BlueTeamSec

DDoSia is a DDoS attack toolkit used by the pro-Russia hacktivist group NoName057(16) against countries critical the invasion of Ukraine.

Our research team is committed to continuously identifying potential security vulnerabilities and techniques that threat actors may exploit to bypass existing security controls. In this blog post, our team is detailing on a comprehensive research specifically focused on process injection techniques ...

A brand-new Burp Suite extension for discovering DNS vulnerabilities in web applications.

EXECUTIVE SUMMARY The CYFIRMA research team has identified a new marketplace run by unknown threat actors, known as the Zero-Day...

DDoS can have global cloud scale impact in 2023..

Executive summary Introduction In early 2023, CPIRT investigated an incident at a European hospital. The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro Dragon’s self-propagating malware infections spreading via USB drive...

Backdoor leverages Microsoft Graph API for C&C communication.

In researching Operation Triangulation, we set ourselves the goal to retrieve as many parts of the exploitation chain as possible. As of now, we have finished analyzing the spyware implant and are ready to share the details.

In June 2023, Bitdefender Labs published a research paper about espionage operation in East Asia.

A new report details a campaign by the threat actor, BlueDelta, likely intended to enable intelligence-gathering to support Russia’s invasion of Ukraine.

The Conceptualization

Service members across the military have reported receiving smartwatches unsolicited in the mail. These smartwatches, when used, have auto-connected to Wi-Fi and began connecting to cell phones

Tools and documentation for Win32 app isolation. Contribute to microsoft/win32-app-isolation development by creating an account on GitHub.

Openfire是根据开放源 Apache 许可获得许可的实时协作（RTC）服务器。它使用唯一被广泛采用的用于即时消息的开放协议 XMPP（也称为 Jabber）。Openfire 的设置和管理非常简单，但是却提供了坚实的安全性和性能。

Photo by Matheus Queiroz on Unsplash In late 2022 we decided to start monitoring PyPI , arguably the most important Python repository, a...

This blog is about a new activity group that was observed targeting governments in the Middle East and Africa with some rare TTPs.

Learn about the Resident campaign and the threat actor's use of Rhamadanthys stealer in this malware analysis from Threat Response Unit (TRU).

This paper establishes an independent evidence base on the experience and perception of cybercrime and online harms in Georgia, with a focus on how and why certain groups are more vulnerable.

EXECUTIVE SUMMARY The team at CYFIRMA recently obtained suspicious Android apps hosted on the Google Play Store under the account...

China's government has rejected as “far-fetched and unprofessional” a report by a U.S. security firm that blamed Chinese-linked hackers for attacks on hundreds of public agencies, schools and other targets around the world.

tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet. Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the phone was infected with a virus but a 2 mi...

Using a variety of CTI enrichment techniques Sygnia was able to determine that the BEC attack was only a part of a much wider campaign, potentially impacting dozens of world-wide organizations.

What role can automation play in evidence collection in cyber incident response? We discuss possibilities in Azure and introduce ParrotForce.

Don’t let cyber threats get the best of you. Read the HP Wolf Security Threat Insights Report for Q4 2022 to learn more about cyber threats and cyber security.

Don’t let cyber threats get the best of you. Read our post, Shampoo: A New ChromeLoader Campaign, to learn more about cyber threats and cyber security.

Learn more about the DcRAT malware and get security recommendations from our Threat Response Unit (TRU) to protect your business from this cyber threat.

Урядова команда реагування на комп’ютерні надзвичайні події України, яка функціонує в складі Державної служби спеціального зв’язку та захисту інформації України.

ImposterKeanu // Introduction  This blog post introduces the reader to “The Obfuscation Hustle”, a term I enjoy using to describe the tedious process of obfuscating and delivering files to corporate […]

Guest Post: Understanding the attack surface of ASEAN economies to better support them.

Attackers heavily focused on acquiring military and security intelligence in order to support invading forces.

Without altering a single line of code, attackers poisoned the NPM package “bignum” by hijacking the S3 bucket serving binaries necessary for its function and replacing them with malicious ones

The Justice Department today announced charges against a Russian national for his involvement in deploying numerous LockBit ransomware and other cyberattacks against victim computer systems in the United States, Asia, Europe, and Africa.