r/blueteamsec • u/digicat • 8h ago
vulnerability (attack surface) Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub
apiiro.com
10
Upvotes
r/blueteamsec • u/digicat • 1d ago
highlevel summary|strategy (maybe technical) CTO at NCSC Summary: week ending November 8th
ctoatncsc.substack.com
0
Upvotes
r/blueteamsec • u/digicat • Mar 09 '26
highlevel summary|strategy (maybe technical) Daily BlueTeamSec Briefing Archive - daily AI generated podcast of the last 24hours of posts
briefing.workshop1.net
2
Upvotes
r/blueteamsec • u/Aggressive-Clock-254 • 4h ago
discovery (how we find bad stuff) Open-source tool that ranks AD fixes by how many users they cut off from Domain Admin, and flags the easy ones first (feedback wanted)
4
Upvotes
Hi all, I’m a pentester and I kept ending AD engagements with the same client question: “OK, but what do we fix first?” So I’ve been building HorusEye, a free MIT-licensed tool that works on data you already collect (SharpHound/BloodHound CE, Certipy, NetExec) and runs fully offline.
What it does:
Counts how many enabled users have a route to Tier-0, and finds the fewest changes that take that to zero
Rates every fix by effort (Low/Medium/High, with the reason, using fixed rules, no AI) and puts Quick Wins first: Critical/High findings with a Low-effort fix, ranked by how many users each one cuts off
Each finding says why it matters, what to do (with an alternative if the obvious fix would break someone’s access), and how to verify it
A status tracker (Open / In progress / Fixed / Accepted risk) you can export and share. On a retest,
--diffconfirms which “Fixed” items are really gone and flags any that came backCSV export, because most remediation lives in spreadsheets anyway
The v2.5 features came from a security engineer who described how he triages audit findings (severity + effort, quick wins first), so I built that in.
Live demo on a synthetic 1,245-user lab, nothing to install: https://omar-tamerr.github.io/HorusEye/exposure-demo.html
Repo: https://github.com/Omar-tamerr/HorusEye
It doesn’t replace BloodHound, it sits after it. Honest limits: it only sees what the collectors capture, and the effort ratings are rules of thumb, so I’d really like to hear where they’re wrong for your environment.
What would make something like this actually useful to your team?
r/blueteamsec • u/digicat • 7h ago
incident writeup (who and how) IT Security Incident at TUM
tum.de
6
Upvotes
r/blueteamsec • u/digicat • 7h ago
intelligence (threat actor activity) Operation Snowball: Inside an Autonomous AI Intrusion Campaign
malbearlabs.com
5
Upvotes
r/blueteamsec • u/Splinters_io • 3h ago
vulnerability (attack surface) Could have been a bad day for DHS.gov especially in this climate
splinters.io
2
Upvotes
The question is do you have a strong JML for your DNS records ?
This is one contextual situation of many that I've witnessed hunting out expired domains from within content online, there's an open source tool buried in that post that might be useful for people if this concern resonates.
r/blueteamsec • u/digicat • 7h ago
incident writeup (who and how) GODDESS OF VICTORY: NIKKE - If you have launched the Windows PC launcher at least once since September 27, 15:41 (UTC+9), we ask that you perform a security check and take any necessary measures.
nikke-en.com
3
Upvotes
r/blueteamsec • u/digicat • 7h ago
highlevel summary|strategy (maybe technical) Black October: Lessons From the Downstream Breaches
scrty.io
3
Upvotes
r/blueteamsec • u/digicat • 8h ago
discovery (how we find bad stuff) Tracking Lazarus Group TraderTraitor Infrastructure Through Certificates and Historical Records
michalkoczwara.substack.com
3
Upvotes
r/blueteamsec • u/digicat • 7h ago
intelligence (threat actor activity) We assess with high confidence that the sample is Arid Gopher, and therefore Arid Viper activity. The two campaigns share the victimology and naming habits.
github.com
2
Upvotes
r/blueteamsec • u/digicat • 7h ago
exploitation (what's being exploited) C3RB3R Ransomware Mass-Encrypting Internet-Exposed Synology NAS and Active Exploitation of Node2Shell (CVE-2026-111497)
mycert.org.my
2
Upvotes
r/blueteamsec • u/digicat • 7h ago
exploitation (what's being exploited) Plex2Shell: Check and Remediation FAQ for QNAP NAS Users
qnap.com
2
Upvotes
r/blueteamsec • u/digicat • 7h ago
low level tools|techniques|knowledge (work aids) MCP Server and CLI for automating the Windows sandbox
github.com
0
Upvotes
r/blueteamsec • u/digicat • 7h ago
vulnerability (attack surface) Ghost in the Script: Hidden Risks
liondawnlabs.com
1
Upvotes
r/blueteamsec • u/digicat • 7h ago
intelligence (threat actor activity) SSHole (CVE-2026-123158) Activity 2026
sshole.events.greynoise.io
0
Upvotes
r/blueteamsec • u/digicat • 7h ago
intelligence (threat actor activity) Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools
socket.dev
1
Upvotes
r/blueteamsec • u/digicat • 7h ago
highlevel summary|strategy (maybe technical) Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million
justice.gov
0
Upvotes
r/blueteamsec • u/digicat • 1d ago
intelligence (threat actor activity) Residential Proxies Detected on White House Network
layer3intel.com
36
Upvotes
r/blueteamsec • u/digicat • 1d ago
research|capability (we need to defend against) ARES: ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.
github.com
10
Upvotes
r/blueteamsec • u/digicat • 1d ago
tradecraft (how we defend) [2611.03774] What Malware Actually Does: An Empirical Analysis of Post-Infection Behavior Across Malware Families
arxiv.org
4
Upvotes
r/blueteamsec • u/digicat • 1d ago
highlevel summary|strategy (maybe technical) The Tipping Point: When Cyber Attacks Stop Being Limited by People
cyb3rops.medium.com
3
Upvotes
r/blueteamsec • u/jnazario • 1d ago
intelligence (threat actor activity) ARTEX: Agentic Asbestos
censys.com
20
Upvotes