code Outlived the Takedown
  • PolinRider: Malicious Coding Assignments Steal Developer Secrets

• Acronis
  Every PC has a junk drawer, and attackers know it

• Oliver Smith at Aikido
  wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories

• Larry Cashdollar at Akamai
  Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT

• Arctic Wolf

  • Agentic Security Operations Report 2026
  • Inside the 2026 Agentic Security Operations Report
  • Still in the Meeting: BlueNoroff Six Months On

• ASEC

  • Analysis of Wpcdoor Attack Cases Spread via Korea-Based DVR Management Software
  • Beware of phishing emails disguised as quote requests (SnakeKeylogger)
  • Beware of phishing emails disguised as purchase order confirmation requests (Xloader)

• Ayelen Torello at AttackIQ
  Enter 666: Unmasking Beast Ransomware

• CJ Moses at AWS Security
  Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents

• Christine Barry at Barracuda
  Dire Wolf ransomware: An apex predator stalking your data

• Leron Gray at Bishop Fox
  Inside Cirro: Enumeration as a Restricted Guest

• Jade Brown at Bitdefender
  Bitdefender Threat Debrief | November 2026

• Tibor Luter at Black Cell
  Parsing raw AWS Cloudtrail logs to Splunk – Tutorial

• TJ Johnson at Black Hills Information Security
  Log Analysis Field Guide: Tips for Spotting Patterns and Red Flags

• Blackpoint Cyber
  RMM Tool Abuse: When Your Remote Access Becomes the Attack Path

• BleepingComputer

  • Active ScreenConnect attacks breach MSPs, impact dozens of organizations
  • New worm-like ‘SCKit’ malware targets MSPs in ScreenConnect attacks
  • Police arrest 354 suspects in dark web cybercrime crackdown

• Brad Duncan at Malware Traffic Analysis

  • 2026-11-10: Traffic Analysis Exercise: The Lucky Turkey
  • 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

• Brian Krebs at ‘Krebs on Security’

  • Microsoft Fixes Nearly 1,100 Security Vulnerabilities
  • Who Runs the Ransomware Group Qilin?

• Alex Gartner at Censys
  ARTEX and AI Attack Tools: Why Threat Intelligence Must Originate From First-Party Data

• CERT-AGID

  • Falso sito INPS in allestimento per futura distribuzione di APK malevolo
  • Sintesi riepilogativa delle campagne malevole nella settimana del 7 – 13 Novembre

• Evenson Jeunesse at CERT-Wavestone
  Anatomie d’une compromission « presque » invisible : Le SEO cloaking

• Chainalysis

  • Sanctioned Canadian Crypto OTCs Served Iran and Drug Cartels
  • Western Europe’s $2 Trillion Crypto Economy Holds Firm
  • The Shadow Market Behind China’s AI Model Distillation Boom
  • FinCEN Bars U.S. Institutions From Moving Funds for MEXC Global

• Check Point

  • 9th November – Threat Intelligence Report
  • From Water Systems to Supermarket Refrigerators: Inside Shahid Kaveh and CyberAv3ngers’ OT Attacks
  • Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
  • October 2026 Cyber Threat Landscape: Record Ransomware, Rising GenAI Risk and an AI-Powered Newcomer
  • PHP2Shell Exploitation on Check Point Gateway

• Cisco’s Talos
  ARTEX and beyond: AI-enabled penetration testing platforms

• CloudSEK
  Off the Rails: Inside an Exposed Silent Lynx Server

• James Lagermann at Corelight
  The Supply-Chain Risk Hiding in Your MCP Servers | Corelight

• Cyble

  • CERT-In’s CRAFTY FALCON Advisory: AI Is the Accelerant, Your Payment APIs Are the Target
  • Can Agentic AI Investigate a Phishing Campaign? Evidence Walkthrough

• Rahul Ramesh and Baskar M at Cyderes
  SignDrop Zero-Day Turns Windows CLFS Defense Into Privilege Escalation

• Cyfirma

  • FINANCE – Quarterly Threat Landscape : Q3 2026
  • Weekly Intelligence Report – 13 Nov 2026

• Raúl.R at Cyllex
  Inside Cereal: Turla Reads Government Emails from the Exchange Server Itself

• Julie Agnes Sparks at Datadog Security Labs
  On the hunt for ARTEX: understanding agentic attacks in AWS environments

• Eclypsium
  Php2shell: A Network Edge Risk Playbook

• Elastic Security Labs

  • 0% GPU utilization: How SANSAR hides Linux cryptomining
  • Inside the loop: Five AI attack frameworks that never ask permission
  • 56 AWS API calls in 141 milliseconds: Inside an AI-run intrusion

• Eric J. Taylor at Barricade Cyber Solutions
  Able2Shell: Inside 33 Unpatched N-able N-central Vulnerabilities

• Bas van den Berg at Eye Research
  Machine speed: how we defended against an AI-driven attack

• Fareed Fauzi

  • Cheatsheet: Threat Attribution in Threat Intelligence
  • Cheatsheet: Enrich Threat Information via OSINT tools

• Flare

  • ClickFix in the Wild: New RATs, Stripe-Based C2, and a Signed Google Tool Turned Against Defender
  • Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads
  • The Binance Hack, Infostealers, and AI-Powered Social Engineering

• Flashpoint
  How to Identify Ransomware Data Exposure Using Leaked File Trees

• Minaxi Parmar at Foregenix
  EtherHiding Malware Explained: How Web3 Smart Contracts Threaten E-Commerce

• g0njxa
  Approaching stealers devs: a brief interview with Stadia

• Gen
  Poisoned AI Answers: How Scams Are Reaching Users Through Chatbots

• GitGuardian

  • Beyond ARTEX: 45 Agentic Attack Frameworks, What They Hunt For, and How to Find Them
  • An ARTEX build ships no secret scanner. In our lab, it found the secrets anyway
  • AntiFox Targeting AWS Credentials: The Latest Wave of AI Agent Attacks
  • A Valid Signature Isn’t Enough: Attributing and Validating Leaked JWTs
  • wfx-loot: A CI Secret Stealer Pushed With Stolen GitHub Credentials

• GreyNoise

  • Global Event: SSHole (CVE-2026-123158) Live Activity Report
  • Global Event: PHP2SHELL Live Activity Report

• Mansour Alhmoud at Group-IB
  Inside The Server: 14 Months of Offensive Cyber Operations Targeting Europe

• Halkyn Security

  • Cyber Incident Communications: What to Say and When
  • Honeytokens and Canary Tokens: Cheap, High-Signal Detection
  • Shadow AI Insider Risk in the Workplace
  • Investigating the Azure Control Plane After a Breach
  • Vector Store Forensics: RAG as Evidence

• Maurice Fielenbach at Hexastrike
  Aur0ra – An Xray Reverse Tunnel Hidden Inside Explorer After a Teams Vishing Call

• Hudson Rock

  • Corium: A New ClickFix Panel Shows How Malware Delivery Is Becoming a Turnkey Business
  • Remus Stealer Markets Persistent Gmail Access: Hudson Rock Investigates
  • School Bomb Threats: Hudson Rock Finds Reported Sender Accounts in Infostealer Data

• Huntress

  • Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
  • N-able Disables Cloud Services Following Disclosure of “Able2Shell” Exploit Chains
  • Beyond the clipboard: The evolving tradecraft of ClickFix
  • SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
  • Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing
  • GeoVision Camera Software Abused to Deploy XMRig Cryptominer
  • Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers

• IC3

  • North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme
  • Threat Overview of ARTEX Autonomous Penetration Testing Framework

• iVerify

  • Half-Click Attacks: How Online Ads Now Deliver iPhone Exploits
  • An Exploit Inside an App Store App: What FomoPeek Means for “App Store Only” Policies
  • Android RATs for Rent: Five Remote Access Trojans and the $150-a-Month Phone Takeover
  • Coruna, DarkSword and the Enterprise iPhone: Key Takeaways from Packet Protector
  • Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones
  • iPhone Spyware Doesn’t Pick Its Targets Anymore

• Kroll
  September Threat Intelligence Spotlight Report

• Tom Neaves at LevelBlue SpiderLabs
  Hiding In Plain Sight: Abusing Model Assumptions To Deceive & Attack Offensive AI Agents

• Manifold

  • What counts as an AI agent incident?
  • What 66 AI agent incidents tell us
  • AI agent config files can run code. agentaudit flags them
  • AI agent security policies beyond blocking: Advise and Correct
  • How long do AI agent incidents take to surface?
  • Who Approves Your Agent? 6,000+ Claude Code Mods Analysed

• Microsoft Security

  • Detecting sleeper agents hiding in AI model neurons
  • The global socket: how threat actors are weaponizing GSocket for stealthy C2
  • Lessons from 59 Linux Kernel Bug Reports
  • Trained to betray: How post-training supply chain attacks hijack coding agents
  • SCKit abuses ScreenConnect to deploy remote access and target technician sessions

• Ray Fernandez at Moonlock
  Hackers came up with a new platform to manage ClickFix attacks

• Shmuel Uzan at Morphisec
  Beyond the Signature: How Attackers Hide Malware in PE Certificate Tables

• Eric Brown at Nebulock
  coreSigma 2.0: macOS Detection Rules Tested on Real Telemetry

• Netskope Threat Labs
  Netskope Threat Labs Report: Manufacturing 2026

• NVISO Labs

  • Breaking the Semantic Cache: A LiteLLM Case Study (CVE-2026-89032)
  • Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 3 – Validation and Future Possibilities

• Oleg Skulkin at ‘Know Your Adversary’
  422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure

• OpenSourceMalware

  • Cryptocurrency being targeted in multi-faceted attack
  • Online Casino Serves Malicious Python SDK

• Outpost24
  Outpost24 Research Finds Infostealer Malware Affected 72% of Organizations With Exposed Credentials

• Moshe Siman Tov Bustan and Vitalii Chepurko at OX Security
  Ethersphere Hijacked With Crypto Stealing Malware Via Github & npm

• Palo Alto Networks

  • ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know
  • The XG Files: Falcon C2 Flying Under The (Browser) Radar
  • Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors

• Benjamin Adolphi at Promon
  Watching the apps we protect: How we found Hirudo by accident

• Rachel Rabin at Proofpoint
  BluePhishing: Initial Access via Third-Party Agent Blueprint Consent

• Ellis Stannard, Marion H., M. Smith, Nick Smart, Olivier Ferrand, and Tenn S. at Ransom-ISAC
  The Gentlemen Incident: Locked Out

• Recorded Future

  • DoppelCart Fraud Network Grows to More Than 250,000 Domains
  • GhostFrame: A new ESXi Implant Linked to Settra Ransomware
  • AI Is Both Target and Tool for Threat Actors
  • Five Findings From the 2027 State of Threat Intelligence

• Joseph Keyes at ReliaQuest
  Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens

• Report URI

  • One Hijacked Analytics Script, and Russian iPhone Exploits on Thousands of Websites
  • Inside a ClickFix Malware Kit: The Attacker Left Their Notes Behind
  • HexMage, Ten Weeks Later: 533 Infected Shops and Counting
  • The Skimmer That Adds a Card Form to Checkouts That Never Ask for a Card

• Ridgeline Cyber
  Device Code Phishing Uses Microsoft’s Real Sign-In Page. Here’s What Your Logs Still Show.

• SANS Internet Storm Center

  • Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)
  • Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)
  • Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)
  • Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)
  • Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
  • Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)

• Sansec
  Supply chain attack on Shopify apps sends shoppers to a fake checkout

• Securelist

  • IT threat evolution in Q3 2026. Non-mobile statistics
  • IT threat evolution in Q3 2026. Mobile statistics
  • Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand
  • Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes

• Security Alliance
  SEAL weekly stats: 4-11 Nov, 2026

• Sekoia
  The Cold Chain on Fire : Unpatched Danfoss controllers exploited

• Simone Kraus
  Fake Google Meet Updates, Abused RMM Tools, the AgtaBackup RAT Ecosystem & Campaign

• Socket

  • Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
  • Cyberattacks Are Skyrocketing in Japan as Researchers Trace AI-Assisted Intrusions

• SOCRadar

  • Dark Web Profile: CyberXero
  • Dark Web Profile: n0n Ransomware

• Sophos

  • ARTEX: Attackers apply agentic AI
  • The State of Ransomware in Retail 2026

• Sophos
  Malicious ScreenConnect deployments observed

• Step Security

  • WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks
  • CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows
  • The Take-Home Test That Runs on Your Work Laptop: Inside the AccuraSoftHire Fake Interview Campaign
  • ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.

• Marco A. De Felice aka amvinfe at SuspectFile
  Haise, Qilin’s Administrator: How Solid Is the Identification of Alexey Yakovtsev? Qilin Denies the Claims and Accuses GangExposed of Asking for $20,000

• Symantec Enterprise
  How AI Revived a Stalled Attack on a U.S. Retailer

• Joseph Harrison at The Hunter’s Ledger
  An AI Pentest Platform Drives Commodity Tooling Against Portuguese Government Targets

• The Shadowserver Foundation
  CastleRAT Historical Bot Infection Special Report (Stolen Credentials)

• Lauren Proehl at THOR Collective Dispatch
  I leaked credentials on purpose for four months. Here’s who took them, and what they did next.

• ThreatMon

  • Inside the Enterprise Access Market: What Nine Underground Listings Reveal About Initial Access Sales
  • CVE-2026-97229 Remote Code Execution via Integer Overflow in the GitLab CICD Regex Parser
  • Financial Sector Threat Landscape 2026

• Umut Bayram at Picus Security
  Imperial Kitten (Tortoiseshell) APT: TTPs, Malware, and Attack Simulation

• WeLiveSecurity

  • Exchange for breakfast: Turla’s Cereal tricks are not for kids
  • GTA VI isn’t out yet – and the scams are already in full swing

• Zack Morrow, Sean Johnstone, and Benjamin Read at Wiz
  Trusted by Default: Qubole Cross-Account Access Abused in the Wild

• Michael Wylie and Chuck Frey at ZScaler
  High-Fidelity Threat Hunting Starts with Your Data Pipeline

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Steven Lim, Tim Peck, and Ethan Andrews at Detections.ai
  Detections.ai and the KQL Wizard: A Live Discussion with Steven Lim

• Robert M. Lee and Rob T. Lee at Dragos
  AI in OT: Adoption, Security, and the Changing Threat Landscape

• John Hammond
  Payload Podcast 013 – Catchup

• Magnet Forensics
  Cyber Unpacked S3:E6 // Busting the myths that are costing you evidence

• Markus Schober and Brian Carrier at Sleuth Kit Labs and Blue Cape Security
  HOW TO USE AI TOOLS TO INVESTIGATE RANSOMWARE

Presentations/podcasts

• Adversary Universe Podcast
  A Lesson in Cybersecurity Higher Ed with Fiserv’s Neil Schloth

• Blue Team بالعربي

  • Detecting Lateral Movement via service creation using XDR
  • Detecting Lateral Movement via Task Scheduler using XDR
  • Detecting Lateral Movement via DCOM object using XDR
  • What is component object model (com)
  • Detecting Lateral Movement via PowerShell Remoting using XDR

• FBI
  Ahead of the Threat Podcast: Season 3, Episode 2 – Stan Duijf and Paul Foster

• Huntress

  • Tradecraft Tuesday | ClickFix and all the Fixins
  • Why Basic Phishing Training Doesn’t Work Anymore

• InfoSec_Bret
  IR – SOC156 – Unnormal Code/Command Execution (2026)

• Magnet Forensics
  AI Unpacked S2:E4 // The art and science of AI prompting in digital investigations

• Monolith Forensics

  • Chain of Custody Actions for Evidence in Monolith
  • Evidence Record Overview: Evidence Details in Monolith
  • Batch Label Printing and Evidence File Management [Monolith Mondays]
  • Evidence Photos in Monolith
  • Time Tracking in Monolith

• MyDFIR
  How I Would Learn SOC Investigations From Scratch

• Open Source Forensics Lab
  Windows Registry Editing on Linux | RegEdLin vs RegistrySpy

• OpenSourceMalware
  The OpenSourceMalware Show #29

• Parsing The Truth: One Byte at a Time Podcast
  TN vs Ahmad Gatlin: Part 7

• Proofpoint
  The Human Cost of Cyberattacks, with Critical Cyber’s Pavlina Pavlova

• Richard Davis at 13Cubed
  What ShellBags NodeSlot Values Really Tell You

• Sandfly Security
  Finding Mystrodx/ChronosRAT Linux Malware with Agentless Sandfly 6.0

• SANS Cyber Defense
  Preparing for Post Quantum Cryptography in 2026

• SentinelOne
  LABScon26 Replay | Let’s Get Physical: Why Cybersecurity Needs Hardware-Based Security to Survive AI

• The Defender’s Advantage Podcast
  ARTEX and Friends: Enter Agentic Offensive Frameworks

• Three Buddy Problem

  • GPT-6 Cyber Sets Price of a Linux Exploit; Europe Silent on Fridge Hacks
  • Bruce Dang on Calif, iOS Exploit Chains, AI Hacker Takeover

Malware analysis

• Adam at Hexacorn
  Anti-AI tricks, Part 1

• Any.Run
  Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures

• Ialle Teixeira at Debugactiveprocess
  MaldocTrace: Emulating Malicious Office Macros Without Running Them

• Fortinet

  • Analyzing an Illegal Android Gambling App Built with Flutter
  • T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers

• IONSEC
  The clock is still the key: INSITO, free recovery for Rhysida’s ESXi locker

• OSINT Team
  Threat Analysis: AntSword Webshell Management Framework

• Shubho57
  Analysis of a file which could be attributed to a APT group

• Zhassulan Zhussupov

  • Malware development trick 69: COFF object loading. Simple C examples
  • Malware development trick 70: Hardware breakpoint process injection. Simple C example

• Rajat Goyal and Fernando Ortega at Zimperium
  Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT

• Шифровальщики-вымогатели The Digest “Crypto-Ransomware”
  HYFLOCK

Miscellaneous

• ⌛☃❀✵Gootloader Details ✵❀☃⌛
  Five Years Chasing Gootloader

• Emi Polito at Amped
  How to Present Image and Video Authentication Findings in Court with Amped Authenticate

• Elif Kurt at Binalyze
  From Signal to Action: Introducing Automations in Binalyze AIR

• Brett Shavers
  DFIR, AI, and an Unexpected Detour Into Vaginal Fluid

• F-Response
  F-Response and Windows 11 25H2+, Windows 2025 Server – Update

• Forensic Focus

  • New Magnet Forensics Report Highlights Challenges Shaping Public Sector Digital Investigations
  • Android FCM Push Notification Artifacts: What Can Remain After An App Is Deleted
  • Cyber Unpacked S3:E2 // IR Beyond Malware: Investigating Business Email Compromise And Fraud
  • Belkasoft X v2.13 Arrives With Amplified BelkaGPT And MFT-Based File Recovery
  • Forensic Focus Digest, 13 Nov 2026

• Intel 471
  What to ask before you buy an AI agent for threat intelligence

• Lenny Zeltser

  • How to Install SIFT Workstation and REMnux on the Same System
  • Is Cyber Deception a Must-Have This Time?

• Lesley Carhart
  Let’s Talk About Why all This OT Stuff is Connected

• Magnet Forensics

  • Where digital investigations stall: 5 findings from 300+ public sector professionals
  • Meet the Magnet Forensics Training Team: Grant Hazell
  • Threat hunting with digital forensics

• MISP
  Guidelines for Building and Federating Cybersecurity Information-Sharing Communities

Software releases/updates

• 13Cubed
  Abeebus 2.2

• Arkime

  • v7.0.0-rc1
  • v6.9.2

• Belkasoft
  Meet Belkasoft X v2.13! This release brings chain of thought in BelkaGPT answers, document summarization, and topic detection for emails and SMS with BelkaGPT, deleted file analysis based on MFT records, improved MTK acquisition, browser-based sign-in for Google Cloud acquisition, and a range of other powerful improvements.

• Binalyze
  Binalyze AIR 5.30

• Crowdstrike
  Falconpy Version 1.6.7

• DFIR-IRIS
  IRIS-Web v3.0.0-beta.23

• DFIRe
  1.17.0 — November 11, 2026

• Digital Sleuth
  winfor-salt v2026.15.3

• Doug Burks
  so-crates v5.3.0

• Ghassan Elsman
  Crow-Eye v0.15.1

• Ialle Teixeira
  MaldocTrace v0.5.1

• kano92-dir
  binkeep v1.2: what it can do, .NET, Android and ZIP

• Lethal Forensics
  MemProcFS-Analyzer v1.3.0

• Martin Laffont
  Vigie v0.5.0

• North Loop Consulting
  NLC Spectator v3!

• OpenCTI
  7.261109.3

• Phil Harvey
  ExifTool 13.63

• Sandfly Security
  Log in to answers, not alerts: what’s new in Sandfly 6.0

• SigmaHQ
  pySigma v2.1.0

• Toño Diaz
  masstin v1.4.4

• UTMStack
  UTMStack v11.4.0 – Angular 17 frontend, security close-out, IR role model

• WithSecure Labs
  Chainsaw v2.17.2-beta.0

• Xways

  • X-Ways Forensics 21.8 SR-7
  • X-Ways Forensics 21.9 SR-3

• Yamato Security

  • Hayabusa v4.4.0 – CODE BLUE Release
  • juntei v1.1.0 – CODE BLUE Release

• Yaniv Radunsky

  • DFIR Companion Detection rules rules-2026.11.12.2
  • DFIR Companion v0.46.0