Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do.
Operationally this week nothing overly of note…
In the high-level this week:
Designing safer links: secure connectivity for operational technology - NCSC UK releases supported by international partners - “New principles help organisations to design, review, and secure connectivity to (and within) OT systems.”
Secure connectivity principles for operational technology (OT) - “It is produced by the UK National Cyber Security Centre (NCSC) in partnership with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC), the Canadian Centre for Cyber Security (Cyber Centre), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Federal Bureau of Investigation (FBI), Germany’s Federal Office for Information Security (BSI), Netherlands’ National Cyber Security Centre (NCSC-NL), and New Zealand’s National Cyber Security Centre (NCSC-NZ).”
Software Security Ambassadors Scheme - Department for Science, Innovation and Technology and Baroness Lloyd of Effra CBE announce - “A scheme to champion secure software development and support a resilient cyber ecosystem.”
Software Security Ambassadors Scheme - UK Department for Science, Innovation & Technology publishes - “This is a commitment by the Department for Science, Innovation and Technology, the National Cyber Security Centre and signatory organisations to work together to endeavour to promote best practices in secure software development and to strengthen digital supply chains by improving transparency and facilitating risk management.”
Tracking Cyber Growth: What Should We Measure, and Why? - UK’s NCSC Research Institute for Sociotechnical Cyber Security explores - “We should strive to understand how, when, and why UK cyber start-ups fail, scale, or exit” - and I would add, exit too early to international firms and not become independent global winners - as there are some deep cultural and phycological contributors.
£279 million investment to build new home for Army’s cyber regiment - Ministry of Defence and Luke Pollard MP announce - “The investment will provide new infrastructure at Duke of Gloucester Barracks in Gloucestershire for 13 Signal Regiment, who deliver defensive cyber operations for the Army. The work will include brand new technical and training buildings for personnel, as well as modern accommodation.”
Report of the Independent Reviewer of State Threats Legislation - UK Home Office publish - “Thirdly, the policy of the legislation is plainly to exclude loopholes, particularly those that might arise from the use of technology.
Cyber activity and remote access and temporary malfunction are covered through tech-proof language and wide extra-territorial jurisdiction.”
Préparer la remédiation - ANSSI publishes - “This document complements the operational aspects of remediation. It assists in the implementation or identification of the actions listed among the activities in the "Managing Remediation" guide from the same collection (Managing Remediation | MyCyberServices). It draws on operational feedback from ANSSI and also incorporates insights from workshops with incident response providers who generously shared their experiences.”
Massive cyberattack on Polish power system in December failed, minister says - Reuters reports - “The failed attack aimed to disrupt the communication between renewable installations and the power distribution operators, Milosz Motyka told reporters, adding in the past large power units or transmission networks have been targeted.”
G7 CYBER EXPERT GROUP STATEMENT ON Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector - US Treasury publishes - “While the trajectory of quantum computing development is uncertain, it may be helpful for organizations to establish comparable migration timelines to ensure their milestones can be achieved prior to the availability of cryptographically relevant quantum computers (CRQCs).”
GCVE Announces the Launch of db.gcve.eu: A New Open Public Vulnerability Advisory Database - Global CVE Allocation System announces - “The project is co-funded by CIRCL and the European Union (ECCC) under the FETTA project, supporting the development of open, resilient, and strengthen EU Cyber Threat Intelligence.”
Unpacking state-sponsored cyber conflict: Intelligence-driven strategic competition in cyberspace - Journal of Strategic Studies publishes (in December) - “ In this view, cyber rivalry is propelled by intelligence practice – collection, pre-positioning, enablement, and selective covert action – integrated with statecraft. The IDSC framework specifies the conditions under which covert access and information control are converted into cumulative strategic leverage over time, and when they instead produce sharper but more bounded effects”
"Designing a Government Organization to Support Japan's Active Cyber Defense (ACD) - Two "Dejima Organizations" Supporting Intelligence-Driven Cybersecurity Policy" - National Institute for Defense Studies publishes - “According to the Cabinet Secretariat's explanatory materials on the ACD-related law, the practical implementation of various measures under the Japanese version of the ACD will involve ( A ) strengthening public-private partnerships and the use of communications information through a new organization within the Cabinet Secretariat and Cabinet Office, established through the progressive reorganization of the National Center of Incident Readiness and Strategy for Cybersecurity ( NISC ). Meanwhile, ( B ) access and sanitization will be handled by the police or the Self-Defense Forces, depending on the nature of the case.”
Strengthening National CSIRT Cooperation: From Domestic Setups to International Networks - The United Nations Institute for Disarmament Research (UNIDIR) publish - “This policy brief examines how the design and functioning of national computer security incident response teams (CSIRTs) shape their ability to cooperate domestically and internationally.”
Civil Takedowns: The Missing Legal Framework for Cyber Disruption - Centre for Strategic and International Studies think tanks - “Today, civil takedowns remain rare and largely confined to a few resource-rich firms. That is not because the threats are limited, but because the legal, procedural, and economic barriers to using this tool are high. This creates a classic public goods problem: The benefits of disruption are diffuse and societal, while costs are concentrated on a few private firms, discouraging action even when the national interest is clear.”
Digital package - Revision of the Cybersecurity Act: Implementation takeaways - European Parliament Think Tank think tank - “The European cybersecurity certification framework has advanced more slowly than initially envisaged. According to stakeholders, progress in developing certification schemes has been limited, with several delays and concerns regarding process transparency and predictability. The absence of a regularly updated EU rolling work programme has made long-term planning more difficult for both public authorities and industry.”
Staying in the Feed: The Islamic State’s Digital Survival Strategy - Observer Research Foundation publishes - “Contrary to the tiered recruitment networks of previous decades, modern ISIS strategy increasingly prioritises networking and mobilisation via online channels, earning the group the moniker ‘cyber caliphate’. These digital ecosystems have enabled not only the dissemination of propaganda but also the cultivation of interpersonal connections among sympathisers worldwide.”
Reporting on/from China
China’s 2025 Top 20 Cybersecurity Companies: Which “Dark Horses” Will Emerge to Prominence in 2026? - Natto Team - “the Natto Team examines the overall development of China’s cybersecurity sector and the top cybersecurity companies of 2025 based on the ISC’s CICCI reports, which analyze these companies’ key performance indicators, innovation and research and development (R&D) capabilities, business and market coverage, and how their core functions align with China’s national priorities.”
补天: China’s digital defense drills - Netaskari opines - “Further, it provides a fertile training ground for Chinese red-team members to sharpen their knifes and test complex attack methods that easily could be modified and transferred to genuine attack operations against foreign targets. As much of the Chinese software ecosystem is built on open source, the proficiency of Chinese red-teams exploiting them is pretty good.”
New Pentagon Research Security Initiatives Announced Following Select Committee Investigations - The Select Committee on the CCP publish - “The initiatives follow a September 2025 Select Committee investigation that revealed that approximately 1,400 research papers published between June 2023 and June 2025 involved collaboration with PRC entities. Of these, over 700 publications—or just over 50%—were conducted in partnership with entities affiliated with China’s defense research and industrial base.”
House Passes Bipartisan Legislation to Limit Adversaries’ Remote Access to Critical Technology - The Select Committee on the CCP announce - “directly addresses this threat by clarifying that export controls can be applied equally to remote access, provision of access, and cloud-based exposure of controlled items.”
Glass Onion Peeling Back the Layers of a Pro-China Online Ecosystem -Graphika publish - “a network of 43 domains and 37 subdomains that pushed pro-China messaging while posing as the New York Times, the Guardian, the Wall Street Journal, and other legitimate media outlets”
AI
BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow - App Omni disclose - and highlights that there is nothing overly AI specific beyond the use agent - just lack of secure by design / an secure development lifecycle blip..
Call for papers: AI-driven threat detection and response Collection - Scientific Reports calls for papers - “… a Guest-Edited Collection on AI-driven threat detection and response. AI-Driven Threat Detection and Response is a rapidly evolving research field focused on leveraging artificial intelligence to identify, assess, and neutralize cybersecurity threats with speed and precision beyond human capabilities.”
Cybersecurity AI: A Game-Theoretic AI for Guiding Attack and Defense - Alias Robotics and Johannes Kepler University Linz publish - “AI-driven penetration testing now executes thousands of actions per hour but still lacks the strategic intuition humans apply in competitive security. To build cybersecurity superintelligence–Cybersecurity AI exceeding best human capability—such strategic intuition must be embedded into agentic reasoning processes. We present Generative Cut-the-Rope (G-CTR), a game-theoretic guidance layer that extracts attack graphs from agent’s context, computes Nash equilibria with effort-aware scoring, and feeds a concise digest back into the LLM loop guiding the agent’s actions”
Potential future risks from autonomous AI systems - UK House of Lords Library publishes - “Some experts argue that future autonomous AI systems may be able to evade human oversight and control. The likelihood and potential impacts of such “loss of control” incidents are debated as the trajectory of future AI advancement is uncertain. To address this risk, the UK has adopted non-statutory principles to guide responsible development and use but currently lacks AI-specific regulations or legislation.”
How well did forecasters predict 2025 AI progress? - Epoch AI analyses - “Mostly right about benchmarks, mixed results on real-world impacts” - I am a very public supporter of Superforecasting and this highlights the very real importance of it.
China’s AI chip dragons’ firepower is mostly mythical - Financial Times reports/asserts - “Here be dragons” was ancient mapmaker code for the unknown. Something similar applies to China’s latest group of so-called dragons — AI chipmakers seeking to profit from Nvidia’s geopolitical tangles. They have been buoyed by investor optimism, but their path ahead is unclear.
Notice from eight departments including the Ministry of Industry and Information Technology on Issuing the “Implementation Opinions on the Special Action of ‘Artificial Intelligence + Manufacturing’” - Chinese government issues - 2027 goals: secure & reliable key AI tech. Apply 3–5 general foundation models deeply in manufacturing + build industry models. Deliver 1000 industrial agents, 100 high-quality datasets, 500典型场景, 1000 benchmark firms, and 2–3 global ecosystem leaders.
HoneyTrap: Deceiving Large Language Model Attackers to Honeypot Traps with Resilient Multi-Agent Defense - Shanghai Jiao Tong University, University of Illinois at Urbana-Champaign and Zhejiang University publish - “Notably, even in a dedicated adaptive attacker setting with intensified conditions, HoneyTrap remains resilient, leveraging deceptive engagement to prolong interactions, significantly increasing the time and computational costs required for successful exploitation. Unlike simple rejection, HoneyTrap strategically wastes attacker resources without impacting benign queries, improving MSR and ARC by 118.11% and 149.16%, respectively.”
Extracting books from production language models - Stanford University and Yale University publish - “In some cases, jailbroken Claude 3.7 Sonnet outputs entire books near-verbatim (e.g., nv-recall = 95.8%). GPT-4.1 requires significantly more BoN attempts (e.g., 20×), and eventually refuses to continue (e.g., nv-recall = 4.0%). Taken together, our work highlights that, even with model- and system-level safeguards, extraction of (in-copyright) training data remains a risk for production LLMs.”
Artificial intelligence: Council paves the way for the creation of AI gigafactories - European Council of the European Union announce - “The Council has adopted today an amendment to the regulation governing the activities of the European High-Performance Computing Joint Undertaking (EuroHPC JU), extending its objectives to facilitate the creation of Artificial Intelligence (AI) gigafactories in Europe and to include a dedicated quantum technologies pillar.”
Cyber proliferation
Critics pan spyware maker NSO’s transparency claims amid its push to enter US market - Tech Crunch report - “But the report, unlike NSO’s previous annual disclosures, lacks details about how many customers the company rejected, investigated, suspended, or terminated due to human rights abuses involving its surveillance tools. While the report contains promises to respect human rights and have controls to demand its customers do the same, the report provides no concrete evidence supporting either.”
Hungary grants asylum to former Polish minister implicated in spyware probe - Recorded Future reports - “Hungary has granted political asylum to Poland's former justice minister, Zbigniew Ziobro, who is being prosecuted for his role in a spyware scandal that has rocked the country.”
Bounty Hunting
Oleg Evgenievich NEFEDOV - EU Most Wanted put on point - “Oleg Evgenievich NEFEDOV (or: Oleg Evgenyevich) is suspected of having formed the group responsible for the malware "Black Basta" and of having served as the group's ringleader, which led to his playing a considerable part in global cyberattacks.”
A 33-year-old Dutchman under international surveillance was arrested at Schiphol Airport on Sunday evening. The National Public Prosecutor’s Office (LP) suspects him and two of his companies of enabling criminals to test malware - Openbaar Ministerie announces - “During the investigation, it emerged that the man had deregistered from the Netherlands and departed for the United Arab Emirates. The suspect had been under international surveillance for some time when he was arrested by the Royal Netherlands Marechaussee at Schiphol Airport on Sunday.”
France releases Russian man wanted in US for cyberhacking, lawyer says - Reuters reports - “Russian state news agency RIA quoted his lawyer, Frederic Belot, as saying Kasatkin had been released late on Wednesday and was already back in Moscow. Belot has previously said that Kasatkin had no computer expertise and that his device had been hacked by cybercriminals.” - he was allegedly swapped for a French national Russia had arrested
Fugitive wanted in connection with Desjardins data breach arrested in Spain - CBC reports - “He was among the most wanted fugitives in Quebec and is wanted by the financial crimes and cyber crime investigation division as part of Project Portier, a large investigation into the Desjardins data breach.”
Microsoft disrupts global cybercrime subscription service responsible for millions in fraud losses - Microsoft announces - “These efforts are part of a broader joint operation with international law enforcement, including German authorities and Europol, which has allowed Microsoft and its partners to seize key malicious infrastructure and take the RedVDS marketplace offline, a major step toward dismantling the networks behind AI-enabled fraud, such as real estate scams.”
Market Incentives
Police mull overseas travel ban on Coupang chief in data breach investigation - The Korea Times reports - “Police are considering imposing a travel ban on Coupang interim CEO Harold Rogers after he refused to appear for questioning over an investigation into the online retailer's massive data breach.”
Data breach: FREE MOBILE and FREE fined €42 million - Commission Nationale de l’Informatique et des Libertés announces - “In particular, it noted that the authentication procedure for connecting to the VPNs of FREE MOBILE and FREE – used in particular for remote working by the companies' employees – was not sufficiently robust. Furthermore, the measures deployed by FREE MOBILE and FREE to detect abnormal behaviour on their information systems were ineffective.” - market incentive to employ phishing resistant MFA aka passkeys..
Reflections this week are around urgency, pace and relentless focus. Specifically in technology security and its preparedness to withstand the contemporary operating threat environment.
Each week in these pages the quality of global vulnerability research, ability to exploit and intent to use is on show. Yet the urgency by those who make the technology to depreciate the legacy, pay down technical debt and adopt secure technology principles in a manner which is unwavering is not always.
This fact is in part the behind the The Software Security Ambassador Scheme announced this week by the UK Government.
The Software Security Ambassador Scheme has been developed to help drive adoption of the Software Security Code of Practice, a voluntary set of principles designed to reduce software supply chain attacks and disruption, and improve cyber resilience across the economy.
Getting technology corporations to make very public commitments will both unlock them internally but also as importantly accelerate. This is something we should applaud of the initial signatories and encourage others to similarly get behind..
As I said this week in a meeting we are at a moment in time which will be inter-generationally defining. We have time to ensure and assure we get the outcome we want, but we don’t have limitless time. As such urgency, pace and relentless focus are the imperatives when it comes to technology security which will be foundational in pursuit..
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
"Untrustworthy Fund": targeted UAC-0190 cyberattacks against SOU using PLUGGYAPE
CERT Ukraine detail this alleged Russian operation against Ukrainian forces for which the initial access tradecraft was/is extremely basic.
[We] took measures to investigate a number of targeted cyber attacks against representatives of the Defense Forces of Ukraine, carried out under the guise of charitable foundation activities using the PLUGGYAPE software tool.
Based on certain characteristics, the activity is associated with a medium level of confidence with the activities of a group known as Void Blizzard (Laundry Bear), for tracking which the identifier UAC-0190 is used.
..
To implement the malicious plan, the target of the cyberattack is encouraged via instant messengers to visit a website that imitates the webpage of a supposedly charitable foundation, from which it is proposed to download "documents" - executable files, which are usually located in a password-protected archive. At the same time, the executable file can be sent directly to the instant messenger and most often has the extension ".docx.pif".
https://cert.gov.ua/article/6286942
🇷🇺 COMmand & Evade: Turla’s Kazuar v3 Loader
Dominik details at alleged latest update to Turla’s implant loader which has clear intent to avoid detection.. Blueteams have been warned..
The upgraded loader heavily utilizes the Component Object Model (COM) and employs patchless Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) bypass techniques, as well as a control flow redirection trick, alongside various other methods to evade security solutions and increase analysis time. It is likely that this malware was used in the same campaign which ESET reported in their Gamaredon and Turla collaboration article, as the loaded Kazuar v3 payloads also use the agent label
AGN-RR-01.
https://r136a1.dev/2026/01/14/command-and-evade-turlas-kazuar-v3-loader/
Reporting on China
LOTUSLITE: Targeted espionage leveraging geopolitical themes
Ilia Dafchev and Subhajeet Singha detail this alleged Chinese operation which is noteworthy for using a hardcoded IP for its C2 and not a DNS domain. Interesting almost the minimum viable product approach to implant development here. The victimology is obviously also of interest as is the initial access tradecraft (phishing)..
Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious DLL. The executable is used to sideload and execute the DLL, which functions as the primary backdoor, tracked as LOTUSLITE.
The backdoor, referred to as LOTUSLITE, is a custom C++ implant that communicates with a hard-coded IP-based command-and-control server and supports basic remote tasking and data exfiltration with a decent persistence technique indicating an espionage-focused capability set rather than financially motivated objectives.
The loader demonstrates low development maturity, with minimal error handling and limited defensive evasion, suggesting rapid operational deployment rather than a long-term, well-maintained malware framework.
Infrastructure analysis and execution patterns show moderate-confidence overlap with Mustang Panda tradecraft, including delivery style, loader–DLL separation and infrastructure usage. Attribution is assessed at a behavioural level and does not rely on code reuse alone.
This campaign reflects a continued trend of targeted spear phishing using geopolitical lures, favoring reliable execution techniques such as DLL sideloading over exploit-based initial access.
The observed targeting is limited to U.S. government and policy-related entities, indicating a focused victim set. While the overall scale appears limited, the nature of the targets increases the potential strategic impact
https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/
VoidLink – A Stealthy, Cloud-Native Linux Malware Framework
Checkpoint Research detail this alleged Chinese developed implant for Linux which shows operational security sophistication.
VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to operate reliably in cloud and container environments over extended periods.
VoidLink’s architecture is extremely flexible and highly modular, centered around a custom Plugin API that appears to be inspired by Cobalt Strike’s Beacon Object Files (BOF) approach. This API is used in more than 30+ plug-in modules available by default.
VoidLink employs multiple Operational Security (OPSEC) mechanisms, including runtime code encryption, self-deletion upon tampering, and adaptive behavior based on the detected environment, alongside a range of user-mode and kernel-level rootkit capabilities.
The framework appears to be built and maintained by Chinese-affiliated developers (exact affiliation remains unclear) and is actively evolving. Its overall design and thorough documentation suggest it is intended for commercial purposes.
The developers demonstrate a high level of technical expertise, with strong proficiency across multiple programming languages, including Go, Zig, C, and modern frameworks such as React. In addition, the attacker possesses in-depth knowledge of sophisticated operating system internals, enabling the development of advanced and complex solutions.
https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/
UAT-8837 targets critical infrastructure sectors in North America
Asheer Malhotra, Vitor Ventura and Brandon White detail an alleged Chinese operation where the victimology is of note.
Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor based on overlaps in tactics, techniques, and procedures (TTPs) with those of other known China-nexus threat actors.
Based on UAT-8837’s TTPs and post-compromise activity Talos has observed across multiple intrusions, we assess with medium confidence that this actor is primarily tasked with obtaining initial access to high-value organizations.
Although UAT-8837’s targeting may appear sporadic, since at least 2025, the group has clearly focused on targets within critical Infrastructure sectors in North America.
https://blog.talosintelligence.com/uat-8837/
Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs
Hunt.io attempt to illicit signal from this analysis of of C2 servers hosted in China.
Analysis of recent telemetry surfaced more than 18,000 active C2 servers distributed across 48 Chinese infrastructure providers.
C2 infrastructure dominates malicious activity (~84%), far exceeding phishing infrastructure (~13%), with open directories and public IOCs together contributing less than 4%.
China Unicom alone hosts nearly half of all observed C2 servers, with Alibaba Cloud and Tencent following, highlighting heavy concentration in large, high-capacity networks.
Tencent and Alibaba Cloud exhibit high phishing activity alongside C2 hosting, reflecting attacker preference for scalable, trusted cloud platforms.
A small set of malware families (Mozi, ARL, Cobalt Strike, Mirai, Vshell) accounts for most C2 activity, showing framework-driven, repeatable abuse.
IoT-based botnet infrastructure remains deeply entrenched, with Mozi’s dominance reinforcing China’s role in large-scale IoT C2 operations.
Chinese infrastructure supports both cybercrime and APT activity, with RATs, cryptominers, phishing frameworks, and state-linked malware coexisting in the same environments.
High-trust networks are actively abused, as China169 Backbone, CHINANET, and CERNET demonstrate exploitation of telecom and academic infrastructure.
https://hunt.io/blog/china-hosting-malware-c2-infrastructure
Reporting on North Korea
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
Red Asgard Threat Research Team detail an alleged North Korean operation which is note worthy for the multipronged approach to achieving initial access.
The repository contained three distinct infection mechanisms:
VSCode Auto-Execution A
.vscode/tasks.jsonfile configured withrunOn: folderOpen—meaning the malicious code executes the moment a developer opens the project folder in VSCode or Cursor.Backend RCE via Function Constructor An
errorHandler.jsfile containingCookie Payload Delivery (Vynlence variant) A
getCookie()function that fetches malicious JavaScript from C2, disguised as benign cookie retrieval. The C2 returns{ cookie: "<javascript_code>" }which is then executed viaFunction.constructor.All three vectors pointed to Vercel-hosted Stage 1 C2 servers. We set up an isolated analysis environment and followed the trail.
https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure
VS Code Tasks Abuse by Contagious Interview (DPRK)
SEAL Intel analyses alleged DPRK capability which is noteworthy to those of you protecting developer eco-systems of interest to DPRK intents.
The malware targets developers by embedding VS Code tasks execution hook as well as regular
npmapplication executing malicious fetch.The attack employs a “dual-stack” architecture:
Node.js Layer: Executes immediately upon infection to steal credentials, log keys, and establish a covert RAT within the
.npmdirectory.Python Layer: Downloads a secondary infrastructure for long-term surveillance, cryptocurrency wallet theft, and cryptocurrency mining.
https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/
Reporting on Iran
MuddyWater: When Your Build System Becomes an IOC – “Jacob”
Robin Dost goes to town on highlighting the operational security mistakes of this alleged Iranian actor.
Build artifacts embedded in operational malware are more than just accidental leaks they offer a look into an actors internal development maturity.
Exposed compiler paths, usernames, project directories or debug strings strongly suggest the absence of a hardened release pipeline.
In mature development environments, build systems are typically isolated, stripped of identifiable metadata and designed to produce reproducible, sanitized artifacts.
When these indicators repeatedly appear in live payloads, it points to ad-hoc or poorly automated build processes rather than a structured CI/CD workflow
The continued presence of build artifacts across multiple campaigns is particularly telling.
https://blog.synapticsystems.de/muddywater-when-your-build-system-becomes-an-ioc/
Reporting on Other Actors
Keylogger targets 200,000+ employees at major US bank
Sansec catch a compromise which is of note due to the potential second order opportunities the collected information would provide.
Sansec detected a keylogger on the employee store of one of America’s largest banks. The site serves over 200,000 employees who use it to order company-branded items. The malware intercepts everything typed into the site’s forms: login credentials, payment card numbers, personal information.
Update Jan 15th: the malware appears to have been removed. It was live for about 18 hours
https://sansec.io/research/keylogger-major-us-bank-employees
UNO reverse card: stealing cookies from cookie stealers
CyberARK shows what is possible if you either live in a jurisdiction with globally unique laws, have a warrant or plough on regardless..
What didn’t make headlines at the time was arguably far more damaging. While analyzing the leaked panel code, we identified a vulnerability that allowed us to observe and interact with StealC operators themselves. By exploiting it, we were able to collect system fingerprints, monitor active sessions, and—in a twist that will surprise no one—steal cookies from the very infrastructure designed to steal them.
In this blog post, we’ll cover a specific threat actor and demonstrate how much can be learned by exploiting vulnerabilities in the threat actor’s infrastructure.
Inside RedVDS: How a single virtual desktop provider fueled worldwide cybercriminal operations
Microsoft detail the technical aspects of this criminal enabler..
The mass scale of operations facilitated by RedVDS infrastructure and roughly US $40 million in reported fraud losses driven by RedVDS‑enabled activity in the United States alone since March 2025 underscore the threat of an invisible infrastructure providing scalability and ease for cybercriminals to access target networks.
RedVDS is an infrastructure service that facilitated malicious activity, but unlike malware, it did not perform harmful actions itself; the threat came from how criminals used the servers after provisioning. Our investigation found that RedVDS customers consistently set up a standard toolkit of malicious or dual-use software on their rented servers to facilitate their campaigns. By examining multiple RedVDS instances, we identified a recurring set of tools:
Mass mailer utilities
Email address harvesters
Privacy and OPSEC tools
Remote access and management
Automation and scripting
Who Benefited from the Aisuru and Kimwolf Botnets?
Brian Krebs details the supply chain which underpinned this botnet.
Neither of Resi Rack’s co-owners responded to follow-up questions. Both have been active in selling proxy services via Discord for nearly two years.
https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/
Discovery
How we find and understand the latent compromises within our environments.
SDFlags - The Log Field I’d Been Ignoring That Unlocked Attack Path Detection
Andrew Schwartz decodes a field which will enable detection engineers to further refine their detections around the misuse of LDAP.
I’d been looking at Event 1644 logs for weeks. Analyzing filters, tracking attributes, and building detection rules. And the whole time, SDFlags was right there in the logs. I just wasn’t seeing it.
The day I finally noticed that field, everything changed. What started as “Wait, what is that?” became:
Understanding how nTSecurityDescriptor works
Realizing this is THE foundation of attack path discovery
Recognizing the detection opportunity in SDFlags
Building high-confidence detection rules
Finding a pattern that only appears during attack path enumeration
https://www.huntress.com/blog/ldap-active-directory-detection-part-three
A Unified Framework for Detecting Point and Collective Anomalies in Operating System Logs via Collaborative Transformers
Mohammad Nasirzadeh brings computer science to anomaly detection and shows their is still improvements and value to be gained from both exploration in and application of even in systems which are inferred to be chaotic.
To handle the heterogeneity caused by these interactions, CoLog incorporates a modality adaptation layer, which adapts the representations from different log modalities. This methodology enables CoLog to learn nuanced patterns and dependencies within the data, enhancing its anomaly detection capabilities. Extensive experiments demonstrate CoLog’s superiority over existing state-of-the-art methods. Furthermore, in detecting both point and collective anomalies, CoLog achieves a mean precision of 99.63%, a mean recall of 99.59%, and a mean F1 score of 99.61% across seven benchmark datasets for log-based anomaly detection. The comprehensive detection capabilities of CoLog make it highly suitable for cybersecurity, system monitoring, and operational efficiency. CoLog represents a significant advancement in log anomaly detection, providing a sophisticated and effective solution to point and collective anomaly detection through a unified framework and a solution to the complex challenges automatic log data analysis poses.
https://github.com/NasirzadehMoh/CoLog
ADTrapper - Active Directory Security Analysis Platform
Michael Haag continues to show he is a modern day one person Q of cyber defence.
ADTrapper is a comprehensive security analysis platform designed for cybersecurity professionals to analyze Windows Active Directory authentication logs. The platform provides advanced threat detection, anomaly analysis, and interactive visualizations to help identify and investigate security incidents.
https://github.com/MHaggis/ADTrapper
Defence
How we proactively defend our environments.
49,000 Patches – Real-World Vulnerabilities Dataset Updated
Cédric Bonhomme updates which is being used in CWE guesser
We’ve updated our dataset of real-world vulnerabilities, now enriched with CWE identifiers and patches collected from platforms like GitHub, GitLab, Bitbucket.
This dataset is designed to support the development of tools for vulnerability classification. Dataset features are:
- CVE/GHSA ID
- Title of the vulnerability
- Vulnerability description
- Patches (URL, Commit message, and Base64-encoded unified diff)
https://huggingface.co/datasets/CIRCL/vulnerability-cwe-patch
OID-See: Giving Your OAuth Apps the Side-Eye
Graham Gold provides a powerful capability to cyber defence teams to understand their third party exposure through integrations.
OID-See is a comprehensive security analysis tool for Microsoft Entra ID (Azure AD) that helps you discover, analyze, and visualize risky third-party applications. The scanner collects data using Microsoft Graph, performs optional enrichment, and generates an interactive graph visualization that runs entirely in your browser—no telemetry, no servers, completely private.
https://cirriustech.co.uk/blog/oidsee/
https://github.com/OID-See/OID-See/tree/v1.0.0
Gixy-Next: NGINX Configuration Security Scanner & Performance Checker
Joshua Rogers releases a powerup which various vendors who integrate this technology would also likely benefit from running..
Gixy-Next (Gixy) is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls before they reach production.
https://github.com/MegaManSec/Gixy-Next
List Browser Extensions
Bert-Jan Pals releases releases a script useful for when you need to need to understand but don’t have a solution already in place..
This script fetches installed browser extensions for the supported browsers and displays them in the terminal.
Incident Writeups & Disclosures
How they got in and what they did.
Legal Aid Agency cyber security incident
Just to highlight the exemplar nature of updates provided here including one this week - https://www.gov.uk/guidance/legal-aid-agency-cyber-security-incident#full-publication-update-history
Vulnerability
Our attack surface.
WhisperPair
This is going to be a gift which keeps on giving for a while for adversaries with proximal access to devices. Also interesting that Pixel Buds themselves where vulnerable.
Hijacking Bluetooth Accessories Using Google Fast Pair
https://whisperpair.eu/vulnerable-devices
Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691)
Watchtowr do what they spicily do with a vulnerability we have previously covered here.
While not telepathic, this is curious - does it imply that this vulnerability was silently fixed almost 3 months before disclosure, and customers of this solution had to wait approximately 2.5 months for the official information that the not-so-critical CVSS 10 vulnerability had been identified and fixed - and that they should likely update with urgency?
Offense
Attack capability, techniques and trade-craft.
Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation
Mandiant adopt a potentially watch the world burn strategy to accelerating protocol depreciation.
By releasing these tables, Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1. While tools to exploit this protocol have existed for years, they often required uploading sensitive data to third-party services or expensive hardware to brute-force keys. The release of this dataset allows defenders and researchers to recover keys in under 12 hours using consumer hardware costing less than $600 USD. This initiative highlights the amplified impact of combining Mandiant's frontline expertise with Google Cloud's resources to eliminate entire classes of attacks.
https://cloud.google.com/blog/topics/threat-intelligence/net-ntlmv1-deprecation-rainbow-tables
EDRStartupHinder: EDR Startup Process Blocker
Zero Salarium further highlights this attack surface of cyber security products on Windows (but not unique to Windows in concept).
Antivirus/EDR services, while well-protected by kernel-level drivers, are essentially just Windows services and processes. Instead of targeting these services directly, attackers can focus on the one area that any Windows process must utilize: System32.
https://www.zerosalarium.com/2026/01/edrstartuphinder-edr-startup-process-blocker.html
Beyond Graph API: Exploring ConsentFix Through the Exchange REST API Lens
Tasos Chatziefstratiou highlights another dark corner to consider..
While most security discussions around OAuth abuse in Microsoft ecosystems focus heavily on Azure CLI and Microsoft Graph API — the common combination for accessing Microsoft 365 data — there’s an alternative first-party application that offers attackers a different route into your organization: Microsoft Exchange REST API Based PowerShell, targeting the Office 365 Exchange Online resource.
getSPNless
Jarno van den Brink a tool which teams will what to develop signature for.
Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account.
https://github.com/jarnovandenbrink/getSPNless
Obfusk8: C++17-Based Obfuscation Library
Zakaria / x86byte releases a technically interesting approach which will be interesting to see the implication of.
Obfusk8 is a lightweight, header-only C++17 library designed to significantly enhance the obfuscation of your applications, making reverse engineering a substantially more challenging endeavor. It achieves this through a diverse set of compile-time and runtime techniques aimed at protecting your code's logic and data.
https://github.com/x86byte/Obfusk8
NoDPI
Theo Telcontar and Shamil Mukhumaev release a capability which could have real impact on cyber defence teams if underlying tool is fragile and unable to cater with these approaches.
Random fragmentation (by default)
Clienthello is divided into several parts of random length. Each part is glued with the prefixes of the type of Clienthello and then all this is sent in one package.
Fragmentation by SNI
In the package there is a field containing SNI record. ClientHello is divided into 4 parts: to SNI, the first and second half of SNI, and all that is after it. The title indicating the type Clienthello is attached to each part and then all this is sent in one bag.
https://github.com/GVCoder09/NoDPI
Exploitation
What is being exploited..
Nothing overly of note this week
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
OpenSSL Performance Still Under Scrutiny
Ivan Ristić highlights something I hadn’t appreciated..
For a very long time, this was not something that was talked about. There were issues on the OpenSSL tracker, but only those who experienced these performance issues would find them. Eventually, the HAProxy developers wrote an extensive article on the state of SSL libraries in general and OpenSSL in particular. The message was clear: Stay away from OpenSSL 3.x if you care about performance.
https://www.feistyduck.com/newsletter/issue_132_openssl_performance_still_under_scrutiny
VMProtect Devirtualization: Part 2
hackyboiz does some excellent work and shows once again anything is possible if you have the skill and determination.
I will conclude with a screenshot showing the successful devirtualization. For the virtualized target function, I patched
vir_Entryso that it jumps directly into the native code block I generated instead of the VMP dispatcher.
https://hackyboiz.github.io/2025/12/11/banda/VMPpart2/en/
Predator’s kill switch: undocumented anti-analysis techniques in iOS spyware
Jamf Threat Labs dig into the anti-forensics capability of this commercial impact which will be of interest..
This function uses kqueue to monitor the CrashReporter directory for any new files. When a crash occurs that might expose Predator’s presence, the handler processes or removes the crash log before it can be synced or examined.
https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites - “In this document, the EDPB provides recommendations to the controllers operating in the e-commerce sector on the conditions under which they may lawfully require their users to create an account under Articles 5(1)(a) and 6 GDPR”
Multi-stakeholder perspectives on governing innovation in the digital afterlife - “Stakeholders acknowledged the various motivations and purposes of digital re-creations, which governance should be sensitive to. Our findings suggest governance principles that include proportionality (in relation to purpose and use), dignity (of the deceased) and protection from harm for those interacting with digital re-creations, particularly for the vulnerable, e.g. minors and those who may be grieving.”
Stacking Up for Resilience - Digital Public Infrastructure: The India Way
Artificial intelligence
Fundamental
Applied non-cyber
Applied cyber specific
TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning - from 2024
Call for papers: AI-driven threat detection and response Collection
Cybersecurity AI: A Game-Theoretic AI for Guiding Attack and Defense
OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs
Cyberattack Detection in Virtualized Microgrids Using LightGBM and Knowledge-Distilled Classifiers
Detection of multi-vector attacks in IoT networks: a graph attention network-based approach
ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation
The Agent Security Paradox: When Trusted Commands in Cursor Become Attack Vectors
The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multi-Step Malware
Books
Events
Resources for Ransomware Risk Management - NIST event - January 28, 2026
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.