Security news from the BlueTeamSec community for Saturday the 12th of September 2026. I'm Sebastian.
And I'm Tess. CISA's updated its Insider Threat Mitigation Guide, expanding the 2020 framework to cover hybrid work environments, AI-enabled manipulation, and modern access control vulnerabilities. It's a practical resource with case studies and behavioural indicators β worth flagging if you're revisiting insider risk policies.
Electronic Arts published its 2026 update on the Javelin anti-cheat system, which now protects over 57 million players across 20 titles. The write-up covers kernel-level protections, hardware security requirements like Secure Boot and TPM, and a claimed 99% detection accuracy across nearly 27 million blocked cheat attempts. One for those tracking endpoint security at scale, particularly gaming infrastructure.
Trellix's Advanced Research Center analysed five sophisticated campaigns from the first half of 2026. DarkSword caught the eye β it's an iOS WebKit exploit kit used in spear-phishing against NATO-aligned senior officials, attributed to Russian actors. The report also covers APT28 targeting European government and defence with weaponised documents, Bitter APT compromising embassies in Asia, and a supply chain attack on the npm package ecosystem. All five demonstrate nation-state and financially motivated groups exploiting trusted infrastructure and living-off-the-land tactics to evade detection.
The U.S. Department of Justice sentenced Ukrainian national Oleksii Lytvynenko to four years in prison for his role in the Conti ransomware conspiracy. He worked as both an intruder and loader malware developer, and continued ransomware operations even after the core group was disrupted. Conti affected over a thousand victims across 47 U.S. states and 31 countries, extorting more than 150 million dollars from critical infrastructure including hospitals and schools.
Unit 42 identified a threat cluster they're calling CL-CRI-1171, which has been running a pay-per-install marketplace for at least two years using a custom loader called OfferLoader. The operation targets young gamers via YouTube channels and corporate entities via search engine poisoning, delivering multiple malware payloads including Insomnia RAT and Docro Hijacker. What's notable is the sophisticated gating β they fingerprint visitors and serve decoys to security researchers to evade detection.
Check Point disclosed PuzzleMask, a technique that embeds malicious instructions inside benign-looking prose to bypass lightweight gatekeeper models in multi-model AI security pipelines. It exploits the reasoning gap between fast screening models and more powerful downstream models, allowing attackers to deliver restricted payloads that evade initial safety checks. This one's useful background if you're deploying AI agents with code interpretation capabilities.
An open-source adversary simulation framework called BEAR-C2 has been released, designed for red team operations that emulate tactics from Russian, Chinese, North Korean, and Iranian APT groups. It provides a graphical interface for campaign management with multi-protocol connectivity, multiple encryption methods, script obfuscation, and integrated exfiltration workflows via cloud services and messaging platforms.
And finally, an educational piece examining the technical limitations of decompilers and the risks of over-reliance on AI-powered reverse engineering tools. The authors emphasise that decompilation produces pseudo-C reconstructions based on heuristics, not perfect reversals, and warn that blind trust in automated tool output poses security risks as practitioners may lose foundational analysis skills. Worth a read if you're onboarding analysts who've grown up with large language models.
That's everything for today from BlueTeamSec. The writing is by the original authors β the analysis was automated. We'll be back tomorrow.