Cyber security developments for Saturday the 20th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 4 articles to cover. All attribution is by the article authors. All article analysis is automated.
ESET have written up The Gentlemen ransomware gang's EDR-killing framework, which they call GentleKiller. What's notable here is that it's centrally managed and distributed to affiliates rather than each crew bringing their own tools, and they're weaponising BYOVD exploits within days of public disclosure. The group's been hitting organisations across Southeast Asia, South America, and Western Europe, often through vulnerable FortiGate configurations.
Dutch police have announced Operation Endgame, a disruption effort targeting the SocGholish malware group. They've identified nearly fifteen thousand compromised WordPress sites and are notifying owners with remediation guidance. SocGholish acts as an initial access broker, so this one's aimed at cutting off supply chains that feed ransomware attacks.
A researcher has disclosed UnCanny, a Windows privilege escalation technique that abuses the Windows Store InstallService to achieve SYSTEM-level execution from a non-admin account. It works by exploiting plugin loading via UNC paths when Developer Mode is enabled, allowing both machine-account NTLM relay and malicious DLL loading. There's also a persistence mechanism through work items that survives reboots, which is less than ideal.
CloudSEK have profiled BlueKit, a Phishing-as-a-Service platform that's lowering the barrier to entry for credential theft at scale. It runs on a subscription model with 87 different phishing kits, uses peer-to-peer rendering to evade detection, and includes real-time session cookie capture to bypass MFA. The platform also automates post-compromise workflows for account takeover, which makes it particularly effective against enterprise and financial targets.
That concludes today's briefing.