// INTEL ARCHIVE //
Authorized digital forensics and threat intelligence repository. Auto-updated daily with verified releases and digests.
DAILY INTELLIGENCE BRIEF
DFIR Articles
An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July.
DFIR Articles
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation Dutch authorities have arrested Pepijn van der Stap, a convicted cybercriminal who used the online name “Umbreon,” on suspicion of helping the ShinyHunters group steal data and extort victims.
DFIR Articles
Hackers accessed Bitget's security devices and wallets in a Sept. 24 breach, per Mandiant report pluang.com
DFIR Articles
Microsoft is taking Windows Subsystem for Linux beyond just running Linux distributions, as WSL Containers is now generally available. [...]
DFIR Articles
The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group's alleged leaders. [...]
DFIR Articles
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. [...]
DFIR Articles
Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft.
DFIR Articles
A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. [...]
DFIR Articles
Citrix NetScaler exploitation began days before public notification Cybersecurity Dive
DFIR Articles
Trust is not a feature. It is the foundation. MSAB
DFIR Articles
Switching to MSAB made simple and safe MSAB
DFIR Articles
Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub.
DFIR Articles
We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities.
DFIR Articles
This new proactive service joins the suite of retainer offerings to provide dedicated, intelligence-led hunting specifically for your organization’s most high-value IT assets.
DFIR Articles
Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group.
DFIR Articles
Click the source link to read the full dispatch.
DFIR Articles
Oracle Stock Slips as Google's Mandiant Flags PeopleSoft Breach - Oracle (NYSE:ORCL) benzinga.com
Forensics
NJIT’s Sara Zapico named National Higher Education Forensic Science Educator of the Year EurekAlert! Science News Releases
Forensics
Histopathological Analysis of the Spectrum of Forensic Pathology Lesions Over Two Years From a Tertiary Care Centre in Kerala: A Descriptive Study The Cureus Journal of Medical Science
Forensics
Forensic Sciences MDPI
Forensics
Dr. Madelyn Kist welcomed into Forensic Science program luc.edu
Forensics
Arkansas Launches Rapid DNA Profiling at Participating Booking Stations NEA Report
Forensics
Communities across the country are debating the role mobile crisis response programs can play in emergency response.
CVE & Vulnerabilities
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Mirai. Type: sha256_hash. Threat Category: payload. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Mirai. Type: sha256_hash. Threat Category: payload. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Mirai. Type: sha256_hash. Threat Category: payload. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Mirai. Type: sha256_hash. Threat Category: payload. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Mirai. Type: sha256_hash. Threat Category: payload. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Unknown malware. Type: url. Threat Category: payload_delivery. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for Unknown malware. Type: url. Threat Category: payload_delivery. Reporter: whack_sh.
IOC Feed
ThreatFox reported a new active indicator of compromise (IOC) for ClearFake. Type: domain. Threat Category: payload_delivery. Reporter: anonymous.
CVE & Vulnerabilities
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
CVE & Vulnerabilities
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
CVE & Vulnerabilities
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I. This issue affects Mint Workbench I: through 5876.
CVE & Vulnerabilities
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
CVE & Vulnerabilities
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
CVE & Vulnerabilities
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.
CVE & Vulnerabilities
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
CVE & Vulnerabilities
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
Research Papers
Photographic evidence is becoming increasingly vulnerable to forms of alteration and fabrication that existing legal and technical workflows are not well equipped to evaluate.
Research Papers
Localizing AI-edited regions is essential for interpretable forensic analysis, but remains challenging due to subtle and spatially distributed artifacts that are misaligned with semantic or object boundaries.
Research Papers
Continual audio deepfake detection requires learning newly emerging deepfake methods while retaining discrimination of previously encountered speech.
GitHub Releases
Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). [...]
Malware Intelligence
Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]
CVE & Vulnerabilities
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]
GitHub Releases
Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it. [...]
CVE & Vulnerabilities
A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors.
CVE & Vulnerabilities
Kiteworks on Monday said it worked with federal intelligence authorities over the weekend as it identified and addressed a critical security vulnerability during the scheduled precautionary shutdown.
Malware Intelligence
Meta’s Muse sent a Facebook Marketplace buyer to a seller’s home Malwarebytes
Malware Intelligence
Update your iPhone, iPad, or Mac: Flaw could run attackers’ code Malwarebytes
GitHub Releases
A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory.
GitHub Releases
OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence (AI) model that was planned for an October launch, after it failed internal safety and alignment audits.
Malware Intelligence
A week in security (September 21 – September 27) Malwarebytes
GitHub Releases
Wireshark 4.6.9 Released SANS Internet Storm Center
The database query returned 0 active intelligence feeds.
Try adjusting your filters, searching for other keywords, or bookmarking articles to view them here.
ARCHIVE INTELLIGENCE OVERVIEW
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //
// DAILY INTEL BRIEF //