Threat intelligence & response · Archive

Threat intelligence & response

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• 0.9.15 is out: capa scanning at native speed ↗ (opens in a new tab)

  MALCAT · Published 2026-07-16 · First collected 2026-10-24

• From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira ↗ (opens in a new tab)

  The DFIR Report · Published 2026-06-29 · First collected 2026-10-24

• Volume Grafting ↗ (opens in a new tab)

  Joe T. Sylve, Ph.D. · Published 2026-06-11 · First collected 2026-10-24

• System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models ↗ (opens in a new tab)

  clearbluejar · Published 2026-06-04 · First collected 2026-10-24

• Why Custom Attributes in .NET give me Nightmares ↗ (opens in a new tab)

  Washi · Published 2026-05-30 · First collected 2026-10-24

• Static Devirtualization of Themida ↗ (opens in a new tab)

  Blog Posts on Aftermath Labs · Published 2026-05-09 · First collected 2026-10-24

• Dissecting a mantis - the kamakiri exploit ↗ (opens in a new tab)

  R0rt1z2 · Published 2026-05-02 · First collected 2026-10-24

• A gentle introduction to binary analysis and Ghidra's SLEIGH ↗ (opens in a new tab)

  THALIUM · Published 2026-04-27 · First collected 2026-10-24

• Harnessing the Wayward Machine-God, 1: Manual Markdown Cleanup Is a Bug ↗ (opens in a new tab)

  Hackerman's Hacking Tutorials · Published 2026-04-21 · First collected 2026-10-24

• Windows Inter Process Communication A Deep Dive Beyond the Surface - Part 11 ↗ (opens in a new tab)

  Sud0Ru · Published 2026-03-30 · First collected 2026-10-24

• Checking the Vibes ↗ (opens in a new tab)

  Dino Hacks · Published 2026-01-26 · First collected 2026-10-24

• Flare-On 12 – Task 9 ↗ (opens in a new tab)

  hasherezade's 1001 nights · Published 2025-11-20 · First collected 2026-10-24

• Detego Global Strengthens Its Presence In Brazil With Detego Day São Paulo 2026 ↗ (opens in a new tab)

  Forensic Focus · Published 2026-10-22 · First collected 2026-10-24

• InfoSec News Nuggets – 10/21/2026 ↗ (opens in a new tab)

  AboutDFIR – The Definitive Compendium Project · Published 2026-10-21 · First collected 2026-10-24

• Why Does Binary Ninja Install Its Own Copy of WinDbg? ↗ (opens in a new tab)

  Binary Ninja · Published 2026-10-13 · First collected 2026-10-24

• Today I learned: Python's .start Files as a Persistence Mechanism ↗ (opens in a new tab)

  dfir.ch · Published 2026-10-04 · First collected 2026-10-24

• Update: search-for-compression.py Version 0.0.8 ↗ (opens in a new tab)

  Didier Stevens · Published 2026-09-30 · First collected 2026-10-24

• Delphos outscores commercial decompilers on DecBench ↗ (opens in a new tab)

  Delphos Labs · Published 2026-09-10 · First collected 2026-10-24

• When Linux and Your Decompiler Load Different Programs ↗ (opens in a new tab)

  zerotistic · Published 2026-07-11 · First collected 2026-10-24

• Encryption Rolling ↗ (opens in a new tab)

  Joe T. Sylve, Ph.D. · Published 2026-06-10 · First collected 2026-10-24

• Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware ↗ (opens in a new tab)

  The DFIR Report · Published 2026-05-11 · First collected 2026-10-24

• Manual Context is a Bug ↗ (opens in a new tab)

  Hackerman's Hacking Tutorials · Published 2026-03-31 · First collected 2026-10-24

• How to Reverse Engineer MediaTek Bootloaders ↗ (opens in a new tab)

  R0rt1z2 · Published 2026-03-30 · First collected 2026-10-24

• 0.9.13 is out: MacOS port, MCP server and dark mode ↗ (opens in a new tab)

  MALCAT · Published 2026-03-09 · First collected 2026-10-24

• Windows Inter Process Communication A Deep Dive Beyond the Surface - Part 10 ↗ (opens in a new tab)

  Sud0Ru · Published 2026-03-08 · First collected 2026-10-24

• Addressing Common Misconceptions about .NET in the InfoSec World ↗ (opens in a new tab)

  Washi · Published 2026-02-21 · First collected 2026-10-24

• Deobfuscation and Analysis of Ring-1.io ↗ (opens in a new tab)

  Blog Posts on Aftermath Labs · Published 2026-02-04 · First collected 2026-10-24

• Symless: an IDA assistant for structure reconstruction ↗ (opens in a new tab)

  THALIUM · Published 2026-01-13 · First collected 2026-10-24

• Feeling the Vibes ↗ (opens in a new tab)

  Dino Hacks · Published 2026-01-04 · First collected 2026-10-24

• How Semantics 21 Is Changing The Way Investigators Work With Digital Evidence ↗ (opens in a new tab)

  Forensic Focus · Published 2026-10-21 · First collected 2026-10-24