40
https://www.reddit.com/r/blueteamsec/ Thanks to @reddit2telegram and @r_channels
Threat actors use agentic AI tooling to find and abuse exposed secrets
https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
https://redd.it/1xpopsf
@r_blueteamsec
SonicWall SonicOS Affected By Multiple Vulnerabilities - CVE-2026-77708, CVE-2026-77709, CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-19868
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
https://redd.it/1xpouoe
@r_blueteamsec
Siemens expands the device list for a 10.0-rated Node-RED flaw
Siemens expanded the affected-product list for CVE-2026-58115 on November 4, adding three SIMATIC IoT2050 products to its advisory.
The missing-authentication vulnerability affects specified devices running Industrial OS with Node-RED installed. It can allow an unauthenticated attacker to deploy malicious flows and execute code with max privs.
The fix dates back to August. Siemens lists V4.3.4-1 or later for the affected configurations. This expanded list just includes IoT2050 and can be patched with updated firmware.
VulnCheck also observed exploitation against its Node-RED canaries. Its research explicitly states that those observations were not exploitation of Siemens products. https://www.vulncheck.com/blog/exploitation-targeting-node-red
An example attack could encompass data theft, safeguard manipulation, or be use a chain to gain access to systems who have weaker safeguards internally.
https://redd.it/1xpkhnu
@r_blueteamsec
Removed by Reddit
Removed by Reddit on account of violating the [content policy. ]
https://redd.it/1xpbb4q
@r_blueteamsec
SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
https://redd.it/1xp6tgt
@r_blueteamsec
US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
https://www.ic3.gov/CSA/2026/261105.pdf
https://redd.it/1xp6l4n
@r_blueteamsec
Want to Rent an Internet Address at the White House?
https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/
https://redd.it/1xoue4c
@r_blueteamsec
New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org
https://www.security.com/threat-intelligence/lindnor-new-backdoor-anubis-ransomware
https://redd.it/1xovnce
@r_blueteamsec
An Ivanti Zero-Day Operation Where the Dead Proxy Was Named in the Operator's Notes
https://etugen.io/blog/ivanti-zero-day-operation/
https://redd.it/1xoudgd
@r_blueteamsec
Removed by Reddit
Removed by Reddit on account of violating the [content policy. ]
https://redd.it/1xot2us
@r_blueteamsec
How are you getting external attack surface findings into Jira or your SIEM?
hi, I have a question about attack surface findings and how they fit into the rest of the workflow. do you push every new exposed asset or open port straight into Jira or the SIEM, or review them first? A new service might need an owner even if there is no confirmed vulnerability, so I am not sure where you draw the line for a ticket.
If you review first, who does it and how often? We are comparing ionix and ccensys, and the integration part is what I am least sure about. Thanks.
https://redd.it/1xoc24r
@r_blueteamsec
Case Study: Profiling a Telegram Initial Access Broker Through Infrastructure and Stealer-Log Pivots
https://kylesinvestigation.com/2026/11/04/case-study-profiling-a-telegram-initial-access-broker-through-infrastructure-and-stealer-log-pivots/
https://redd.it/1xo2tdc
@r_blueteamsec
ARTEX fork learns to spot honeypots
https://huntback.io/blog/artex-fork-learns-to-spot-honeypots
https://redd.it/1xnzeda
@r_blueteamsec
of that change."
Question for you: would you actually onboard a new log source for AI interactions, or would you rather have this folded into an existing CASB/DLP feed?
# 3. Evidence preservation for AI Act Article 12 traceability
Article 12 of Regulation (EU) 2024/1689 requires high-risk AI systems to technically allow automatic recording of events over the lifetime of the system, with traceability appropriate to the intended purpose. The obligations for Annex III employment-related systems take full effect on 2 August 2026. The operational reading for a blue team is that you will soon be asked to produce and defend a traceability record, not just retain logs. A hash-chained, signed per-interaction record is closer to that requirement than a plain log line, because it is verifiable after the fact.
Question for you: if your organization deploys high-risk AI in employment or critical infrastructure, is Article 12 traceability on your roadmap yet, or is it still a legal team problem that has not reached detection engineering?
# What I am not claiming
Not tamper-proof. Tamper-evident.
Not producer attestation. The chain starts at the collector; a compromised client can emit fabricated events that the chain will faithfully record.
Not a completeness guarantee. Unenrolled devices, uncovered browsers, and user-initiated pauses are recorded as gaps, not eliminated.
Not a SIEM replacement. It is one more source, with a specific integrity property.
Not a compliance certification. It can help an operator produce Article 12-style traceability, but it is not a conformity assessment.
# The questions I actually need answered
1. Signal vs. noise: if this showed up as a new log source in your pipeline, what would make you keep it versus mute it after a week?
2. Chain design: for blue team purposes, is per-interaction hash chaining enough, or do you need periodic root digests anchored off-host (WORM bucket, RFC 3161 timestamp) before you would treat it as evidence?
3. Client trust: is there any realistic way to get from "tamper-evident record of what the collector received" to "trustworthy record of the interaction" without a TEE on the endpoint, or should I stop trying and scope the claim to server-side observation only?
4. DFIR workflow: would a per-interaction receipt be useful during an investigation, or does it add a verification step that analysts will skip under time pressure?
5. The "just use X" question: if you already hash-chain audit logs in your pipeline (the Cordum pattern, or an equivalent), what would justify a separate evidence layer for AI traffic instead of extending the existing chain to cover AI events?
# Links
Repository: `github.com/JuanLunaIA/aegis-latent-core`
Project page: [`aegislatent.com`](http://aegislatent.com) (README is the source of truth if the page is down)
License: LICENSE in the repo root (LicenseRef-Aegis-Commercial-1.0, source-available, not OSI open source)
If this is operationally useless to you, say why. That is more valuable to me than a polite "interesting project".
https://redd.it/1xnr0yl
@r_blueteamsec
Quick script to block exposed Danfoss/Dixell refrigeration controllers
Just put together a simple python tool (danfoss-shield) to scan local subnets, check if those auth-bypass endpoints are live, and drop inbound WAN traffic via nftables or iptables.
Added a few safety checks so it won't block your default gateway or let you type a dead WAN interface by accident. Supports dry-runs, backups, and rollbacks.
Zero extra dependencies, Python 3.9+.
How this came about: Built this after seeing the absolute mess across Europe with these systems and the complete lack of patches from vendors.
Repo: Since i cannot post links, look up drg-src/danfoss-shield on GitHub if you want to check out the code or test it out. I would love some feedback!
https://redd.it/1xnukzl
@r_blueteamsec
ARTEX: Agentic Asbestos
https://censys.com/blog/artex-agentic-asbestos/
https://redd.it/1xpop5k
@r_blueteamsec
Joint statement on cyber incidents in refrigeration systems across the EU | ENISA
https://www.enisa.europa.eu/news/joint-statement-on-cyber-incidents-in-refrigeration-systems-across-the-eu
https://redd.it/1xplwru
@r_blueteamsec
Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles
https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
https://redd.it/1xpk5b8
@r_blueteamsec
DarkSword router's iOS 26 route, C10, is switched off
https://ohey.ca/research/darksword-router-ios-26-c10/
https://redd.it/1xpa6ob
@r_blueteamsec
HostBadger -> Win hardening auditor / now with small GUI + enforcing profiles
Hello! Some new features on HostBadger, a free, open-source Windows hardening auditor, now with a (not so) fancy GUI & remediation profiles.
Nothing to install & in a few clicks, you'll see:
\-> 223 checks, each mapped to MITRE ATT&CK and explained:
\- Credentials (LSA, Credential Guard, WDigest, NTLM)
\- Defender, ASR and EDR
\- BitLocker and Secure Boot
\- Network (SMB, LDAP, LLMNR, firewall, TLS, cleartext DNS)
\- RDP and WinRM
\- Accounts, UAC and LAPS
\- Privilege escalation (writable services and tasks, unquoted paths, PATH)
\- Logging and audit
\- Patching and end of support
\-> Software: EOL, versions behind the latest release, CVEs by installed version with CVSS/KEV/EPSS, vulnerable and malicious drivers (LOLDrivers), malicious browser extensions, remote access tools.
\-> Threat hunting: WMI/IFEO/COM persistence, hidden services and tasks (Tarrask), RID hijack, replaced accessibility tools, BITS jobs, Office hooks, suppressed event logs, hosts file, rogue root CAs.
\-> Compliance:
\- DISA STIG (1,475 rules, 14 products)
\- CIS, quoting each host's own benchmark numbers (Windows 11, Windows 10, Server 2016/2019/2022)
\- Essential Eight
\- NIS2 ACN for Italy
\-> Report: HTML dashboard, A–F score, trend over time and comparison with the previous run.
\-> Fixes: a reversible script under each check, Essential/Recommended/Strict profiles plus debloat and telemetry.
\-> Optional AI summary and prioritization hints (Gemini). Names are tokenized, and a leak check runs before anything is sent.
https://github.com/g4bri-3l3/HostBadger/
https://redd.it/1xp6ol7
@r_blueteamsec
How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident
https://securelist.com/storm-2603-fileless-toolshell-attack/121467/
https://redd.it/1xp5g2p
@r_blueteamsec
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/
https://redd.it/1xovhio
@r_blueteamsec
DigiCert: Unauthorized access to business system
https://bugzilla.mozilla.org/show_bug.cgi?id=2084460
https://redd.it/1xovtsq
@r_blueteamsec
TraderTraitor vs Contagious Interview - A Look at Binance's Initial Incident Report
https://radar.securityalliance.org/tradertraitor-vs-contagious-interview-a-look-at-binances-initial-incident-report/
https://redd.it/1xouerc
@r_blueteamsec
CWPdoor: The Invisible Backdoor Living Inside Control Web Panel
https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/
https://redd.it/1xom7jc
@r_blueteamsec
adminide-stack npm compromise: an Ethereum dead drop that leads to a Node RAT persisting through npm and editor startup files
https://blog.greenflagged.dev/posts/2026-11-03-adminide-stack-eth-dead-drop/
https://redd.it/1xo7ve8
@r_blueteamsec
Looking for motivated builders to start an open-source Threat Intel & OSINT team (Not just another CTF group)
Hey everyone,
I’ve been practicing on HTB and TryHackMe for a while, but I realized that grinding points in isolated labs isn’t the same as solving real-world security problems.
I am starting a small, open-source collaborative group called **Loorte**. The goal is to bridge the gap between practicing security and actually engineering security tools.
**What we will do:** Instead of just participating in weekend CTFs (which we will still do for practice), the main focus of this group will be building our own tactical toolkit and conducting real-world analysis:
* **Building Tools:** Coding our own Python-based CLI OSINT scanners, network monitors, and a FastAPI backend telemetry system to process threat data.
* **Threat Hunting:** Taking user-submitted suspicious URLs, phishing links, and malware hashes, analyzing them in a sandbox, and publishing detailed write-ups on GitHub.
* **Responsible Action:** Compiling our findings to send formal takedown requests to hosting providers. Strict white-hat rules apply.
**Who I’m looking for:** You don't need to be an industry expert, but you need to be driven. I am looking for a few founding members to help get the infrastructure and first tools off the ground.
* **Python/FastAPI Devs:** If you want to practice your coding by building security tools.
* **OSINT/Analyst Enthusiasts:** If you love tracking digital footprints or want to learn how to tear apart suspicious files.
**How we operate:** We will use a Discord server for coordination and a GitHub Organization to host our tools and intel reports. We maintain a very clean, dark-mode/minimalist aesthetic for everything we build.
If you are tired of just hacking simulated boxes and want to start building real tools and analyzing real threats together, drop a comment below or send me a DM, and I’ll share the Discord link so we can start planning the first project.
Let's build something useful.
https://redd.it/1xnzcek
@r_blueteamsec
Stanford, NYU, UC Berkeley, and 17 other universities targeted in an academic fraud campaign run by AI agents over Telegram?
Our research team just published a writeup on an actor tracked as leepsmarts (Chinese-speaking) whose operation touched 20 universities, 19 of them in the US. The impact varies a lot by institution, so it’s worth breaking down rather than lumping everything together:
→ Harvard: 195 alumni records processed from a torrent-distributed dataset tied to the November 2025 ShinyHunters incident. This was not an intrusion by this actor.
→ Stanford (summer session), UChicago, Wake Forest, Case Western, and Central Michigan: application payment links generated
→ NYU, UC Berkeley, Oregon State, UIUC, Colorado State, CSU East Bay, CSU Chico, and Arizona State: accounts created under fraudulent identities
→ University of Utah, Arizona Christian University, and UTN Argentina: hardcoded targets in a staged CVE-2026-41940 cPanel exploit, with no confirmed compromise
What makes this one unusual is the tooling. The operator ran 2 AI agent frameworks, Hermes Agent and OpenClaw, controlled over Telegram. The agents automated account registration, watched for new AI model releases, and even built the actor’s management dashboard. The same pipeline harvested 2,233 LLM API keys from misconfigured cloud deployments.
All of it surfaced through a single open directory on the actor’s primary server.
https://redd.it/1xnpswp
@r_blueteamsec
Aegis Latent Core: a tamper-evident evidence chain for AI traffic. Does this help a blue team, or is it just another log source?
Disclosure: I am the author. Personal project. Source-available, not OSI open source. Not selling anything in this post. I am here because r/blueteamsec is where detection engineering and log integrity get taken seriously, and I want to know if what I built is operationally useful or just architecturally cute.
# The blue team problem I am trying to address
Your SIEM ingests logs from endpoints, identity providers, proxies, and SaaS. If an attacker with privileged access wants to erase a trace, the classic move is T1565.001 (Stored Data Manipulation) applied to the audit trail itself: mutate an event, delete one, reorder them, or roll back to an earlier state. You already know this. The standard mitigations are off-host collection, append-only storage, and hash-chaining with periodic root digests.
Aegis Latent Core is not a SIEM and not a log shipper. It is an evidence layer that sits in front of AI traffic (web UI via browser extension, API via proxy, local models via gateway) and produces a per-interaction hash-chained, signed receipt before the response is delivered. The question for this community is narrower than "is it secure": does a per-interaction evidence chain for AI traffic give a blue team a detection signal or an investigative artifact that it does not already get from its existing log pipeline?
# What the chain actually gives you (and what it does not)
The design is deliberately close to the audit-chain pattern you already know. Each event is canonicalized, hashed, linked to the previous event in the stream, and signed. The chain detects:
In-place mutation of an event after it was recorded (hash mismatch at the affected sequence).
Deletion of an event (gap at the missing sequence).
Reordering (out-of-order sequence).
Rollback to an earlier chain head (boundary shift).
This is the same integrity model as a per-tenant audit chain that forwards to a SIEM, and the same scope limitations apply: the chain starts at the collector. If an attacker controls the client before the event reaches the collector, the chain will faithfully record whatever the client emitted. It is not producer attestation. It does not prove the client was honest.
For a blue team, that means the chain is useful for post-collection integrity and investigative artifact preservation, not for pre-collection detection of a compromised endpoint. I want to be explicit about that distinction because it is the difference between "this helps your IR" and "this replaces your EDR".
# Where this might actually be operationally useful
I have three hypotheses. I would like you to tell me which one is wrong.
# 1. Detection of evidence tampering during an AI-related incident
If an incident involves an employee exfiltrating data through an AI tool, the first question in the post-incident review is often "what did they actually send, and can we prove it?" The chain gives you a signed, ordered record of what reached the collector, with a receipt that a third party can verify without trusting the gateway. That is a DFIR artifact, not a detection rule. But if the attacker's objective includes cleaning up the AI interaction history, the chain gives you a way to detect post-hoc modification of the collected record, which is one layer below the endpoint.
Question for you: in your experience, does a per-interaction receipt like this survive contact with legal or HR, or does it get dismissed because the client is untrusted?
# 2. A log source for "AI interaction anomalies" that your SIEM can correlate
The events are structured metadata by default (hashes, timestamps, surface, user/device identifiers), not message bodies. That makes them cheap to ship to a SIEM and correlate with DLP, CASB, or identity logs. The signal is not "the model said something bad"; the signal is "this user's AI interaction pattern changed, and the chain shows no tampering in the record
Hands-on resources for learning EDR alert triage? (for a fresher, not platform admin courses)
A junior analyst on my team asked me for a resource to help him get better at investigating EDR alerts. I want to point him to something that builds **investigative thinking**, not just tool familiarity.
**What I'm looking for:**
* Hands-on labs, challenges, or scenario-based exercises where you triage an endpoint alert from start to finish
* Content that teaches the *reasoning*: how to read a process tree, what makes parent-child relationships suspicious, how to pivot from one artifact to the next, how to scope impact, and how to decide between true positive, false positive and benign true positive
* Material that explains *why* an analyst looks at something, not just *where to click*
* Writeups, blogs, books or walkthroughs that show a real analyst's thought process on endpoint detections
**What I'm NOT looking for:**
* Vendor courses on navigating a specific EDR console
* Courses on deploying, configuring or tuning an EDR
* General "intro to cybersecurity" content
He already has the basics. The goal is for him to learn to look at an alert, form a hypothesis, collect evidence and reach a defensible conclusion, whatever EDR he ends up using.
Free resources are a big plus, but I'm open to paid ones if they're really worth it.
What helped you (or your juniors) make that jump from "I can see the alert" to "I know how to investigate it"?
https://redd.it/1xnt30e
@r_blueteamsec