ARTICLES COVERED:

1. The Morris Worm: The Internet's First Major Wake-Up Call (Historical Archive)

ARTICLES COVERED:

1. Contagious Interview malware in SVG images: DPRK campaign (Elastic)
2. The One Chokepoint to Rule Them All: Why I Deleted 50 ClickFix Detection Rules and Replaced Them with One (Ddosier)
3. grokpatrol: Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure. (Optimus Labs)
4. Half a Second - The Backdoor That Almost Broke the Internet, and the Invisible Labor Beneath It (Adrian Mastronardi)
5. OpenSSL HollowByte: A DoS Hiding in 11 Bytes (Okta)
6. Accessing sensitive Passwords app account data on macOS (CVE-2025-24169) (Josh Parnham)
7. IPhone Hacking Firm Sues Ex-Worker Over Alleged Theft of Secrets (Bloomberg)
8. Magnet Forensics, LLC v. Del Gaudio (1:26-cv-03781) - allegedly Magnet were exploiting usbliter8 BootROM exploit that Paradigm Shift published - said it was leaked (Free Law Project)
9. Benchmarking 13 AI Models on Known CVE Detection (Aikido Security)

ARTICLES COVERED:

1. The RedLine Thread That Led to a Maritime BEC Infrastructure Cluster (VMRay)
2. Iran Reportedly Used a 1970s Phone Protocol to Track U.S. Troops Before Missile Strikes (Yahoo)
3. 금융보안원 - This report provides an in-depth analysis of attack and money laundering techniques employed by state-backed hacking organizations regarding cross-chain security threats among digital assets (금융보안원)
4. PolinRider Confirmed Footprint Grows 6.5x Since March (OpenSourceMalware)
5. European Password Manager Shares Origins and Updates with State-Certified Russian Firm (Organized Crime and Corruption Reporting Project (OCCRP))
6. Save the Date for Spamouflage (Graphika)
7. HelloNet campaign: a threat via the ViPNet update system (AO Kaspersky Lab)
8. ZSB-26014: Zoom Workplace for Windows - Improper Input Validation (Zoom Video Communications, Inc.)
9. Windows AppResolver LPE: From AppContainer to SYSTEM (David Carliez)
10. How I found an integer overflow in tcpip.sys (aprilpet)
11. wp2shell: Pre Authentication RCE in WordPress Core (Searchlight Cyber)
12. wp2shell - Code Trace Deep Dive (ZephrFish (Andy Gill))
13. wp2shell-poc: wp2shell - Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory. (Icex0)
14. Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures (Zhouhao Ji, Kaikai Pan, and Wenyuan Xu)
15. CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read (Openwall)
16. lCVE-2026-50416-writeup-and-poc: CVE-2026-50416: Windows 11 KASLR bypass (karollol)
17. Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation (Volexity)
18. Report into preliminary inquiries of Qantas (Office of the Australian Information Commissioner)
19. SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification (SingGuard Team, AI Security Lab, Ant Group)
20. tarit: A hypervisor and sandbox cloud for self-hosted AI agents and RL (Instavm)
21. Incantation: AI Deception Layer for - containing adversarial context designed to redirect or confuse an LLM agent reading your own infrastructure (Casey)
22. Crossing the Golden Gate: macOS's New Application Support Protection (Wojciech Reguła)
23. White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination (The White House)
24. AD-PathFinder: Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data. (NetSPI)
25. Offensive-COM: Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. (An0nUD4Y)
26. DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft (eSentire)
27. JSAC2027 - January, Tokyo - CFP (JPCERT/CC)
28. The State of Ransomware 2026 - Stolen identities cause 79% of ransomware attacks (Sophos Ltd.)
29. clx: A cross-platform ahead-of-time Lua compiler and runtime, using C++20 backend (Tine Samir)

ARTICLES COVERED:

1. How NHS England improved sign-in times and saved over £1m with passkeys (Google LLC)
2. Security incident disclosure — July 2026 - "The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline." (Hugging Face)

ARTICLES COVERED:

1. Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2 (Genians)
2. Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor (Broadcom)
3. Co-Founder of Controversial Spyware Firm Had Israeli Diplomatic Passport (Organized Crime and Corruption Reporting Project (OCCRP))
4. Moroccan intelligence insider reveals widespread use of Pegasus hacking software (The Guardian)
5. Detections for LegacyHive exploitation by GossiTheDog (GossiTheDog)
6. Revised Telecommunications Security Code of Practice 2026 (version 1.1) (Department for Science, Innovation and Technology)
7. Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers (media.defense.gov)
8. AsyncAPI Supply Chain Compromise via GitHub Actions (Wiz)
9. Teen hackers jailed after live streaming cyber attack on TfL - sentenced to five years and six months in prison. (BBC)
10. COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8} (Astharot15)
11. CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining (Tiziano Marra)
12. Registry Snapshots for Post Exploitation Enumeration (S12 - 0x12Dark Development)
13. UnwindRaven is a Windows x64 offensive research framework that constructs fully synthetic call stacks at thread startup time, making a newly created thread appear (toneillcodes)
14. There and Back Again: An Operators Guide on NTLM Relaying Egress (SpecterOps)
15. windows-process-injection: A collection of techniques for process injection on Windows (toneillcodes)
16. Ghost in the 7‑Zip: The Shadow of Residential Proxies Creeping into Your Life (DOCOMO BUSINESS, Inc.)
17. BingusLdr: BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique. (Sizeable-Bingus)
18. Modular PIC Implant Design (Kirchware)

ARTICLES COVERED:

1. REWARD UP TO $10,000,000 USD - FOR INFORMATION ON Russian Malicious Cyber Actors (U.S. Department of State)
2. Alleged Russian cyber spy in Boston case previously worked for Kaspersky, source says and documents show (Thomson Reuters)
3. BirdCall: ScarCruft Malware Masquerading as Zangi Messenger (S2W)
4. Analysis of attack actions suspected to be from the APT-C-26 (Lazarus) group upgrading its monitoring program (奇安信威胁情报中心)
5. Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries (Hunt.io)
6. Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident (Expel, Inc.)
7. DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel (Cyderes)
8. TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains (Elastic)
9. Tailscale: Tailscale SSH previously accepted usernames that contained a leading - character. On Linux platforms these usernames were passed as arguments to getent(1) leading to ACL bypass (Tailscale Inc.)
10. cyber-decoy: Experimental Decoy Broker (secdev02)

ARTICLES COVERED:

1. Three Russian Nationals Indicted for International Cybercrimes Resulting in More Than $62M in Losses to Victims (U.S. Attorney's Office for the Northern District of Ohio)
2. Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries (Hunt Intelligence, Inc.)
3. Update on Attacks by Threat Group APT-C-60 in 2026 (JPCERT/CC)
4. CERT-UA Handled 3,309 Cyber Incidents in the First Half of 2026 (State Service of Special Communications and Information Protection of Ukraine)
5. Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer (Arctic Wolf)
6. Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026 (DomainTools)
7. Public to be told how to prepare for cyber-attack and weather emergencies (British Broadcasting Corporation)
8. Forgotten UEFI shims undermining Secure Boot (ESET)
9. LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability (MSNightmare)
10. SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade (SonicWall)
11. Miasma Worm Returns to npm (JFrog)
12. Lucide Proxy: Turning Student Web Proxies into DDoS Bots (JFrog)
13. OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration (Proofpoint)
14. Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links (Hunt.io)
15. Pandora’s Container Part 1: Unpacking Azure Container Security (TrustedSec)

ARTICLES COVERED:

1. Targeting and Compromise of French Entities Using the Turla Intrusion Set (Agence nationale de la sécurité des systèmes d'information (ANSSI))
2. UK and Allies urge critical sectors to improve defences against Russian intelligence targeting (National Cyber Security Centre (NCSC))
3. Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (Cybersecurity and Infrastructure Security Agency)
4. Russian man pleads not guilty in US cyber espionage case (AOL Media LLC)
5. UK and EU strike Russian cyber networks with new sanctions (Foreign, Commonwealth & Development Office)
6. Hidden Exfiltration Capability Discovered in a Trusted, 900,000-User Chrome Web store Extension (Stripe OLT)
7. jscrambler npm Package Compromised in Supply Chain Attack (Socket)
8. SharpViewStateKing: The stealthy implant framework - Canadian Centre for Cyber Security (Canadian Centre for Cyber Security)
9. chimera: Sandbox untrusted code with safe access to the host. (Pekka Enberg)
10. Lessons from CISA’s Cyber Incident (Cybersecurity and Infrastructure Security Agency (CISA))

ARTICLES COVERED:

1. One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators (Ambionics)
2. How WP-SHELLSTORM Exposed 1.4M WordPress Sites (SOCRadar® Cyber Intelligence Inc.)
3. How a Gang of Thieves Pulled Off a Multimillion-Dollar Data Center Heist (The New York Times)
4. Teen accused of using ChatGPT to delete 46,000 anime accounts (The Asahi Shimbun Company)
5. Unfit to Boot: Breaking U-Boot's FIT Signature Verification (Binarly)
6. Patch Release Update: Zimbra 10.1.19 - 'security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened' (Synacor)
7. The SQL Server Unicode problem: why your data might not be what you (Synacktiv)
8. Man Serving Federal Prison Sentence Charged with Theft of Forfeited Cryptocurrency (United States Department of Justice)
9. AnyDesk forensic artefacts (Ayush Anand)
10. Use Unified Sign-In logs in Advanced Hunting (Fabian Bader)
11. Finding SOCKS with Proxywatch (SpecterOps)
12. stinger: Unprivileged endpoint deception for macOS and Linux workstations. Uses FIFO baits, other local traps, and protected sessions to detect secret collection as it happens. (0x4D31)
13. EPM Part 3: Writing Intune Endpoint Privilege Management rules for the real world: File hash, certificate, and when each one is the wrong choice - MSEndpointMgr (MSEndpointMgr)
14. Scheme Hunter - Enumerate URI schemes and prototype invocation - WDAC / AppLocker Bypass Recon Scripts (AlloySecureGroup)
15. Kestrel: Passive Active Directory security enumeration via native ADSI/COM interfaces. (ssteelfactor-oss)
16. tempolocus: Tempolocus is a time-series activity patterns and approximate location inference (CIRCL)
17. How Windows App Execution Aliases Work (and How to Read Them in C++) (Pavel Yosifovich)
18. JQ for Hackers (TrustedSec)
19. CaddySmith: Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles. (IceCubeSandwich)

ARTICLES COVERED:

1. Tracking a K8-Branded Web Cluster Across 10,156 Domains (Webamon)
2. GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses (Broadcom)
3. Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639) (AmberWolf)
4. RedWing: A Mobile Malware-as-a-Service Operation (Zimperium)
5. nodemon-sudo: an npm Backdoor With No Install Script (SafeDep)
6. Adversarial Intelligence: Local LLMs for Automated Attacks (Mike Scutt)
7. klist.exe Revisited: Internals and Further Use Cases (Jake Otte)
8. nimcrypt: Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender. (Chaelsoo)
9. klist2ccache: Dump TGTs remotely and convert Windows' klist binary output to ccache. (jakeotte)
10. ida_rpc: IDA Pro RPC for assisted RE-tasks (B.Kerler)
11. Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? (arXiv)
12. Sighthound: rule-based SAST scanner (Corgea)

ARTICLES COVERED:

1. DarkSpectre — a Chinese state-sponsored threat actor, maintains persistent access to enterprise environments by weaponizing legitimate browser extensions after establishing a trusted user (ExtraHop)
2. Large-scale exploitation campaign targeting website content management systems (CMS) (Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC))
3. Nederland doelwit van Russische spionageoperatie via IP-camera’s | The Netherlands targeted by Russian espionage operation via IP cameras (Rijksoverheid)

ARTICLES COVERED:

1. One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement (SentinelOne)
2. Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories (Socket)
3. Onderzoek naar hack Odido wijst op mogelijke betrokkenheid Nederlanders | Investigation into Odido hack points to possible involvement of the Dutch (Politie Nederland)
4. Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor (Datadog)
5. Cybersecurity Startup Publishes Infostealers to NPM (Paul McCarty)
6. Januscape: Guest-to-Host Escape in KVM/x86 (Hyunwoo Kim)
7. XRING: Crashing XQUIC with spec-compliant QPACK instructions (FoxIO)
8. Vulnerabilities of Realtek SD card reader driver, part2 (zwclose)
9. CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware (Huntress)
10. Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps (Socket)
11. Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting (Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and Ben Nassi)
12. GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware (Microsoft)
13. Random Windows Things Part 1: PreviousMode Mitigation (Winsider Seminars & Solutions Inc.)
14. Evolving Windows vulnerability management to meet the speed of AI-powered discovery (Microsoft)

ARTICLES COVERED:

1. AI Research in Security Operations Pushing the frontier of AI agents for real security work (Cotool)
2. Inside an AI-Assisted Cloud Attack: Familiar Techniques at Unfamiliar Speed - or written another way AI slower than most ransomware crews (Sygnia)
3. Process Parameter Poisoning (Orange Cyberdefense)
4. GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos (Noma Labs)

ARTICLES COVERED:

1. The Investigation Bureau has cracked a case involving the Chinese Communist Party's cyber army, which impersonated international journalists to conduct social engineering attacks (Ministry of Justice Investigation Bureau)
2. Cavern Manticore: Exposing Iran-Linked Modular C2 Framework (Check Point Research)
3. The National Police have arrested a suspected collaborator of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. (Dirección General de la Policía)
4. UAT-7810 continues building ORB networks using new malware (Cisco Systems, Inc.)
5. One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation (Proofpoint)
6. PhantomFS: PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant Event Log (Alloy Secure)
7. Windows Privilege Abuse: Attackers' Path to Active Directory Compromise (Semperis)
8. Recovering Active ADFS Signing Keys via Machine DPAPI | Google Cloud Blog (Google)
9. Full writeup of the Windows GDID - Global Device Identifier fully reverse engineered (SmtimesIWndr)
10. GDID Disabler - Windows (SmtimesIWndr)

ARTICLES COVERED:

1. Hook Chains (how I built Crystal Kit incorrectly*) (Rasta Mouse)
2. EasyTokens: Kali365 - EvilTokens Replica (Casey Smith)

ARTICLES COVERED:

1. TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry (Trend Micro)
2. Does anyone even use GitHub for federated authentication? (Sapir)
3. Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver (GFAC_Sys_x64.sys) (FzRsLLaSheR)
4. Identity Crisis in Confidential Computing: Formal Analysis of Attested TLS (Association for Computing Machinery (ACM))
5. Improved RpcGhosting (Practical Security Analytics)
6. Escalating from On-prem to Entra through MITM Attacks (SVA System Vertrieb Alexander GmbH)
7. Exploring cross-domain & cross-forest RBCD: part 2 (Synacktiv)
8. @marketfront: 25 npm Packages Reuse a Known Lure (Safedep)
9. Linux Backdoor Targeting iKuai Routers (dmpdump)
10. NebulaPulsar: NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of the Alien project. (iss4cf0ng)
11. GeoLocation_BOF: Cobalt Strike BOF to obtain location data (CodeXTF2)
12. Hunting Sleeping Giants: Detecting Encrypted Beacon Sleep Obfuscation (Russell Allen)
13. BareMetal-RAM-Dumper: A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory. (pIat0n)
14. Nox: Modular Go framework for attack surface management, reconnaissance, and vulnerability scanning. (kernelstub)
15. T3MP3ST: autonomous red teaming platform; multi-agent offensive-security meta-harness (elder-plinius)
16. Arrest of Iranian Hacker Spotlights Iran’s Movement into Economic Espionage and IP Theft (Kim Zetter)
17. Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery (Synaptic Systems)

ARTICLES COVERED:

1. Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public (GreyNoise, Inc.)
2. The Gentlemen RaaS: rapid growth and a new ransomware variant (AO Kaspersky Lab)
3. How I broke Rhysida ransomware encryption (Sigreturn Labs)
4. From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks (Arctic Wolf)
5. Armored Likho's new weapon: BusySnake Stealer - "tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence)." (AO Kaspersky Lab)
6. GRU: military unit 67606 (S2 Grupo)
7. WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication - (WatchGuard Technologies)
8. Unauthenticated Stored XSS in NEX-Forms Express WP Form Builder (≤ 9.1.10) — CVSS 8.8 High (CVE-2026–10525) (Sai Krishna Kothapalli)
9. Bad Epoll: The bug missed by Mythos (Jaeyoung Chung)
10. Fake Google and Cloudflare verification pages spread multiple malware families (Malwarebytes)
11. PamStealer: macOS Malware Posing as Clipboard Manager App (Jamf)
12. FBI Seizes NetNut Proxy Platform, Popa Botnet (Brian Krebs)
13. The Blind Spot in the Watchtower: Detections for When Someone Attacks Your Sentinel (Alex Teixeira)
14. Knossos: Procedurally Generated Decoy Environments (Praetorian)
15. Building more resilient CNI: what industry penetration testers told us (National Cyber Security Centre (NCSC))
16. On Favicons: From Browser Icons to Attack Surface Intelligence (Bishop Fox)
17. OpenUDC2: This is an open source implementation of the UDC2 spec used in Cobalt Strike (CodeXTF2)
18. tf-mythic-azure: Automatically deploying Mythic C2 in Azure using Terraform (qmadev)
19. Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs (Expel)
20. Boss Scam: Don’t Trust Every “Urgent” Message from Your Boss! - "It runs in the background till it finds an active WhatsApp Web session in Chromium-based browsers" (K7 Labs)

ARTICLES COVERED:

1. Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus - The Citizen Lab (The Citizen Lab)
2. Accelerating EDR Evasion with LLM-Driven Analysis (SpecterOps)
3. ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 (Cisco Talos)
4. GadgetSniper: Precision call-stack spoofing gadget hunter for x64 DLLs, powered by Iced disassembler (ZakiPedio)

ARTICLES COVERED:

1. PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems (Socket)
2. Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool (Recorded Future)
3. Kibana 7.17.15, 8.11.1 Security Update (ESA-2026-53) - Improper Output Neutralization for Logs in Kibana can lead to log injection via Log Injection-Tampering-Forging (Elastic)
4. skewrun: Active Directory time discovery protocols for red teams. Stealthy extraction via Kerberos, SMB, NTLM, and CLDAP. (JVBotelho)
5. Don’t pay the ransom: Warning to organisations to protect themselves from ransomware attacks as more than 320 businesses affected last year (City of London Police)

ARTICLES COVERED:

1. How the ToddyCat APT group gains access to Gmail accounts (Kaspersky Lab)
2. Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (JFrog)
3. AI Security Incident Case: Miasma Worm Attacked Microsoft GitHub (NSFOCUS)
4. JADEPUFFER: Agentic ransomware for automated database extortion (Sysdig)
5. CredSpy: Entra ID user enumeration and auth method discovery via the public GetCredentialType API (Keanu Nys)
6. Fortinet Vulnerability CVE-2026-35616 and EKZ Stealer, Attacking Obfuscating Compilers with Binary Ninja Workflows (eSentire, Inc.)
7. ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 (Cisco Talos)
8. Anatomy of an Attack: VIPERTUNNEL (ExtraHop)
9. Hollow: hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. (Chaelsoo)
10. SpotifyC2: SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery (NirvanaOn)
11. RustDuck: An In-Depth Analysis of a Two-Stage Botnet (Qianxin XLAB)
12. Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to the United States (United States Department of Justice)
13. A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain (Blackpoint Cyber)

ARTICLES COVERED:

1. The Morris Worm: When a Graduate Student Broke the Internet (Historical Archive)

ARTICLES COVERED:

1. Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON (Acronis)
2. SOCRadar has attributed FortiBleed to the Lynx / INC ransomware group (SOCRadar® Cyber Intelligence Inc.)
3. From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira - The DFIR Report (The DFIR Report)
4. Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer (JFrog)
5. The Biometric AuthToken Heist: Cracking PINs and Bypassing CE via a Long-Ignored Attack Surface (Android) (DARKNAVY)
6. pagecache-lpe-containment-kit: defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation (Douglas Mun)
7. ipv6_frag_escape: Linux LPE - Reliable Jail/Container Escape (sgkdev)
8. Dumping LSASS Without Touching Disk: Improvements to ShadowDumper (Practical Security Analytics LLC)
9. About Hypervisor Cheats, Part 2: EPT/NPT, Split Views, and Second-Stage Fault Evidence (Kernullist)
10. Anatomy of a WHQL-Signed Windows Filtering Platform (WFP) Kernel-Resident Network Backdoor (www.nextron-systems.com)
11. Modern Adventures in Azure Privilege Escalation (NetSPI)
12. Mark-of-the-Web: the rules changed, the tools didn’t (Maxim Suhanov)

ARTICLES COVERED:

1. Understanding Trends & Patterns In Insider Threat: Analysis Of 1,000+ Cases (Jawed Karim)
2. Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment (Seqrite)
3. AsyncRAT Family Threat Overview (Censys)
4. Proxmox and Adversaries (ZombieLucy)
5. Control who and what triggers GitHub Actions workflows - GitHub Changelog (GitHub)
6. Inside StegoAd: How a Threat Actor Evolved to Fuel Silent Ad Fraud and Credential Theft at Scale (Orenda Security LLC)
7. From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach (Fortinet, Inc.)
8. CVE-2026-11374: Account takeover vulnerability in ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus (ManageEngine)
9. CrystalSliver: Crystal Palace Evasion kit for Sliver (Simone Licitra)
10. khaos-c2: KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks. (28Zaaky)
11. Time Travel Debugging with Codex (SpecterOps)
12. Harnessing Harnesses - Climbing the LLM Hills (ZephrSec)
13. Customer & Partner Updates: Remote Code Execution Vulnerability in PTC’s Windchill and FlexPLM Solutions | June 2026 | PTC (PTC)

ARTICLES COVERED:

1. Internet Crime Complaint Center (IC3) | Russian Intelligence Services Continue to Target Commercial Messaging Applications (Internet Crime Complaint Center (IC3))
2. LOTSを活用して進化を続けるKimJongRAT – KimJongRAT continues to evolve by utilizing LOTS (Internet Initiative Japan Inc. (IIJ))
3. security-audit-skill: A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings (Cloudflare)
4. a CVE dispute (Daniel Stenberg)
5. CVE-2026-45504: CVE-2026-45504 Microsoft Exchange File Read - allows an authenticated low-privileged user to read arbitrary local files from the Exchange server by creating an EWS ReferenceAttachment (Hawktrace)
6. gluegate: Memory API proxy via signed mozglue.dll - Detection research PoC: proxy memory operations (memory mapping, local memory allocation) through Mozilla's signed mozglue.dll (sbousseaden)
7. heavener: This is what happens when you can't afford EDR licenses (Otter)
8. One Bool. Six Shells. AMSI’s Design Problem. (Evariste (bl4ckarch))

ARTICLES COVERED:

1. Cyber Prevent: A descriptive evaluation of cohort reoffending (National Crime Agency)

ARTICLES COVERED:

1. Using SASE in a Modern TIC 3.0 Solution (Cybersecurity and Infrastructure Security Agency)
2. SBU and FBI exposed Russian special services in systematic attempts to "hack" messengers of officials in Ukraine, Europe and the USA (Служба безпеки України)
3. Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances (ESET)
4. Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading (Robin Dost)
5. UNC5792 – Rewards For Justice (U.S. Department of State)
6. Russia Breaks Into Human Rights Activist's Phone With Cellebrite - The Citizen Lab (The Citizen Lab)
7. CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure (Palo Alto Networks)
8. StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon (Kaspersky)
9. Analysis of APT-C-36's Recent Activities in Colombia (Intelligence-Group)
10. Lazarus Targets the Financial Sector with Memory-Only Malware Toolset (Cognyte Software Ltd.)
11. Miasma Returns: Leo Platform Compromise in npm (Sonatype Security Research Team)
12. Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access (Microsoft)
13. Director-General's Annual Threat Assessment 2026 - "We discovered nation state hackers had compromised the network of an Australian critical infrastructure provider." (Australian Security Intelligence Organisation)
14. Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker (Broadcom)
15. DCloud Uni-App: One Framework, 236,000+ Scam Sites (Infoblox)
16. Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager (Google Cloud (Mandiant))
17. From context_handle to type confusion - A Type Confusion Vulnerability Pattern in Windows RPC Servers (Whereisk0Shl)
18. codfish/semantic-release-action GitHub Action has been compromised (StepSecurity)
19. LoaderClient Malware Analysis: How WeedHack Uses Ethereum Smart Contracts for Resilient C2 Infrastructure (Buguard)
20. KuinaExtractor: Six Months of a Rust Infostealer's Evolution (Threatray)
21. Disposable Tooling: Building LLM-Generated Mythic Agents from Prompt to Deployment (SpecterOps)
22. Trust No One: Automating macOS Privilege Escalation at Scale (XM Cyber)
23. LACUNA Chain: Ghost Frames — defeats all EDR layers of call-stack-based detection (Mohamed Alzhrani)
24. Harnessing the Power of Cobalt Strike Profiles for EDR Evasion (White Knight Labs)
25. Release Obfusk8 v1.5 (x86byte)
26. Target Flags - Apple Security Research - "Target Flags are a new security research capability in Apple operating systems that make it easier to objectively demonstrate your findings" (Apple)
27. Testing AI Threat Hunting against Real-World KQL: A Side-by-Side Test (Alex Teixeira)
28. The Latest Addition to Turla’s Intelligence Gathering Apparatus (Google)

ARTICLES COVERED:

1. Reconnaissance Scanning Tools Used by Chinese Threat Actors and Those Available in Open Source (Natto Team)
2. SindriKit: A foundational C library for building operationally credible offensive capabilities (youssefnoob003)

ARTICLES COVERED:

1. Dismantling Fortibleed: Inside a Russian Fortinet compromise operation (socradar.io)
2. HoneyWire: HoneyWire: The Open-Source, Unlimited Deception Platform. Turn any Linux machine into an enterprise-grade canary in 60 seconds. (Andrea Termine)
3. CVE-2026-41089: CVE-2026-41089 PoC — Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL) - only a Denial of Service PoC not RCE (0xABCD01)
4. Ghost-Sender - Universal Email Spoofing against Exchange Online (InfoGuard AG)
5. macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox (SentinelOne)
6. From Langflow to Monero: Inside CVE-2026-33017 Cryptominer (Trend Micro)

ARTICLES COVERED:

1. CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure (Cybersecurity and Infrastructure Security Agency)
2. Analysis of Reported Credential Compromise of FortiGate Devices (Fortinet, Inc.)
3. From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet (Microsoft)
4. Klue Third-Party Cybersecurity Incident (Jamf)
5. Two men plead guilty over £39m Transport for London cyber attack (BBC)
6. From PostCSS Masquerading to Windows RAT (JFrog)
7. Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs (Spur Intelligence Labs)
8. Bypassing Conditional Access policies that have a resource exclusion (Dirk-jan Mollema)
9. Prevent data exfiltration: AWS egress controls for cloud workloads | Amazon Web Services (Amazon Web Services)
10. Securing the Nation Against Advanced Cryptographic Attacks (The White House)
11. Using the Cert Graveyard (Rogue Authority LLC)
12. GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain (Synaptic Systems)
13. Security Update: Tanium’s Response to the Klue Breach that Allowed Data Exfiltration from Salesforce | Tanium (Tanium)

ARTICLES COVERED:

1. UK Cybercrime Journal: Sustained DragonForce Campaign (BushidoToken)
2. Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework (Sekoia.io)
3. The Booking.com Phishing Campaign Targeting Hotels and Customers (Bridewell)
4. Mind the Gap: GCP serviceData in Logs Explorer vs. Exported Logs (Permiso Security)
5. Azure AD Graph Activity Logs: detecting directory enumeration (Elastic)
6. Reduce Microsoft Sentinel Costs with Summary Rules (NVISO)
7. OSS Artifact Scanning at Scale Without Burning Your Token Budget (Nextron Systems)
8. An Update on the Recent Klue Security Incident - Klue (Klue)
9. A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope (Snyk)
10. Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind (CloudSEK)
11. NOW: NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose. (Nirvana)
12. GhostPack Necromancy: Reforging C# Tools with WasmForge (Praetorian)
13. Harnessing the Power of Cobalt Strike Profiles for EDR Evasion – Part 3 (White Knight Labs)
14. RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse (LevelBlue)
15. Threat Brief: Mitigating Large-Scale Credential Attacks (Palo Alto Networks)
16. macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT (Netskope)
17. asftriage: LLM Agent Session Forensics Tool - A forensic investigation tool for AI agent session logs (Claude Code and Codex CLI). (OA Labs)
18. OXLOADER: new loader evading detection to drop infostealer (Elastic)
19. Composer & Packagist Supply Chain Security in 2026 (Nils Adermann)
20. Man jailed for role in “SMS Blaster” fraud operation following City of London Police investigation (City of London Police)
21. Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections (Gen Digital)
22. Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model (Cisco Talos)

ARTICLES COVERED:

1. Fable 5 Cybersecurity benchemark (Graphistry)
2. astro.config.mjs Supply Chain Attack via Blockchain C2 (SafeDep)
3. Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies (OALABS)
4. The Klue Security Incident and Its Impact on Recorded Future (Recorded Future)
5. DSA-2026-197: Security Update for Dell Client Platform BIOS for a Weak Encoding for Password Vulnerability (Dell Technologies)
6. Introducing usbliter8: Apple iPhone A12/A13 SecureROM exploit (Paradigm Shift)
7. Squidbleed (CVE-2026-47729) (Calif.io)
8. Bring Your Own Everything: Traitorware (Print3M)
9. More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers (QiAnXin XLab)
10. Multiple JetBrains IDE plugins caught stealing AI keys (Aikido)
11. Popa: From Sourcing to Distribution (Synthient)
12. Deobfuscation in the Age of Agentic Reverse Engineering (Tim Blazytko and Nicolò Altamura)
13. ktrace: Speakeasy-based Windows kernel-mode driver API tracer (struppigel)
14. SELECT * FROM binary - Vibe Reversing Across IDA, Ghidra, and Binary Ninja (Elias Bachaalany)
15. From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker (Check Point Research)
16. Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline – Europol analysis links the criminal service to over 15 international cybercrime investigations | Europol (Europol)

ARTICLES COVERED:

1. APT Organization Research Yearbook (2026 Edition) - Chinese (绿盟科技、广州大学网络空间安全学院)
2. Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress | Huntress (Huntress)
3. Operationalizing browser exploits to bypass Windows Defender Application Control (WDAC) (IBM)
4. RawHive: Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk. (nmht3t)
5. PhantomCtx: Activation Context Hijacking Evasion Tool (r3xmax)
6. Using Slack links-preview to smuggle C2 in locked-down environments. (RWXstoned)
7. git-clean-filter: This is a proof-of-work for abusing git's clean filter against IDEs & Sublime. (RootUp)
8. Internet Crime Complaint Center (IC3) | Cyber Criminals Redirecting Users to Fraudulent Websites with Malicious Traffic Distribution Systems (Federal Bureau of Investigation (FBI))
9. Building a Modern Detection Pipeline with ContentOps (Gianni Castaldi)

ARTICLES COVERED:

1. International law enforcement initiate hunt on malware group SocGholish (Dutch police (Politie))
2. UnCanny: Another new coercion primitive with LPE 0day - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin resolution experiments (0xHossam)
3. Bluekit Phishing as a Service (PhaaS) (CloudSEK)
4. Killing me gently: Inside Gentlemen’s EDR killer framework (ESET)

ARTICLES COVERED:

1. Counsel for the AGC and the affiant described the Cyber Threat Reduction Measures Warrant as necessary to protect critical infrastructure from foreign adversaries that have infected certain SOHO IoT (Federal Court)
2. Threat Intelligence Report: Russia, Router, DNS, and Messaging-Layer Collection Operations (DomainTools)
3. Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research | Google Cloud Blog (Google)
4. Operation Escaneo: Infrastructure Exposure, TTP Analysis, and Attribution Assessment of an Advanced Intrusion Campaign Against Mexican Federal Agencies and Financial Institutions | CloudSEK (CloudSEK)
5. Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain (Rapid7)
6. Analysis Report on Recent Phishing Attacks by the APT-C-48 (CNC) Group (奇安信威胁情报中心)
7. FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure (Hudson Rock)
8. Cisco Security Advisory: Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability (Cisco Systems, Inc.)
9. Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat (StepSecurity)
10. 정상 이력서처럼 보이지만 실행 순간 감염 시작 - It looks like a normal resume, but the infection starts the moment it is executed. (AhnLab)
11. Hunting Honey Pots as Red Teamers (CYPFER)
12. VSMEx: A Collection Tool and a Dataset of Malicious VS Code Extensions: Data/Toolset Paper (Association for Computing Machinery)
13. Operation Poisson – Analyzing a Cybercriminal’s Entire Operation (Cato Networks)

ARTICLES COVERED:

1. Chinese Grid Operators Maintain Offensive Cyber Programs - Jamestown (The Jamestown Foundation)
2. GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions (Socket)
3. FishMonger’s arsenal upgraded: SprySOCKS for Windows (ESET)

ARTICLES COVERED:

1. Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server (Hunt Intelligence, Inc.)
2. Ransomware Tool Matrix Project Updates: Three Groups To Track (BushidoUK)
3. SBOM Adoption State of Play - 2026 | ENISA (European Union Agency for Cybersecurity)
4. HallWatch: Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more. (Adam Zypherion)

ARTICLES COVERED:

1. Hunting North Korea's job adverts on Google Docs (Kieran Miyamoto)
2. Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 (Genians)
3. Actively Understanding the Dynamics and Risks of the Threat Intelligence Ecosystem - NDSS Symposium (Internet Society)
4. NIST Special Publication (SP) 800-126 Rev. 4, Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.4 (National Institute of Standards and Technology (NIST))
5. Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does (Guillaume Ross)
6. Well-architected best practices for software supply chain security | Amazon Web Services (Amazon Web Services (AWS))
7. 反入侵 Pipeline 2.0 (Agentic) -Anti-intrusion Pipeline 2.0 (Agentic) (Chinese) (奇安信攻防社区)
8. ADR: An Agentic Detection System for Enterprise Agentic AI Security (Uber Technologies, Inc.)
9. Scales — carving an embedded eBPF rootkit (jolmos)
10. OptinMonster supply chain attack hits 1.2 million sites (Sansec)
11. CVE-2026-45454 — Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution (Aretiq AI)
12. Unpacking .zip: A First Look at Domain and File Name Confusion (Oregon State University, Georgia Institute of Technology)
13. After applying AI to perform a deep audit of ActiveMQ patches, two new high-risk vulnerabilities were discovered (Chinese) (腾讯安全应急响应中心)
14. Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected (Sygnia)

ARTICLES COVERED:

1. tracebit_x33fcon_2026: a POC sensor aiming to fingerprint implants in memory using only lowlevel runtime telemetry. (ThreatHunting.io)
2. ModuleStomped: Proof of concept to detect module stomping detection by looking for modified .pdata sections. (0xjbb)
3. Trusting trust - building Nix from a manually verified seed (Helsing)
4. EDRUnChoker: EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies (sbousseaden)
5. Hardening Intune: The Implementation Guide (TrustedSec, LLC)
6. ADWS-BOF: Beacon Object File for LDAP Queries Through ADWS (Ethan)
7. tunnel-vision-toolkit: Offensive security toolkit for Microsoft Global Secure Access (GSA), Microsoft's Zero Trust Network Access (ZTNA) solution. (Arshia Reisi)
8. Phishing for Lobsters: How We Tricked OpenClaw into Spilling Secrets (Varonis)
9. Roughly 400 AUR (Arch User Repository) packages compromised (Arch Linux)
10. ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit | Google Cloud Blog (Google Cloud)
11. rax: rax is a CPU emulator that does not trust itself. (Hex-Rays SA)
12. Noradrenaline: Offensive macOS and Linux shared library modules for Poseidon and other agent frameworks. Designed to be small and quick for automation. (atomiczsec)
13. Preliminary analysis of AUR malware (Codex)
14. Covert Kernel/User Communication Channels on Windows: Rootkits, Game Cheats, and Detection (kernullist)

ARTICLES COVERED:

1. Interlock and Rhysida within the Ransomware Ecosystem | IBM (IBM)
2. Detecting Misuse with the Claude Compliance API: The Threat Is in the Content (PaperMtn)
3. Factoring "short-sleeve" RSA keys with polynomials (Trail of Bits)

ARTICLES COVERED:

1. BOD 26-04: Prioritizing Security Updates Based on Risk (Cybersecurity and Infrastructure Security Agency)
2. Behind Khmer Shadow: Targeted espionage against Cambodian government entities (Acronis)
3. Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation (Lumen Technologies)
4. BLUERABBIT: A Golang-Based Backdoor with Ransomware and Destructive… (Binary Defense)
5. APT28, an evolution of tradecraft (Sekoia.io)
6. OceanLotus: From external espionage to domestic targeting (ESET)
7. ホテル業界を標的とした不審メールの分析（パート1: キャンペーン概要編）- Analysis of suspicious emails targeting the hotel industry (Part 1: Campaign Overview) (ITOCHU Cyber & Intelligence Inc.)
8. ホテル業界を標的とした不審メールの分析（パート2: 技術詳細編） - Analysis of Suspicious Emails Targeting the Hotel Industry (Part 2: Technical Details) (ITOCHU Cyber & Intelligence Inc.)
9. APT-C-08（蔓灵花）近期钓鱼网站攻击活动分析 - Analysis of Recent Phishing Website Attacks by APT-C-08 (Manlinghua) (WgpSec)
10. Now Available: Practical Guidelines for Preventing and Mitigating Ransomware (www.nccoe.nist.gov)
11. Hardening Intune: The Implementation Guide (TrustedSec)
12. BUMSRAKETE™ — The Most Beautiful, Most Tremendous FreeBSD Vulnerability In The History Of Computing. BELIEVE ME. (Bumsrakete)
13. GreatXML a bitlocker that seems to only work if you ever had Defender Offline Scan (NightmareEclipse)
14. User-to-User Authentication: Down the Rabbit Hole - Part 1 (SpecterOps)
15. DCOMIllusionist: DCOM in memory and fileless lateral movement techniques through .Net deserilization (Synacktiv)
16. Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 (SpecterOps)
17. NimSyscallPacker: This Packer can be used to pack any C# Assembly, PE-File or Shellcode into a Nim binary. It will encrypt the target payload, build the corresponding Nim source code accordingly (Fabian Mosch)
18. A Long-running BOF Component Contract (Raphael Mudge)

ARTICLES COVERED:

1. [Op Report] From SSA Phish to AdaptixC2: A Multi-RAT Intrusion (MalBeacon)
2. On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface) (Arista Networks)

ARTICLES COVERED:

1. Synthetic APTs: the Collapse of TTP-Based Attribution (Alias Robotics)
2. Microsoft Defender now monitors RPC activity (Microsoft)
3. Whoops! I did it again. I patched Windows Kernel at Milan0day 2026 (Ethical Hacker)
4. RoguePlanet: RoguePlanet Windows Defender Vulnerability (MSNightmare)
5. Benchmarking n-day exploit generation [via AI] (Josh Merrill)
6. Understanding modern Chinese cyber operations means shifting from ‘APT’ to composite responsibility (Virtual Routes Community)

ARTICLES COVERED:

1. Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Palo Alto Networks)
2. Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751) - Check Point Blog (Check Point Software Technologies Ltd.)
3. Old WinRAR Flaw Fuels Attacks on Ukraine: Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, (Trend Micro)
4. Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency (Proofpoint)
5. Incident de sécurité sur Tchap : la DINUM sécurise la plateforme et informe les usagers après une intrusion maîtrisée - Security incident on Tchap: DINUM secures the platform and informs users (Direction interministérielle du numérique (DINUM))
6. UK Cybercrime Journal: British Universities Struck by ShinyHunters Before Exam Season (BushidoToken)
7. QuasarNix: Reverse Shell Detection with Machine Learning (Dmitrijs Trizna)
8. Security Notice: Former Helm APT Mirror Domain `baltocdn.com` Statement | Helm (Cloud Native Computing Foundation)
9. Visual Studio Code 1.123: Delayed extension auto-updates (Microsoft)
10. Fighting Spyware: An Update From WhatsApp: Today, we’re asking the court to hold NSO in contempt for violating a permanent injunction that barred them from ever targeting WhatsApp and its users. (Meta)

ARTICLES COVERED:

1. Chinese-Cybercrime-Research: Resources to learn more about Chinese-language cybercrime actors. (aurora)
2. Query-Hub: CQL Hub is an open repository of detection and hunting queries for CrowdStrike NextGen SIEM and Falcon LogScale (ByteRay-Labs)
3. Building a safe, effective sandbox to enable Codex on Windows (OpenAI)
4. Z-Jail: A lightweight, multi-layer Linux sandbox combining namespaces, pivot_root, seccomp-bpf, capability dropping, and an evidence-based verdict engine) for secure, auditable code execution. (Division-36)
5. ot-sentinel-rules: Open-source ICS/OT detection rules (Wazuh + Sigma) for Modbus, DNP3, IEC 104, MQTT, and OPC-UA — tested against a real OpenPLC + GNS3 digital twin lab. (Subhash Bharadwaj)
6. On May 31, 2026, Meta discovered that there was a vulnerability in an AI-assisted account recovery system for Instagram ("High Touch Support" or "HTS") that was exploited by unauthorized third parties (Maine Office of the Attorney General)
7. Pwnd Blaster: Hacking your PC using your speaker without ever touching it | nns.ee (Rasmus Moorats)
8. About PCIe DMA Cheats: Protocol, IOMMU, Hardware, and Detection (kernullist)
9. BusyWork: Replacing Sleep with Real Work to Break Behavioral Detection (m4n0w4r)
10. UPnPHostFileRead: Arbitrary file read exploit for the Windows UPnP Device Host service. (SpacePlant)
11. EDRChoker: A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server. (Two Seven One Three)
12. cygor: An modular asset discovery framework written in python to automate the repeating manual work (tjnull)

ARTICLES COVERED:

1. CISA and Partners Urge Hardening Automatic Tank Gauge Systems (Cybersecurity and Infrastructure Security Agency)
2. Ongoing Targeted Campaign Against US Law Firms (Google)
3. New China-Linked Cluster OP-512 (ReliaQuest)
4. MUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chain (BlueCyber)
5. PoisonXドライバを用いた日本組織への攻撃キャンペーン - Attack campaign against Japanese organizations using PoisonX driver (株式会社ラック)
6. Investigation into APT 5 and their inner workings of PLA Troop 61786 (The author of the content on the Threat Review Journal blog is not explicitly named.)
7. From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services (Arctic Wolf)
8. Six Stages Deep and an Endless Loop: Shai-Hulud Is Getting Sophisticated - OX Security (OX Security)
9. Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp - StepSecurity (StepSecurity)
10. Inside an Active STX RAT Supply Chain Campaign - A threat actor spent one month building a trojanized software supply chain aimed at a specific type of victim (Cyderes)
11. Game Over: WeedHack – The Rise of Minecraft Malware-as-a-Service Campaigns (McAfee)
12. Unmasking Quellostanco: How a Git Commit Exposed a Threat Actor Targeting Egyptian Infrastructure (co-authored) (M4lcode)
13. The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy (Include Security)
14. Security advisory: Brute force attack on Dashlane user accounts (Dashlane)
15. Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis (Bishop Fox)
16. 21 Zero-Days in FFmpeg (Depthfirst)
17. Seven Years on a Public Clipboard: Pasted Secrets, Türkiye's Exposure, and a Stored XSS (beyondmemory.io)
18. The Privileged Roles Nobody Talks About (TrustedSec)
19. The Detection & Response Chronicles: Covert Operations Through QEMU (NVISO)
20. The Interesting Case of WSL for Payload Staging (Daniel Koifman)
21. Enter the WasmForge: Compiling Sliver into WebAssembly (Praetorian)
22. staged-DLL-Injection-SMB-: Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study (CRTO). (kasturixbm5)
23. Trend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window (Matheuz Security)
24. BOF Cocktails in Cobalt Strike (Rasta Mouse)
25. Magecart skimmer turns Stripe into a malware command server (Sansec)
26. Auditing GitLab: The CI/CD Kill Chain - GoGatoZ — a purpose-built Go tool for GitLab CI/CD security auditing that can perform and automate the entire CI/CD kill chain... (Black Hills Information Security, Inc.)
27. About ETW Internals: Architecture, Hooking, Tampering, and Detection (kernullist)
28. Async PICOs and Custom Beacon Wakeups in Cobalt Strike (NCC Group)
29. Address Translation (reisen_1943)
30. The Click that shouldn’t have worked: RCE via clickjacking in Internet Explorer (Positive Technologies)

ARTICLES COVERED:

1. The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds (OpenSourceMalware)
2. 1-Click GitHub Token Stealing via a VSCode Bug (Ammar Askar)
3. Enhance your Supply Chain Security with our Package Proxy Tool (Thinkst)

ARTICLES COVERED:

1. VerdantBamboo: Just Another BRICKSTORM in the Firewall (Volexity)
2. Software supply chain attacks: check your dependencies (National Cyber Security Centre)
3. IronWorm Supply Chain Malware Hits npm - OX Security (OX Security)
4. You do surprise me.exe: An unexpected executable in Hola Browser (Sophos X-Ops)
5. The Deny ACE That Never Fires: Non-Canonical ACL Order in Active Directory (Robin Granberg)
6. AzureRedOps: Azure RedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID (Mr.Un1k0d3r (TrueCyber Inc.))
7. zannotate: Utility for annotating Internet datasets with contextual metadata (e.g., origin AS, MaxMind GeoIP2, reverse DNS, and WHOIS) (ZMap)
8. MXC Internals: How Microsoft's eXecution Containers Actually Isolate Agent Code | Origin (Origin)
9. FSB’s matryoshka #3/3 - Gamaredon’s gifts that keeps unpacking - GammaSteel (Sekoia.io)
10. FSB’s matryoshka #2/3 - Gamaredon’s gifts that keeps unpacking - GammaLoad (Sekoia.io)

ARTICLES COVERED:

1. CVE-2026-45247 (CISA KEV)
2. Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem (Check Point Software Technologies)
3. Inside DesckVB Rat Analysis: From Malspam to In-Memory RAT | Huntress (Huntress)
4. Bring Your Own RWX Region DLL (BYORWXDLL) (S12 - 0x12Dark Development)
5. NuGet Code Execution As A Service (Tier Zero Security)
6. aether: Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET (0xsp)
7. The Server Seizure That Affects Also Iran's Cyber Operations (Check Point Research)
8. How China's Cyber Operations – and the Contractors Behind Them – Target Critics Abroad (Natto Team)
9. Espionage Campaign Targeted Stock Exchange Executive for Five Months (Broadcom)
10. TA4922: The Suspected Chinese Crime Group is Going Global | Proofpoint US (Proofpoint)
11. HazyBeacon and AWS Lambda Function URL Abuse (Qualys)
12. Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor (Palo Alto Networks)
13. Analysis of APT-C-26 (Lazarus) group's attack activities using CVE-2025-55182 and the Copperhedge component (上海市浦东新区人民法院)

ARTICLES COVERED:

1. Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026 (Exatrack)
2. Tracking North Korea Nation-State APT Infrastructure: Kimsuky (Idan Malihi)
3. From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services (Arctic Wolf)
4. Malicious Registrations in the Domain Name Market: An Analysis of gTLD Registrations and Cybercriminal Demand (Interisle Consulting Group, LLC)
5. Dependency Cooldowns - Dependency Cooldowns (People Can Fly)
6. Codex Discovered a Hidden HTTP/2 Bomb (Calif.io)
7. Click Or Trick (CVE-2025-59199): Escaping the Sandbox with Windows URIs (SafeBreach)
8. Unpatched NTLM Coercion in Windows search: URI Handler, Same Bug, No CVE, No Fix | Huntress (Huntress)
9. 새벽에 온 암호화 손님 Endpoint(Midnight) 랜섬웨어 분석 - Analysis of Endpoint (Midnight) Ransomware: The Encrypted Guest That Arrived at Dawn (AhnLab)

ARTICLES COVERED:

1. Miasma: Supply Chain Attack Targeting RedHat npm Packages (Wiz)
2. Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages (Socket)
3. Multiple redhat-cloud-services npm Packages compromised (StepSecurity)
4. RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation (blog.calif.io)
5. Cybersecurity (CYBER); Cyber Resilience Act (CRA); Cybersecurity requirements for routers, modems intended for the connection to the internet and switches (ETSI)
6. Gamaredon’s gifts that keeps unpacking - GammaPhish and GammaWorm (Sekoia.io)