Cyber security developments for Sunday the 21st of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 9 articles to cover. All attribution is by the article authors. All article analysis is automated.
NSFOCUS and Guangzhou University have published their 2026 APT organisation research yearbook. It's an annual reference compendium tracking nation-state threat actors, their campaigns, attribution patterns, and operational characteristics through the year. One for threat intelligence teams who need a comprehensive overview of the APT landscape.
Huntress have disclosed a breach at Klue, a market intelligence platform. The Icarus threat group compromised the service using a dormant credential, pushed malicious code to harvest OAuth tokens, then used those to exfiltrate CRM data from Salesforce and Gong across multiple customer organisations. Extortion emails started going out on the 16th of June, affecting firms including Huntress themselves, Recorded Future, Tanium, and Jamf.
IBM X-Force have documented a technique for bypassing Windows Defender Application Control by exploiting trusted Electron applications. The method abuses known V8 engine vulnerabilities through modified main.js files and argument smuggling to execute arbitrary code within whitelisted processes. Particularly relevant if you're relying on WDAC as part of your endpoint hardening posture.
Security researchers have released RawHive, a Cobalt Strike tool that extracts registry hives and ntds.dit by directly parsing NTFS metadata and reading raw disk clusters. It bypasses standard file access controls by opening handles to raw volume devices. Defenders should watch for processes accessing raw volume handles — it's highly anomalous behaviour for anything that isn't a system process.
And another evasion tool in the wild. PhantomCtx automates Activation Context hijacking to force signed Windows executables to load malicious DLLs. It uses section unmapping and remapping to evade EDR detection, achieving code execution within trusted processes by abusing the Windows dependency resolution mechanism without needing vulnerable binaries.
Security researchers have documented a novel command-and-control technique that exploits Slack's server-side link preview functionality. The method embeds C2 instructions in HTML metadata tags which Slack's backend fetches and renders, bypassing network egress filtering since the malicious requests originate from Slack's own infrastructure. This class of vulnerability affects most collaboration platforms with similar preview features.
Security researchers have published a proof-of-concept for remote code execution via Git's clean filter mechanism. The technique weaponises legitimate Git filtering by binding malicious scripts through config and attributes files, which execute automatically when IDEs perform diff operations. It targets development environments with automatic Git integration, particularly those using libgit2.
The FBI have issued a warning about cybercriminals using Traffic Distribution Systems to redirect users to malicious sites. The platforms work by compromising legitimate websites, using SEO poisoning and phishing, then filtering victims by metadata and cloaking infrastructure to evade detection. Payloads include ransomware, phishing pages, and financial fraud sites — both individuals and businesses are being targeted.
And finally, an article from Gianni Castaldi on building a modern detection pipeline using the ContentOps framework for Microsoft Sentinel and Defender. The methodology treats detection rules with the same rigour as application code, using CI/CD pipelines with drift detection, automated linting, and safeguards like circuit breakers to prevent mass deletion during deployment. Worth a look if you're trying to move from reactive manual processes to managed detection engineering.
That concludes today's briefing.