This is the infosec briefing for Monday the 31st of August 2026, drawn from the BlueTeamSec community on infosec.pub — quite a busy one, with nineteen stories to get through.
iVerify reports that Android 16 introduces Intrusion Logging as part of Advanced Protection Mode — a forensic capability built with Amnesty International's Security Lab. It captures DNS and connection events plus twenty-five security event subtypes with per-app attribution, all encrypted and cloud-backed so they survive device wipes and remain inaccessible even to Google. This follows earlier coverage of consensual forensics with Android intrusion logging from mid-August.
GuidePoint Security's forensics team shows how the Active Directory Certificate Services database can serve as a persistent audit trail for detecting privilege escalation attacks, particularly those exploiting misconfigured certificate templates. The CA database maintains durable records of all certificate requests including denied attempts, and unlike standard event logs it can't be easily cleared or disabled — tools like Velociraptor can acquire it via raw NTFS access for forensic analysis.
AWS Security Blog has published guidance on detecting multi-stage attacks in cloud environments through cross-service signal correlation. The guide provides technical strategies for identifying attack patterns by correlating signals across AWS services, including queries for detecting role chain violations and sensitive data access — one for defenders working in AWS infrastructure.
Hudson Rock reports that in May 2023, a RedLine infostealer infection compromised a military police workstation in Suluk, Syria operated by the Turkish-backed Syrian National Army. The malware exfiltrated operational data including passwords, cookies, active Telegram sessions, and sensitive detainee case files, which later appeared on cybercrime marketplaces.
ReliaQuest was targeted by a sophisticated social engineering campaign on the 22nd of August, where attackers impersonated internal security staff via phone and directed employees to a fraudulent SSO page. One employee entered credentials and approved an MFA push notification, but the attacker's access was limited and no business systems or data were breached. Worth a read if you're refining social engineering defences — this one escalated through a BEC-style approach we've seen ramping up in recent weeks.
The International Association for Cryptologic Research has published analysis of the 2020 law enforcement operation against Encrochat, a vertically integrated encrypted communications platform used by organised crime groups. The operation exfiltrated both historical and real-time communications over several months by exploiting control over the device and infrastructure layer, resulting in over six thousand arrests across Europe. We covered related malware used in the operation back in August.
ZeroTrace Lab reports that Chinese state-sponsored threat group QTFY, operating as an infrastructure provider for MSS and PLA, had three domains seized by U.S. authorities after targeting NASA, the Department of Energy, the Federal Reserve, and several other U.S. government agencies. The group operated a reconnaissance platform called QScan and QTRouter hardware infrastructure, using Chinese commercial proxy services to obfuscate malicious traffic. We've seen this group appear several times over the past few days — the FBI and NSA issued warnings and the Justice Department announced platform seizures just last week.
Huntress investigated North Korean state-sponsored group FAMOUS CHOLLIMA conducting remote worker infiltration operations where DPRK actors obtain legitimate employment using stolen identities to generate revenue, evade sanctions, and establish insider access. The campaign targets healthcare, financial services, and sales sectors, with actors bypassing perimeter defences by operating as authorized employees with access to internal systems and sensitive data. This adds to coverage from mid-August on defending against DPRK IT workers and their crypto-to-fiat activity.
Censys discovered a misconfigured open directory exposing Moobot botnet source code, a DDoS-as-a-Service panel called StresD Pro Plus, and fraudulent identity verification tools. Despite a 2024 court-authorized disruption, Moobot remains active with over five hundred attack taskings observed from command-and-control infrastructure as recently as this August — the exposure reveals operational methods of a persistent Mirai-derivative botnet targeting IoT devices and gaming servers.
Confiant reports on the HexMage campaign, a Magecart-style digital skimming operation that has compromised over forty e-commerce websites since April 2026 using a technique called EtherHiding. Attackers leverage Ethereum Sepolia testnet smart contracts to host and dynamically update malicious delivery domain URLs, making detection and takedown significantly more difficult. The campaign targets WooCommerce, PrestaShop, and Magento platforms to steal payment card data during checkout. We've seen EtherHiding crop up a couple of times since early August, including in an npm supply chain incident and a DPRK wallet trail.
Altered Security demonstrates how attackers with appropriate Azure permissions can abuse BitLocker recovery keys stored in Microsoft Entra ID to decrypt exported VM disk snapshots. The technique exploits the intersection of legitimate backup features — BitLocker recovery keys, disk snapshots, and inadequate access controls — to bypass disk encryption protections on Azure VMs. Particularly relevant if you're managing Azure infrastructure and assume encrypted disks are safe at rest.
Unsecure.sh has released TheBiggerInterview, a benchmark scenario designed to test AI-driven SOC tools through a simulated multi-stage attack progressing from CI/CD compromise through Kubernetes to full AWS account takeover. The scenario specifically interleaves malicious actions with legitimate administrative activities to evaluate whether agentic security tools can accurately differentiate between normal operations and attacks across cloud-native infrastructure layers — one for teams evaluating autonomous SOC capabilities.
PaperCut Software has released Emergency Patch Release 2 addressing active exploitation of two critical vulnerabilities in PaperCut NG and MF print management software. One enables arbitrary Java bytecode execution through unsafe dynamic class loading, the other provides unauthenticated access to alter system configurations. Attackers are deploying remote access tools like SimpleHelp and AnyDesk following exploitation — if you're running PaperCut, flag this one immediately.
And another critical actively exploited vulnerability — the Australian Cyber Security Centre reports that a critical authentication bypass flaw in JetBrains TeamCity On-Premises is being actively exploited. Unauthenticated attackers can remotely execute arbitrary operating system commands via HTTP or HTTPS access, with all versions of TeamCity On-Premises affected. Australian organisations are urged to patch immediately and monitor for suspicious activity.
A developer inadvertently created a financial denial-of-service vulnerability by coupling expensive LLM API calls to Google Gemini directly to public HTTP requests without rate limiting. Google's search crawler triggered an infinite crawl loop by requesting dynamically-generated AI content, resulting in a six hundred dollar unexpected bill and polluting Google search results with AI-generated pages — which is either a cautionary tale about API design or an expensive lesson in rate limiting, depending on your perspective.
CISA released the Logging Reference Architecture to help Federal Civilian Executive Branch agencies implement standardised logging capabilities. The framework provides guidance for developing Agency Logging Plans to enable continuous event monitoring, threat hunting, incident investigation, and forensic capabilities across federal networks — useful background reading if you're designing logging infrastructure or dealing with compliance requirements.
Truffle Security re-verified over ten thousand leaked AWS keys from 2022 through 2026 and found eighty-eight percent still authenticate, with seven hundred and sixty-eight keys granting full administrative control including five hundred and twenty-six root keys. The median age of live leaked keys is over five years, and one hundred and thirty root keys are associated with organisation management accounts that control entire AWS organisations. This adds useful context to the logging and credential exposure coverage from earlier in August.
A security researcher proposes applying Statistical Process Controls to SOC alert management, introducing the Dynamic Incident Routing Engine framework that uses e-values for hypothesis testing. The approach reframes false positive reduction as a resource optimisation problem, analysing the Microsoft GUIDE dataset to demonstrate flaws in traditional alert management that lead to operational blindness and unmeasured risk — one for SOC leads thinking about alert fatigue and triage efficiency.
And finally, a security researcher has released darwin-vm, an open-source QEMU-based virtual machine environment that enables low-level security research on Apple Silicon and Darwin OS without requiring physical hardware. The project uses a custom QEMU fork to facilitate kernel and system-internal security mechanism analysis for iOS and macOS platforms — particularly useful if you're researching Apple's security model without access to a fleet of test devices.
That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated as ever.