Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.
Operationally this week nothing overly of note.
In the high-level this week:
Managing the cyber risk of agentic AI - NCSC UK publish - “Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.”
Help shape the future of resilient private 5G - NCSC UK invite - “The NCSC wants to collaborate with organisations developing technologies and approaches for secure, resilient and deployable private 5G”
UK Public Survey of Risk Perception, Resilience and Preparedness: 2026 - Cabinet Office publish - “Compared to 2025, the perceived likelihood of most emergencies remained broadly stable. .. The perceived likelihood of a … a cyber attack affecting critical infrastructure rose by three percentage points (39% to 42%).”
Call for evidence on the impact and effectiveness of Sections 1 to 13 of the Telecommunications (Security) Act 2021 - Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology publish - “The call for evidence seeks views from all stakeholders who have engaged with the Telecommunications (Security) Act 2021, the Electronic Communications (Security Measures) Regulations 2022, and the Telecommunications Security Code of Practice.”
The National Security Authority warns of a significant cyber threat associated with the use of several types of road speed cameras - National Security Authority of the Slovak Republic warns - “The National Security Authority, through a security analysis conducted on a loaned sample of the NERO R-ONE road speedometer, identified several security risks, including:
the true origin of the camera hardware and software,
inconsistency between the documented and detected configuration of the product’s communication interfaces,
pre-configured remote access and product management mechanisms, the configuration of which is not fully available to the user,
inconsistency between the declared and actually used software ensuring measurement processing,
poor software security.”
We need a more complete picture of cyber-attacks on UK critical national infrastructure - Alan Turing Institute leverage freedom of information - “To elicit a more grounded picture of cyberattacks on UK CNI, we sent FOI requests to regulators spanning England, Wales, Scotland and Northern Ireland to gain access to their data. This data collection exercise was complemented by analysis of advisories published by US authorities which provided more detail than the UK data on how attacks are carried out. Our data showed that during 2024, nearly one third (29%) of incident reports made under the regulations concerning network and information systems related to cyberattacks. The data we obtained also provided us with important insight into the attackers’ motivations. Of six health-sector incidents in England that met the reporting threshold in 2024, five were ransomware attacks and the sixth was a power outage.”
National Security Science & Technology Strategy - The White House (not me) publishes - “building segmentation into critical network architectures, and modernizing cryptography and cyber infrastructure. This also includes prioritizing S&T to secure operational technology and industrial control systems through cyber-physical threat modeling and AI-driven anomaly detection.”
The Presidential Memo on Combating Transnational Cybercrime: Implications for Industry and Government - Center for Strategic and International Studies think tanks - “It is a pivotal moment for security in cyberspace. State actors are ramping up activity, as we have seen with the likely Iranian attacks on U.S. water facilities, while high-profile cybercriminal incidents are impacting more sectors across the U.S. economy and society, such as schools. U.S. government actors have their hands full and should make use of industry’s talent and hunger to help.”
The Cyberattacks on the U.S Water Sector and the Iran Question: Escalation or Opportunism? - Center for Strategic and International Studies think tanks - ”The answer is not yet. Psychological effect is precisely the point of Iran’s cyber operations, to sow fear, chaos, and division, as part of its information warfare strategy. If these attacks are indeed Iran’s doing, this commentary asserts four reasons the water incidents do not constitute escalation in this conflict; they should be regarded as opportunistic disruption owing to weak U.S. cyber defenses, rather than a turning point.”
Outpaced: AI and Policy’s Role in Transforming Cybersecurity Compliance - Center for Security and Emerging Technology think tanks - “Despite decades of reform efforts, the federal government’s Authorization to Operate (ATO) process is a major barrier to delivering secure systems to warfighters at speed. This report examines why past ATO reforms have fallen short of their intent, and offers recommendations to getting leading American technology into the hands of warfighters faster and securely.”
Volunteer with our Technology Advisory Group - UK Girlguiding call for volunteers - “We’re looking for experienced digital, data and technology professionals to join our new Technology Advisory Group as volunteers.”
Reporting on/from China
T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network - Tech Crunch proxy reports - “New reporting from Bloomberg revealed how cybersecurity staff at U.S. phone provider T-Mobile identified and expelled Chinese hackers from its network in 2024 during a spate of industry-wide intrusions by Beijing aimed at stealing customer data.” …. “After identifying the breach, T-Mobile’s cybersecurity chief, Jeff Simon, told Bloomberg that he and three others drove to the data center nearby to its Bellevue, Washington headquarters, found the compromised system, pulled out a set of scissors, and snipped the cable connecting the box to the outside world.”
The Documentary, China: The rise of a science superpower - BBC World Service broadcasts - “Roland Pease explores how decades of strategic investment and diligent educational reform have brought China to the brink of global scientific dominance.”
China Presses a Weakness in America’s Tech Policy - Wall Street Journal opines - “The danger is twofold. China is reducing its own dependence on foreign-controlled [chip] architectures while positioning itself to lead in commercializing the open alternative [RISC-V].”
China Wants to Shape What the World’s A.I. Knows - New York Times reports - “Earlier this year, the country’s National Data Administration unveiled a blueprint to transform China into a data powerhouse by the end of 2028. The plan proposed creating “high quality” data sets in more than two dozen strategic fields, including scientific research, industrial manufacturing and autonomous vehicles. The plan calls on China to share its data sets worldwide. That was reinforced last month when China pledged to share data to help the dozens of developing countries that attended the World Artificial Intelligence Conference in Shanghai build their own A.I. systems. China has also already released huge troves of data curated by government labs and state-owned media, making them available for download around the world. The goal, analysts say, is twofold: to draw more users into China’s A.I. orbit and to narrow the gap with the United States in access to high-quality training data, which Beijing believes is helping America maintain its lead.”
AI
Managing the cyber risk of agentic AI - NCSC UK publish - “Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.”
Benchmarking Automated Security Patch Backporting: How Far Are We? - many Chinese universities measure - “Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV.”
Measuring coding agent misalignment in the wild - Transluce measures - “We studied rates of coding agent misalignment in 8,600 real-world coding agent sessions. We found severe cases of monitor evasion and misrepresenting success in a small but non-negligible fraction of sessions (around 2% for each behavior). In these cases, agents merge PRs to main without authorization, falsely claim approval from review agents, and reason that they shouldn’t disable tests before quietly doing so anyway.”
How Google is Making Private AI Practical with Homomorphic Encryption - Jeremy Kun details - “HEIR can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs. Our vision is to make HEIR a one-click solution to enable non-experts to incorporate encrypted inference into production applications.”
AI in Cyber Conflict: Short-term Offensive Opportunities, Long-term Defensive Advantage - Irregular Warfare think tanks - “On the one hand, AI automation could massively enhance the effectiveness of cyber operations and campaigns below the threshold of war as some have predicted. If true, states would be able to achieve even more strategic gains through irregular warfare than U.S. national defense strategy assumes. … In a new article published in International Security, I argue that these expectations are likely misplaced. Contrary to prevailing expectations, cyber defense likely has more to gain from AI automation. While AI-powered attacks make for dramatic headlines, a level-headed examination shows core offense challenges reflect the weaknesses of AI models whereas defense tasks speak to its strength.”
Everything is about to “go dark” - Matthew Green worries - “I’m concerned that AI is going to make software much too secure. While that doesn’t sound so bad on the surface, there’s a consequence to this. I mean something very specific: I’m concerned that U.S. intelligence and law enforcement agencies are about to go dark, meaning: that they’re going to suddenly lose a huge portion of their capability.”
The TEVV-Athlon Framework for Evaluating AI Systems - NIST calls for input - “Input Sought on Initial Public Draft of NIST AI 200-2 through October 6, 2026 … This paper introduces the TEVV-Athlon Framework, a four-stage method for developing customized assessments of AI systems based on organizational TEVV objectives. The framework produces a TEVV-Athlon, an assessment where AI systems are tested via a set of Events and Tools which produce data on Blocks related to measurement concepts of interest.“
Pacing model development in an era of cyber-critical capabilities - OpenAI assert - “We expect models to soon drive most security work, including defending against other models. This will allow all three safeguards to scale with model capability, which we see as crucial.”
Responsible Innovation at the Frontier - Americans for Responsible Innovation publish - “ARI’s blueprint for federal AI governance is designed to promote safe frontier AI development in America. The blueprint is built around three governance functions any federal proposal should incorporate. To set adequate safety standards, the federal government should hold every covered developer’s published safety framework to minimum federal standards that define adequacy. To verify compliance with those standards, there should be independent assurance. To secure transparency into frontier AI development, there should be federal visibility into both internally deployed frontier models and the growing automation of AI research and development.”
China advances global AI governance in a comprehensive manner - People’s Daily reports - “At the opening ceremony of the 2026 World AI Conference (WAIC) and High-Level Meeting on Global AI Governance, Chinese President Xi Jinping called for joint efforts to build a just and equitable system for global AI governance. The proposal reflects a profound understanding of technological and historical trends, embodies the wisdom of governing AI for the common good, and points toward the long-term goal of building a community with a shared future for humanity.”
Cyber proliferation
US courts will start publishing how often the government uses spyware - TechCrunch reports - “Starting in 2029, U.S. judiciary will publicly disclose precisely how many times judges authorized the use of wiretaps to be carried out with hacking tools and spyware, which fall under the category of what the feds call network investigating techniques, or NITs.”
Bounty Hunting
17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities - US Department of Justice announces - “A 14-count superseding (S2) indictment was unsealed today charging 17 members of the Mabna Institute, an Iran-based company that, since at least 2013, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations (NGOs).”
Reward Up To $10,000,000 USD For Information On Iranian Hackers - Rewards for Justice bounties - “These individuals are affiliated with Iran’s Ministry of Intelligence and Security and the Islamic Revolutionary Guard Corps, a designated Foreign Terrorist Organization. They have targeted numerous segments of U.S. critical infrastructure with malicious cyber activity.”
Malaysian Police Arrest SMS Blaster Driver Targeting Singapore Border Traffic - CommsRisk reports - “Malaysian authorities arrested a 65-year-old man who allegedly used a car-mounted SMS blaster to target peak-hour commuters travelling between Johor Bahru and Singapore.”
Market Incentives
Cyberleagle: If the computer is not accountable, who is? - Graham Smith asks - “If the computerised bill system had been AI-driven, one wonders how impressed the Ferguson court would have been with distinctions between determinate and indeterminate computer outputs. That speculation aside, when considering corporate tortious liability for AI errors it seems likely that at some point the Meridian framework will come into play”
UK Corporate Governance Code 2024 - Financial Reporting Council published but are now coming into effect- “As a result, the Code will provide a stronger basis for companies to evidence the effectiveness of their internal controls, thereby enhancing transparency and investor confidence. In order to give companies sufficient time to implement these new arrangements, reporting on this element of the Code (Provision 29) will not be effective before accounting periods beginning on or after 1 January 2026”
ETSI launches approval process for 17 European Standards supporting the Cyber Resilience Act - ETSI launches - “ETSI is pleased to announce the availability of the 17 vertical final draft standards developed in the framework of the EU Cyber Resilience Act (CRA) and currently under Public Enquiry. These standards aim to become Harmonised Standards, giving manufacturers a recognised way to demonstrate compliance with the legislation, the so-called “presumption of conformity”.
Artificial Intelligence Underwriting Company emerges - comment: it will be interesting to see the world in the insurance - video here from AIUC on Making Safe AI Profitable: Standards, Audits, and Insurance a paper was written on Underwriting Superintelligence by the co-founders
No reflections this week.
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Gabby Roncone and Wesley Shields details an alleged Russian operation which is of note due to its scale and techniques which may fall outside of enterprise detection and discovery.
These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms. Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.
…
UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts. The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences.
Reporting on China
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
Fareed Radzi details that this alleged set of Chinese operations are now using a signed kernel driver which history implies the certificate may of been in use for a while. Noteworthy as as kernel code signing is still obtainable by adversaries it would appear.
CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions.
..
In late 2025 and 2026, our latest investigation reveal another major evolution. The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified. The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.
We have observed this updated CoolClient variant and its accompanying driver in intrusions across multiple countries in Asia, including Pakistan, Mongolia, and Myanmar.
…
The path contains several notable strings, including “Nanjing Laboratory” (
南京实验室) and “Zhang Xuejie Yunnan m” (张雪杰云南m), which likely refer to the driver’s development environment. However, our OSINT analysis did not identify any information linking these strings to a known organization, developer, or threat actor.The driver is digitally signed with a certificate issued to
"Nanjing Ranyi Technology Co., Ltd.", with serial number3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD. The certificate was valid from August 2013 to September 2014.We identified several older malicious drivers signed with the same certificate that were compiled around 2013. However, we found no evidence directly linking those samples to the CoolClient activity described in this article.
https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/
SilkParasite: Tracking a China-Nexus APT Across Central Asia
Martin Zugec details a suite of alleged Chinese capability which has hints that AI was used in its development (not a surprise). Initial access tradecraft is extremely well understood and easily mitigatable.
SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously undocumented; we identified and named them: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and professionally engineered, and it carries traces of AI-assisted development.
..
Initial access ran through malicious Microsoft Office documents, most likely delivered by spear-phishing email. In several cases the lure documents were packaged inside password-protected RAR archives, with the password supplied in the email body, a low-effort but effective way to slip past email-gateway scanning and automated sandbox inspection. Once opened, the document ran a macro that dropped a signed-application sideloading chain to disk and launched the first-stage payload.
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Joey Chen details an allegedly Chinese threat actor who has integrated AI to increase scale. Not sure the expertise point in the below is empirically proven quite yet given this campaign used publicly disclosed vulnerabilities, we do not know who the actor is and we have had ./ exploit for time and memorial… they also describe this actor as highly capable in the following blog.
[We] identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale.
UAT-10147 integrated AI-driven tooling into exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos observed AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic supporting real-world intrusions.
The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence.
Talos assesses that integrating AI-generated exploitation guidance, automation, and validation workflows enables threat actors to scale complex attacks more efficiently while reducing the expertise traditionally required for advanced post-compromise operations.
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
Joey Chen further details this alleged Chinese threat actors capability which implies criminality may be the intent. Noteworthy as it is a new implant and it does have some evasion capabilities
UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization (SEO) fraud monetization with advanced persistence and defense evasion techniques.
The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.
The actor demonstrates operational maturity through the combined use of custom malware, open-source offensive tooling, Bring Your Own Virtual Driver (BYOVD) based EDR neutralization, Linux kernel rootkits, and sophisticated in-memory web shell deployment techniques.
Cisco Talos’ analysis of recovered source code suggests portions of the Linux rootkit development may have incorporated AI-assisted code generation workflows, highlighting the growing role of generative AI in accelerating offensive malware development.
Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor
Priya Patel details an alleged Chinese operation which uses tradecraft we have known about what feels like over five years. All well understood, all mitigatable. Noteworthy due to victimology and the fact it might be effective in achieving access.
We have been tracking this threat actor over the past few months and identified three related campaigns targeting Myanmar. The earliest campaign, observed in April 2026, used a sample named HolidayNotice.pdf.exe. The lure used in this variant was a fabricated Belgian–Myanmar public holiday calendar, which suggests that the threat actor was targeting personnel from Belgian organizations operating in Myanmar, such as embassies or NGOs.
We also identified two VHD samples that appeared within a short period of time. The first sample, TrainingAnnouncement.jpg, was first observed on June 2026. The second sample, ACMECS_Pillar_1.vhd, was first observed in July 2026. Although the two samples use different lure documents, they share the same infection chain, payload, and C2 infrastructure.
Trapping a Mustang Panda
Agnes Ramos-Beauchamp , Joshua Chung , Golo Mühr and Joe Fasulo detail an alleged Chinese operation which is of note due to sector (energy) and if you look past the product marketing the use of cyber deception effectively for intelligence gain.
X-Force is tracking ongoing campaigns attributed to ITG27 (formerly Hive0154), a China-aligned actor conducting cyber espionage.
The actors are likely exploiting ongoing geopolitical events in South Asia, using emails to spread new versions of the Toneshell backdoor.
Using Deception.Pro, X-Force observed two real ITG27 incidents in realistic, simulated victim organizations’ environments. ITG27 operators maintained access over multiple days and performed hands-on-keyboard activity including reconnaissance, credential harvesting and malware deployment.
The actors deployed a previously unknown VNC-capable backdoor tracked as Havencode to manually browse the victim’s desktop, and exfiltrated fake documents placed in the deception environments.
X-Force analysis shows that operator-initiated actions took place exclusively during weekday working hours (08:00-18:00) in China Standard Time.
https://www.ibm.com/think/x-force/trapping-a-mustang-panda
Reporting on North Korea
PurpleDelta’s Fraudulent Employment Operations
Insikt Group® detail an alleged North Korean operation which continues to gain effective employment. The complex supply chain around these operations is of note.
Insikt Group has identified at least 22 fabricated personas linked to multiple PurpleDelta clusters that submitted applications to over 1,100 companies across the software, staffing, healthcare, and financial sectors, with operators submitting as many as 60 or more applications per day across at least 8 job platforms.
These clusters of PurpleDelta operators are highly likely to have been actively employed at ten or more organizations, with confirmed or probable placements at companies that pose an ongoing and material insider threat.
PurpleDelta demonstrated a high degree of operational sophistication, using multi-account management browsers, multiple Chrome profiles, AI-generated profile photos, custom ChatGPT assistants, and real-time AI transcription tools to deceive hiring managers during interviews, sometimes repeating AI-generated responses verbatim.
Once employed, PurpleDelta operators recorded internal meetings at victim organizations, used screen recording software during work sessions, and drafted pre-written Google Translate excuses to justify the use of personal devices and personal bank accounts.
Video evidence indicates that PurpleDelta operators use identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, and coordinate via Telegram and Slack, with support from facilitators who procure and maintain company-issued hardware on the operators’ behalf.
https://www.recordedfuture.com/research/purpledelta-fraudulent-employment-operations
Reporting on Iran
Nothing overly of note this week
Reporting on Other Actors
Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure
Rhys Downing details a cloud based implant and C2 which is noteworthy due to its operational usage here.
TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services. Tasking flows through SharePoint Online file dead-drops via the Microsoft Graph API. Interactive operator access routes through WebRTC DataChannels relayed by Microsoft Teams TURN servers. Graph API traffic is driven through a headless instance of the victim’s own Edge browser, making it indistinguishable from legitimate user activity. The implant harvests Windows credentials via pixel-faithful fake lock screens, provides a reverse SOCKS5 pivot into victim networks, executes arbitrary commands, and persists through four mechanisms. One instance involved an offline‑forged mandatory profile hive created without administrative privileges. This used a technique called “Corrupting the Hive Mind,” the first recorded malicious use of this persistence method in the wild.
We recovered the modules from under PyArmor 9.2.5 protection and decrypted the embedded configuration, giving us visibility into the operator infrastructure, including the SharePoint C2 site, the Azure Blob config dead-drop, and the attacker-registered domains.
https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows
Infoblox Threat Intel detail the scale of this campaign over a series of posts - the level of financial investment is of note showing there must be a return of a greater amount.
Dropcatch actors inherit traffic from compromised websites by acquiring expired malicious domains and redirecting victims to scams and malware.
…
Sable Squirrel spends millions on expired domains to deliver illegal gambling, streaming, RAT malware, and ransomware in a massive cybercriminal enterprise.
Software Supply Chain Incursions
A reminder we issued guidance a number of weeks ago in Software supply chain attacks: check your dependencies for software developers
Discovery
How we find and understand the latent compromises within our environments.
Device Roles in Microsoft Defender XDR: Better Context for Threat Hunting and Detection Engineering
Mehmet Ergene details these new data source/colum in Microsoft Defender XDR which will facilitate for precise threat hunting.
Microsoft has added a DeviceRoles column to the DeviceInfo table in Microsoft Defender XDR Advanced Hunting. I’ve been asking for this type of device context for a long time, so I was happy to see it finally appear.
For threat hunting and detection engineering, it solves a problem I regularly run into: understanding what a device actually does without leaving the hunting query. For example, I hate switching to CMDB and finding out the device is just a Terminal server.
DeviceRoles JSON-formatted string field, containing roles identified by the system or defined by users, confidence levels, and the last time each role was observed.
That gives us another useful source of context directly inside DeviceInfo.
https://academy.bluraven.io/blog/device-roles-in-microsoft-defender-xdr
Google SecOps (Chronicle) Curated Detections: Flaw Analysis & Tuning
All3xJ fixes a hyperscalers detections.
This repository documents architectural design flaws, logic discrepancies, and tuning strategies for native Google SecOps (Chronicle) Curated Detections.
While Google Threat Intelligence (GTIG) provides exceptional conceptual threat coverage (such as tracking APT29/BRICKSTORM campaigns), raw YARA-L implementations of curated rules sometimes suffer from implementation oversights, such as grouping logic contradictions and hardcoded threshold variables. In real-world enterprise environments, this frequently leads to massive alert fatigue.
This project analyzes why native rules break or flood the SOC, and shares optimized Custom Rules and patches to resolve these issues.
https://github.com/All3xJ/fixing-google-secops-detections
Hunting MacSync Stealer infrastructure through behavioral pivots
Microsoft Defender Experts and Microsoft Security Research detail they expanded the identification of associated infrastructure.
Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity.
Consensual Forensics with Android Intrusion Logging
Kevin Pagano details how to leverage these new logging sources to identify potential intrusions on Android.
A few months back Android introduced their new intrusion logging capabilities as part of their advanced protection mode. Security Lab has a great blog on everything about them. It really breaks them down into three different categories from the samples I’ve seen:
Security Events - A lot of types, including ADB commands, packages installed/uninstalled, process starts and more
DNS Events - Hostnames, IP addresses
Connection Events - IP addresses, package names, ports
It really allows you to then run IOCs on the logs to see if anything suspicious may be connecting to your mobile device or other connections or packages running that shouldn’t be. I don’t think there are many tools that support parsing these logs at this time but ALEAPP does now after a quick run through Python.
https://www.stark4n6.com/2026/08/consensual-forensics-with-android.html
IRFlow Timeline
Renzon Cruz adds support for ChatGPT Computer History to the IR timeline flows..
IRFlow Timeline 1.0.10 adds ChatGPT Computer History as a new forensic artifact family, and hardens the app for long-running investigations.
https://github.com/r3nzsec/irflow-timeline/releases/tag/v1.0.10
13 million tool calls: auditing every AI coding agent action with Elastic Agent
Wieger van der Meulen shows how it is done at contemporary scale in the AI era across a modern AI use case. How many agents ran tooling which accessed a certificate (per the below) is a jolly good question to be asking.
We gave hundreds of developers an AI agent that can run shell commands, edit files, and call Model Context Protocol (MCP) servers on their laptops, then realized we had no record of what it actually did. So we built one. One 280-line dependency-free bash script, fired by Cursor's hooks, records every tool call as JSONL, and the Elastic Agent already on each endpoint ships it to Elasticsearch. Since the May rollout we have logged over 13 million tool-call events from more than 1,100 machines. A question like "which hosts ran an agent that read a .pem file last week?" is one ES|QL query. The worked example here is Cursor end to end, but the pattern works with any agent that offers lifecycle hooks.
https://www.elastic.co/security-labs/ai-coding-agent-audit-cursor-hooks
From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs
Christopher Henshaw and Gour Karmakar provides some measurement of efficacy but show that there is likely real-world value to be had.
k. Meta Llama 3.1 8B Instruct achieved the strongest overall end-to-end detection performance, with an accuracy of 89.3%, recall of 88.2%, F1-score of 91.8%, and false negative rate of 11.8%. In comparison, Wazuh achieved an accuracy of 52.0% and false negative rate of 68.6%, while OpenSearch achieved an accuracy of 49.3% and false negative rate of 74.5%. Meta Llama also detected 80% of the borderline anomalous scenarios, compared with 20% for Wazuh and 15% for OpenSearch. Qwen achieved lower overall detection performance than Meta Llama but recorded the lowest average inference latency and 100% structured-response validity. GPT-OSS demonstrated strong classification performance when valid responses were produced.
https://arxiv.org/abs/2608.19938
From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation
Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi, Mourad Debbabi and Chadi Assi show that LLMs are in of themselves likely not the sole answer for some use cases - real world value on show here.
Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation. Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality.
https://arxiv.org/abs/2608.19011
Defence
How we proactively defend our environments.
Joint guidance on isolating vital system
Canadian Centre for Cyber Security and friends published this at the end of July
The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the following international partners in releasing cyber security guidance on isolating vital operational technology (OT) systems:
New Zealand’s National Cyber Security Centre (NCSC-NZ)
United Kingdom’s National Cyber Security Centre (NCSC-UK)
United States’ Cybersecurity and Infrastructure Security Agency (CISA)
United States’ Federal Bureau of Investigation (FBI)
State-sponsored cyber actors are targeting critical infrastructure (CI) to conduct espionage and pre-position for cyber attacks. CI organizations can strengthen resilience against escalating cyber threats by preparing to isolate vital OT and enabling systems from the Internet and other networks for an extended period. This can help ensure essential services continue even if corporate networks are compromised.
This joint guidance promotes a shift from reactive defence to proactive resilience, using physical isolation to limit threat actors’ access and maintain operational continuity during crises.
https://www.cyber.gc.ca/en/news-events/joint-guidance-isolating-vital-systems
Defending Against DPRK IT Workers – An Implementation and Operational Guide
Bridewell provide a playbook for defence..
Privileged Identity & Access in Microsoft Entra
Thomas Naunheim and Martin Sohn Christensen accelerate the defence of every Entra centric organisation with this release which continues to be updated / iterated.
Docs, resources and samples to implement a secure privileged identity and access management in Microsoft Azure and Microsoft Entra.
https://github.com/Cloud-Architekt/AzurePrivilegedIAM
Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers
Kerri Prinos, Lilianne Brush and Cameron Denton provide some valuable insight from this research and highlight various gaps in contemporary tradecraft. Also worth nothing that human-machine teaming will need to be considered as these research streams continue.
Our empirical evaluation reveals three key findings that establish LLMs as a distinct attacker class: (1) every model in our cohort falls for deceptive traps at a significantly higher rate than human attackers; (2) the defensive attention-diversion effect observed in humans is statistically absent in our LLM cohort; and (3) a critical recognition-action gap, where LLMs successfully articulate trap recognition in their reasoning but exploit the deceptive elements anyway 73.4% of the time; 48.5% of aware-on-deceptive responses correctly identify the trap and exploit it anyway, while 24.8% exploit after misidentifying the deceptive line.
https://arxiv.org/abs/2606.21037
Benchmarking Automated Security Patch Backporting: How Far Are We?
Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu and Hui Li show the lived reality of where we are and why the technical debt paydown will continue to not be entirely machine scalable for a while.
Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design.
https://arxiv.org/abs/2608.17671
Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers
Elnaz Rabieinejad, Ali Dehghantanha, Fattane Zarrinkalam and Sarina Dastgerdy undertake some valuable socio-technical research with this work showing human trust of AI is going to continue to add friction.
Participants report perceived time savings for low-stakes tasks that are quickly verifiable (e.g., summarizing logs or drafting initial investigative leads), but they consistently frame LLM outputs as preliminary drafts and suggestions rather than decision-grade conclusions. Participants also describe limited trust in LLMs for high-stakes security decisions due to unreliable outputs and unclear model reasoning, and they report relying primarily on ad-hoc verification norms and continuous human oversight rather than standardized mitigation procedures.
https://arxiv.org/abs/2608.17154
Incident Writeups & Disclosures
How they got in and what they did.
I accidentally logged hundreds of thousands of phone calls to military bases
Lina once again shows it is always DNS…
How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.
…
DNS hijacking is silly. I already took over different
.govand.edudomains in the past, but I just immediately reported that and moved on.This one is a little different though, it's about how I took over phone-network infrastructure domains (
e164.arpa) of entire territories, and accidentally logged hundreds of thousands of phone calls to military bases. But let's start at the beginning.
https://lina.sh/blog/hijacking-e164-arpa
Vulnerability
Our attack surface.
A revisit of remote Spectre attacks on Cloudflare Workers
Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl show Spectre is not entirely theoretical in terms of real-world implications and impact in contemporary architectures. Side channels in cloud are a real-thing and thus limit some of the use cases depending on threat model.
To mount a successful side-channel attack in production, an external attacker has to overcome additional obstacles such as activity on shared hardware resources, interrupts, context switches, and coarse-grained timers. Our research uncovered a limitation in the implementation of DyPrIs and we managed to demonstrate a remote Spectre attack reliably leaking up to 12 bit/s with a 99% accuracy in the production environment of Cloudflare Workers.
https://blog.cloudflare.com/revisiting-spectre-attacks-on-workers/
Kanzashi
Andrea Barisani brings foundations to low-level AI enabled research
This repository experiments with bare metal Go, as supported by TamaGo, to perform LLM-driven security vulnerability analysis on low-level architectural layers minimizing OS interference.
The TamaGo framework allows trivial integration of LLM libraries on bare metal to achieve the following:
dramatically reduced driver footprint, no OS presence
ability to import and run pure Go libraries
ability to bridge register/MSR read/write tooling with an LLM agent
https://github.com/abarisani/kanzashi
ZhiShi — Security Research Harness
From China - finding real vulnerabilities with AI - including for awareness.
On the way
Seven vulnerabilities are in Microsoft’s review process
White-box audits uncovered over 200 vulnerabilities, some of which are currently being reported as CVEs.
Browser vulnerabilities
Analysis and reproduction of multiple Chrome/Firefox vulnerabilities
https://github.com/LielingAi/ZhiShi
OpenVuln
Yuxuan Zhang and Clouditera offer this service from China..
Submit a public repository and OpenVuln hunts its vulnerabilities. Protect your open-source repository, together with GLM.
https://huggingface.co/spaces/zai-org/OpenVuln
smiiiiiiiiiiiiiiii
Chris Domas exploits showing what happened when you’ve worked for a CPU manufacturer for a very long time you know where likely architectural bodies are buried.
Exploiting System Management Mode with a very very very very very very very long interrupt.
https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii
LoongLeak
Lorenz Hetterich, Tristan Hornetz, Fabian Thomas and Michael Schwarz side channel on RISC-V.
LoongLeak is a vulnerability affecting the Loongson 3A5000 and 3A6000 CPUs. LoongLeak allows unprivileged attackers to leak data from the L1 data cache, including data from other processes or the operating system.
..
Loongson is a CPU manufacturer that produces high-performance CPUs primarily targeting the Chinese domestic market, including government and administrative sectors. These CPUs use a custom instruction set called LoongArch™. The latest high-performance Loongson CPUs use the 64-bit variant of LoongArch named LA64.
Offense
Attack capability, techniques and trade-craft.
BOFScale: A CDN-Fronted Tailnet from a BOF-PE
Ceri Coburn delivers an in memory capability which detection engineering teams will want to be across.
Running Tailscale as a network layer for C2 traffic is not a new idea. What makes this implementation different is that the entire Tailscale daemon runs inside the implant process with no driver, no service, no disk state, and no child processes. Traffic relays over standard WebSockets that are indistinguishable at the edge from a browser opening a WebSocket connection, which means both the DERP relay servers and the control plane can sit behind CloudFront or Fastly without any special handling.
This post covers three tools that work together to make this possible. The first is
tailscaled, a modified Tailscale daemon compiled as a BOF-PE that runs as an async background job inside the implant. The second istailscale, a lightweight C++ BOF-PE that acts as the operator-facing client, letting you bring the node up, check its status, advertise routes, and shut it down. The third issocksportfwd, which bridges the gap that exists in userspace networking mode by forwarding local ports through the SOCKS5 server that tailscaled exposes, routing traffic to any node on the tailnet.
https://www.netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe/
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
Jiří Vinopal highlights a capability we should expect Microsoft to address - even if they have indicated it won’t be in the short term. Detection engineering teams will want to be across this in the short term.
Furthermore, we demonstrate how
BTR_CLIcan be used as an EDR/AV bypass technique, disarming security solutions while using a trusted Windows built-in, Microsoft-signed driver, thus not relying on typical BYOVD techniques.
Vipere
P'tit Snake delivers a capability which detectio engineers will want to ensure coverage of in their developer environments.
BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native ETW evasion. For Cobalt Strike & Adaptix.
https://github.com/0xaled/Vipere
BusyWork
PatchRequest delivers a capability which it will be interesting to see what the data science deities make of it in terms of efficacy. Statistics hooooo.
A Rust library that replaces
sleep()with real, varied work to evade behavioral pattern matching by EDR, anti-cheat, and dynamic analysis systems.Every call executes a completely different code path — random category, random task, random iteration counts. No two calls produce the same syscall sequence, instruction trace, or API call pattern
https://github.com/PatchRequest/BusyWork
MS-Nightmare Un-defend v2 — What Happens When Signatures Can’t Land
MS-Nightmare shows how to block EDR updates and thus ensuring tradecraft to detect these techniques is the imperative.
Every antivirus and EDR product depends on freshness. It is only as effective as its most recent signature update. Vendors invest heavily in protecting that pipeline — the update service, its driver, its file layout, and its networking — because once the pipeline stops, the sensor quietly goes stale while still appearing healthy.
We asked a simple question: can a user-mode process halt the update pipeline of a major AV or EDR product without kernel code, without changing services, and without special administrative tricks beyond a normal run?
The short answer is **yes**. The method uses Windows file-handle semantics, a byte-range lock, and one watch thread per directory. This document explains how the update machinery works, where its weak points are, and why the technique succeeds. It is published so defenders can understand the failure mode, test it, and mitigate it.
https://weedhashpeddler.medium.com/every-antivirus-and-edr-product-depends-on-freshness-28b0fa9c810d
Turning Chrome Remote Desktop into Pure Red Team Ops
Smukx details how it is done - detection tradecraft is the name of the game..
This post, we are going to explore how we can take a popular Google product, Chrome Remote Desktop (CRD), and look at it from a red team perspective, turning its existing features into red team tool, almost like a spyware-kinda scenario.
https://zerotracelab.com/blog/chrome-remote-desktop-red-ops
Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse
Shahak Morag leverages security products to provide surrogate homes for malicious capability. Detection again is the name of the [WHAT]?
Legitimate SentinelOne installers and accessible COM interfaces can be abused to bypass Protected Process Light (PPL) protections and execute unsigned code — completely bypassing the need for kernel vulnerabilities or traditional exploits.
Management communications rely on user-configurable mechanisms like local DNS lookups, which allow an administrator to easily isolate the agent and block remote telemetry.
Built-in self-defense mechanisms can be inverted against the host system, rendering files inaccessible and processes untouchable.
Trusted endpoint detection and response (EDR) software can become a high-impact Trojan horse when local privilege escalation vectors and local trust assumptions are not properly hardened.
https://www.akamai.com/blog/security-research/bring-your-own-edr-turn-commercial-edr-trojan-horse
Chaining Trusted Windows Components into a Process-Tampering Primitive
Angelo Frasca Caccia shows how to degrade detection capabilities with this release..
SgrmFault is a Windows process-tampering exploit chain that combines a revived COM-based code-injection technique in WerFaultSecure.exe with an APC-based process-tampering primitive exposed by Microsoft’s SgrmAgent.sys driver.
https://github.com/lem0nSec/SgrmFault
Exploitation
What is being exploited..
Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia
Hunt.io detail global exploitation of these CCTV camera which is noteworthy for the type of device and scale..
Between 17 June and 22 July 2026, a single operator compromised over 14,000 Dahua IP cameras. The scanning behind it was global: masscan sweeps ran against Russian address space first, then across the full IPv4 range, and the largest single haul actually landed in Mexican and Vietnamese ISP ranges before the operator's focus settled on Russian and CIS telecom netblocks. Where the confirmed, geolocated compromises concentrated was Ukraine and Russia, with Ukraine holding the largest share.
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised
Actively exploited vulnerability in Zimbra Collaboration Suite
The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.
The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag
Connor McGarr details this flag and its impact..
Recently, while investigating new feature development for our Origin (by Prelude) Runtime Memory Protection research preview product, we were forced to dig into the inner-workings of Event Tracing for Windows (ETW). In the course of leveraging our internal ETW tooling, which executes at a signing and protection level of Antimalware Protected Process Light (PPL), we noticed that it was possible to issue a “stop trace” code to a target ETW session that had an undocumented “security trace” flag enabled
https://connormcgarr.github.io/securitytrace-etw-ppl/
Windows Kernel Trace MOF
John U publishes a Trace Managed Object Format (MOF) File - a text file used by classic Event Tracing for Windows (ETW) and WMI providers.
I updated my ETW classic provider MOF recovery to include EventTypeName and Description.
These were in an adjacent ms_409 (en-US) locale namespace.
The recovered Windows Kernel Trace MOF now looks like this
gist.github.com/jdu2600/a2b03e4e9cf19282a41ad766388c9856
CipherRun
Marc Rivero López developed this tooling which will have a variety of use cases.
CipherRun is a comprehensive TLS/SSL security scanner written in Rust. It combines protocol and cipher analysis, vulnerability testing, compliance checks, and certificate transparency monitoring in a single high-performance CLI and API-ready engine.
https://github.com/seifreed/CipherRun
windbg-bridge
Kevin Gosse releases this work aid.
windbg-bridge connects a live WinDbg session to AI agents like Claude Code or Codex through a named pipe. The agent can run debugger commands, read your command history, and watch output in real time. Everything it does shows up in the WinDbg UI, so you always see exactly what's happening.
https://github.com/kevingosse/windbg-bridge
Reverse engineering Malwarebytes Browser Guard
Milton Cardoso reverse engineers and documents.
Static analysis of Browser Guard 3.1.5 (15M+ installs): Zstd-encoded on-disk databases, the heuristic rule engine that scans the live DOM, the Hubble false-positive service, the package update protocol, and a debug URL interface left in production. With reimplementations in C# and Python.
https://msil.re/posts/reversing-malwarebytes-browser-guard.html
Reverse-engineering Find My People
Zerotistic unpicks and details.
How I registered a Linux machine with Apple's private services, received an existing Find My People key over IDS, and decrypted the live location without a Mac.
https://zerotistic.blog/posts/find-my-people-linux/
CUDA Agent: Large-Scale Agentic RL for High-Performance CUDA Kernel Generation
Weinan Dai, Hanlin Wu, Qiying Yu, Huan-ang Gao, Jiahao Li, Chengquan Jiang, Weiqiang Lou, Yufan Song, Hongli Yu, Jiaze Chen, Wei-Ying Ma, Ya-Qin Zhang, Jingjing Liu, Mingxuan Wang, Xin Liu and Hao Zhou publish.
CUDA Agent achieves state-of-the-art results on KernelBench, delivering 100%, 100%, and 92% faster rate over Torch.compile on KernelBench Level-1, Level-2, and Level-3 splits, outperforming the strongest proprietary models such as Claude Opus 4.5 and Gemini 3 Pro by about 40% on the hardest Level-3 setting.
https://arxiv.org/abs/2602.24286v1
Technical Analysis of the Geedge Networks Firewall Source Code Leak
Anna Ablove , Johnnie Walker , Ben Wolin , Niklas Niere , Felix Lange , Aaron Ortwein , Armin Huremagic , Richa Priyanka , Ali Zohaib , Jade Sheffey , Nico Heitmann , J. Alex Halderman , Juraj Somorovsky , Amir Houmansadr , Roya Ensafi , Mingshi Wu and Eric Wustrow publish
In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks’ flagship product, the Tiangou Secure Gateway (TSG) firewall. Working across multiple repositories, we successfully build and run a local copy of TSG—revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other resources. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.
https://www.usenix.org/system/files/usenixsecurity26-ablove.pdf
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection and APT report collection
Artificial intelligence
if you are a big arxiv.org user - out of China there is alphaxiv.org which is an AI powered incarnation / overlay
Fundamental
Small-Scale Experiments: Are We There Yet? - By ablating the basic scaling law recipe, we show well-tuned hyperparameters matter more than any other ingredient. Further, we reveal why those hyperparameters become easier to find: as scale increases, the hyperparameter loss surface becomes lower dimensional. Nevertheless while scaling laws exist in small models, extrapolation hits statistical limitations.
Intern-S2-Mobius: Foundation Model with Decoupled Knowledge and Reasoning
HiFi-UMI: Learning Deployable Manipulation Policies from High-Fidelity UMI Data Alone
Data Pyramid for Embodied Manipulation - “For embodied brain models, vision-language-action models, and world-action models alike, we relate data composition to capabilities in perception, reasoning, planning, action generation, and world prediction.”
EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models
Applied non-cyber
The Fabricated Front: Generative AI and the Opacity of Workplace Performance
One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI
Why Does CLAUDE.md Keep Growing? Catastrophic Remembering in Agentic Coding
DeepSeek Harness - DeepSeek Harness (
dsh) is an open-source agent harness developed by DeepSeek AI. It uses an architecture where everything is a plugin, and is powered by Cordis,CUDA Agent: Large-Scale Agentic RL for High-Performance CUDA Kernel Generation
Reviving Old Unsupported Devices with AI – AVerMedia Game Capture HD II
BreakGuard: Towards Detecting Dependency Breaking Changes with LLM-Generated Tests
Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets
Benchmarking Identity-Sensitive LLM Outputs for Surveillance and Security Robots
Breaking and Defending LLM-Powered Social Media Bot Detection Systems
Applied cyber specific
COMA: A Compositional Misleading Attack Class on Security-RAG, and a Causal Counterfactual Defense
Securing AI-Generated Code: A Just-in-Time Vulnerability Detection and Remediation Pipeline
MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection
Improving LLM-Based SSH Honeypots Through Prompting and Fine-Tuning
CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence
Benchmarking Automated Security Patch Backporting: How Far Are We?
Probing the Prefill: Detecting Code Vulnerabilities via Latent Activations
LLMs for Zero-Shot Threat Detection via Structured Risk Indicators
WeSCE: A Benchmark for Measuring Security Drift in LLM-Driven Code Editing
Books
Valley of Death - out in September
Events
Critical Information Infrastructures Security papers - “20th International Conference, CRITIS 2025, Jönköping, Sweden, October 21–23, 2025, Revised Selected Papers”
INTERCEPT — Builders & Breakers of Agentic Runtime Security - February 2027, San Francisco
CHERITech'26 Call for Papers - November 2026, Munich, DE @ SEMICON Europa
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.