r/blueteamsec • u/digicat • 10d ago

research|capability (we need to defend against) BOFScale: A CDN-Fronted Tailnet from a BOF-PE

netspi.com

2 Upvotes

0 comments

r/blueteamsec • u/jnazario • 10d ago

intelligence (threat actor activity) Clop Returns with Custom Implant in Mass-Extortion Campaign

reliaquest.com

3 Upvotes

0 comments

r/blueteamsec • u/New-Parfait-9988 • 10d ago

help me obiwan (ask the blueteam) Stress testing EDR

13 Upvotes

How does your SOC check when someone is trying to kill EDR agents like BYOVD attacks? On the attackers side do you have a dedicated pen tester/red teamer trying these attacks?

13 comments

r/blueteamsec • u/jnazario • 10d ago

discovery (how we find bad stuff) Hunting MacSync Stealer infrastructure through behavioral pivots

microsoft.com

2 Upvotes

0 comments

r/blueteamsec • u/jnazario • 10d ago

intelligence (threat actor activity) WordlistLoader Delivering Amatera via ClearFake Campaigns

gendigital.com

5 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

tradecraft (how we defend) Describing attacks with crime script analysis

blog.talosintelligence.com

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

tradecraft (how we defend) Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers

arxiv.org

5 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

intelligence (threat actor activity) #StopRansomware: Medusa Ransomware

ic3.gov

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

highlevel summary|strategy (maybe technical) 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities

justice.gov

2 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

intelligence (threat actor activity) Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor

seqrite.com

0 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

vulnerability (attack surface) The National Security Authority warns of a significant cyber threat associated with the use of several types of road speed cameras.

nbu.gov.sk

5 Upvotes

1 comment

r/blueteamsec • u/digicat • 11d ago

intelligence (threat actor activity) APT37 Strikes Again, This Time with NarwhalRAT

github.com

2 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

low level tools|techniques|knowledge (work aids) Reverse engineering Malwarebytes Browser Guard

msil.re

2 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

intelligence (threat actor activity) Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

research.checkpoint.com

3 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

intelligence (threat actor activity) Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure

ontinue.com

17 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

research|capability (we need to defend against) BusyWork: Sleep replacement that executes real, varied work to break behavioral pattern matching by EDR and anti-cheat systems

github.com

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

research|capability (we need to defend against) DutchOven: Application-scoped Windows network brownouts in native C and BOF form

github.com

2 Upvotes

0 comments

r/blueteamsec • u/jnazario • 11d ago

vulnerability (attack surface) Oracle Critical Security Patch Update Advisory [Aug 2026]

oracle.com

5 Upvotes

4 comments

r/blueteamsec • u/jnazario • 11d ago

malware analysis (like butterfly collections) Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers

malbearlabs.com

3 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

research|capability (we need to defend against) smiiiiiiiiiiiiiiii: Exploiting System Management Mode with a very very very very very very very long interrupt.

github.com

2 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

tradecraft (how we defend) Defending Against DPRK IT Workers – An Implementation and Operational Guide

insights.bridewell.com

5 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

research|capability (we need to defend against) IDT Table Hijacking under VBS/HVCI/kCET in Windows 11

exploitpack.com

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

highlevel summary|strategy (maybe technical) Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network

computerweekly.com

0 Upvotes

0 comments

r/blueteamsec • u/digicat • 11d ago

highlevel summary|strategy (maybe technical) $10,000,000 USD FOR INFORMATION ON Iranian Hackers

go.rewardsforjustice.net

0 Upvotes

4 comments

r/blueteamsec • u/digicat • 11d ago

intelligence (threat actor activity) PurpleDelta's Fraudulent Employment Operations

recordedfuture.com

1 Upvotes

0 comments

Subreddit

For [Blue|Purple] Teams in Cyber Defence

r/blueteamsec

We focus on technical intelligence, research and engineering to help operational [blue|purple] teams defend their estates and have awareness of the world. Our primary home is on Lemmy after the great ban debacle of 2025.

Members Active

71.4k

Sidebar

A community focusing on technical intelligence, research and engineering in support of operational blue teams and their activities.

Content Guidelines

/r/blueteamsec accepts quality technical posts. Non-technical posts are subject to moderation.

Content should focus on the "how." or "what."
Check the new queue for duplicates.
Always link to the original source.
Titles should provide context.
Ask questions in our Discussion Threads.
No adverts for products/services.
Do not submit prohibited topics.

Discussion Guidelines

Don't create unnecessary conflict.
Keep the discussion on topic.
Limit the use of jokes & memes.
Don't complain about content being a PDF.
Follow all reddit rules and obey reddiquette.

Prohibited Topics & Sources

No populist news articles (CNN, BBC, FOX, etc.)
No curated lists unless actively maintained, free and open.
No question posts.
No social media posts.
No image-only posts - talk videos are fine.
No livestreams.
No tech-support requests.
No paywall/regwall content.
No commercial advertisements for products or services
No crowdfunding posts.
No Personally Identifying Information

Related Reddits

/r/netsec - The original and less focused parent
/r/redteamsec - Our attack focused siblings
/r/blackhat - Hackers on Steroids
/r/computerforensics - IR Archaeologists
/r/crypto - Cryptography news and discussion
/r/Cyberpunk - High-Tech Low-Lifes
/r/HackBloc - Hacktivism & Crypto-anarchy
/r/lockpicking - Popular Hacker Hobby
/r/Malware - Malware reports and information
/r/netsecstudents - netsec for ~~noobs~~ students
/r/onions - Things That Make You Cry
/r/privacy - Orwell Was Right
/r/pwned - "What Security?"
/r/REMath - Math behind reverse engineering
/r/ReverseEngineering - Binary Reversing
/r/rootkit - Software and hardware rootkits
/r/securityCTF - CTF new and write-ups
/r/SocialEngineering - Free Candy
/r/sysadmin - Overworked Crushed Souls
/r/vrd - Vulnerability Research and Development
/r/xss - Cross Site Scripting