Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
91 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_f9879f264b7a8ec1d7Recent successful batchLast successful batch: Last attempt:
intelligence_src_fb6a3ec633d94a60b2Recent successful batchLast successful batch: Last attempt:
intelligence_src_fcdfb37baec473935cRecent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
SAN FRANSICO, Sept. 25, 2026, CyberNewswire — Archipelo today announced Salmon, Execution Verification Infrastructure (EVI) for AI agents and autonomous systems, powered by a cryptographic protocol designed to make execution history verifiable. Salmon establishes verifiable execution history and state … (more…) The post News alert: Archipelo launches Salmon to create verifiable audit trails for AI agent activity first appeared on The Last Watchdog.
First reported Sep 29, 2026 18:15 UTCCatalog metadata updated Oct 13, 2026 05:22 UTCOpen evidence record
TORONTO, Oct. 8, 2026, CyberNewswire – Insignary Inc. today announced the general availability of Insignary Clarity AIR, a source-code scanning product built to answer a question most security teams can’t currently answer with confidence: what is actually running in their … (more…) The post NEWS ALERT: Insignary launches Clarity AIR to expose hidden open-source and AI-generated code first appeared on The Last Watchdog.
First reported Oct 08, 2026 23:19 UTCCatalog metadata updated Oct 13, 2026 05:22 UTCOpen evidence record
Security teams are being told they have hours to patch. Related: AI agents have a Lord of the Flies problem The warning has a real basis. In June, Anthropic’s frontier red team demonstrated an AI model building working exploits from … (more…) The post SHARED INTEL Q&A: AI finds flaws faster — defenders still need to fix what attackers exploit first appeared on The Last Watchdog.
First reported Sep 30, 2026 10:02 UTCCatalog metadata updated Oct 13, 2026 05:22 UTCOpen evidence record
Nobody picked the browser to run the workplace. It just happened. Related: The year of the enterprise browser HTML5 matured. SaaS spread. One business application after another moved into a tool designed to browse the public internet. Security and privacy … (more…) The post BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary first appeared on The Last Watchdog.
First reported Sep 21, 2026 13:15 UTCCatalog metadata updated Oct 13, 2026 05:22 UTCOpen evidence record
The network’s job has always been simple: watch the traffic. Authority stopped there. Related: AI agents have a Lord Of The Flies problem For decades, network traffic came from something physical: a server, a laptop, a badge reader, a printer, … (more…) The post Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer first appeared on The Last Watchdog.
First reported Sep 23, 2026 10:32 UTCCatalog metadata updated Oct 13, 2026 05:22 UTCOpen evidence record
SILVER SPRING, Md., Oct. 6, 2026, CyberNewswire — Aembit, the identity control plane for AI agents, today announced support for securing personal agents’ access to enterprise environments, available immediately to existing customers at no additional cost. As personal agents, … (more…) The post News alert: Aembit gives enterprises new controls over personal AI agents accessing sensitive systems first appeared on The Last Watchdog.
First reported Oct 06, 2026 21:58 UTCCatalog metadata updated Oct 13, 2026 05:22 UTCOpen evidence record
On October 5th, Atlassian published patches&#;x26;#;xc2;&#;x26;#;xa0;for multiple products to fix an "Arbitrary File Access" vulnerability &#;x26;#;x5b;CVE-2026-21589&#;x26;#;x5d;. An attacker can read arbitrary files in the web application&#;x26;#;39;s directory, potentially exposing sensitive information such as configuration files.
First reported Oct 07, 2026 14:59 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
First reported Oct 06, 2026 13:16 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record
The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far).
First reported Oct 10, 2026 09:11 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8&#;x26;#;xc2;&#;x26;#;xa0;of the most popular AI coding assistants and&#;x26;#;xc2;&#;x26;#;xa0;agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I&#;x26;#;39;ve been using Claude Code and a little bit of Codex, but I also have recently been playing with OpenCode and am setting up Hermes. I decided to figure out where the chat history was in OpenCode and where any Hermes evidence might be located.
First reported Oct 08, 2026 16:52 UTCCatalog metadata updated Oct 13, 2026 05:20 UTCOpen evidence record
Tổng hợp bởi AI Link gốc: https://archives.phrack.org/dl/73/halvar-flake-prophile.pdf Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: 📖 PHRACK #73 PROPHILE — Halvar Flake | 0day in {REA_TEAM} 1 post - 1 participant Read full topic
First reported Oct 11, 2026 16:01 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
How to detect Azure Monitor transformation drops before they create blind spots in your security monitoring.Every hunt, detection rule and investigation starts with one assumption: the data in your workspace shows what actually happened.But it doesn’t always. It only shows the data that made it through the pipeline.That pipeline has a filter that many security teams have never reviewed. They may not know how much data it drops or monitor it for changes. If someone changes the filter, important events may stop reaching your tables. No alert fires because the data needed to trigger it is missing. Those events were dropped before they were ever stored.The good news is that dropped data leaves clues, just not where you would normally look.This article explains where the filter lives, why it sits outside the SOC’s usual view and which signals you can monitor to catch both malicious changes and simple configuration mistakes.Understanding Data TransformationsIn Azure Monitor and Microsoft Sentinel, data does not go straight from the source into your workspace. It first passes through a Data Collection Rule (DCR).The DCR decides what data to collect, how to change it and where to send it.One part of the DCR is the transformation. This is a KQL query that runs on every record as it arrives, before the record is written to a table. Microsoft defines the order clearly the transformation runs after the source sends the data and before it reaches the destination.Transformations are useful. You can drop noisy data you do not want to pay to store, remove columns you do not need or reshape logs into a common format. Microsoft recommends them for cost control, and in normal use they make sense.Here is the part of the DCR that matters:{ "dataFlows": [ { "streams": [ "Microsoft-Syslog" ], "destinations": [ "MyWorkspace" ], "transformKql": "source | where SeverityLevel != 'info'", "outputStream": "Microsoft-Syslog" } ]}The key line is transformKql. It is a KQL query stored in the configuration and every record must pass through it.In this example, it drops informational syslog messages. That is cheap, sensible and something nobody would question.But watch what happens when one extra line is added.The one-line blind spotStart with a transformation nobody would look at twice. It drops debug logs.source | where LogLevel != "DEBUG"Add one more condition.source| where LogLevel != "DEBUG"| where SourceIP != "10.20.20.20"Every event from that IP is now gone. It is not hidden in a table you can still query and it is not moved to a cheaper storage tier. It is removed before anything is written.No detection rule can alert on it, because rules query tables and the record never reached the table.An attacker using that IP address becomes invisible. And the thing hiding them is just one line in a configuration file.A transformation can quietly remove one column that your detection depends on.In that case, the events still arrive. The row count looks normal and nothing appears missing at first glance. But the field your rule relies on is blank in every record. The detection still runs, finds nothing and reports that everything is healthy.The Blind Spot Before the SOCA normal attacker with admin rights has to take action, generate logs and then clean up afterwards. That cleanup is still an action and it leaves traces. Purging a table, changing retention or deleting records are all things a decent SOC can detect.A transformation works differently. It acts before the log is created. There is no “after” to clean up.The evidence is not deleted. It is never stored in the first place. And you cannot write a detection for the deletion of something that never reached your tables.That is why whoever controls the DCR sits above the SOC not inside it.The SOC studies the data it receives. The DCR decides which data reaches the SOC. One controls
First reported Oct 10, 2026 20:25 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
오늘은 Snake Keylogger 계열 도면 문의의 건으로 위장한 키로그 악성코드 에 대해서 알아보겠습니다.파일명:도면 문의의 건.js사이즈:2 MBMD5:e89c8668c8b5041768a59c1532edf2adSHA-1:e66eead0b75cbc01f0f35f4a8394266a8bf2a380SHA-256:079932.. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: Snake Keylogger 계열 도면 문의의 건으로 위장한 키로그 악성코드-도면 문의의 건.js 1 post - 1 participant Read full topic
First reported Oct 11, 2026 17:01 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
Ritzau has more on the Denmark Central Person Register (CPR) breach: At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access… Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Source Article Link: https://databreaches.net/2026/10/10/123456-password-used-in-massive-danish-cpr-data-breach/ 1 post - 1 participant Read full topic
First reported Oct 10, 2026 20:55 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.Then you asked your AI assistant to summarize your inbox.Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?That’s the risk behind phishing emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. Recent research from Barracuda describes emails designed to target both audiences at once.For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.How prompt injection worksPrompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.The malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.That means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.Apollo Raines, developer of the AI code review service ShipItClean, explains:“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”He adds:“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”Before taking actionAn assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.An assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose sensitive information.You don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.The familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account det
First reported Oct 12, 2026 11:20 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
<p>A Canadian cybersecurity executive who built a career helping organizations recover from cyberattacks has been arrested on federal extortion charges, a case that may be linked to the FBI&rsquo;s pursuit of the ShinyHunters hacking group that pilfered troves of bureau employee data.&nbsp;</p> Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <p>Edward &ldquo;Ed&rdquo; Dubrovsky, 54, faces charges of conspiring to extort money by threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion, according to<a href=“https://www.courtlistener.com/docket/74942095/united-states-v-dobrovsky/”> court records</a>. He appeared Thursday in federal court in Philadelphia, where a magistrate judge ordered him transferred to the Eastern District of Texas. Prosecutors are <a href=“https://storage.courtlistener.com/recap/gov.uscourts.paed.663480/gov.uscourts.paed.663480.3.0.pdf”>seeking his detention</a> pending trial.</p> <p><a href=“FBI Arrests Founder of Ransomware Negotiation Firm – Krebs on Security”>KrebsOnSecurity first identified Dubrovsky</a> on Friday night, citing sources linking his arrest to the ShinyHunters investigation. The New York Times had earlier reported that an unnamed Canadian man arrested in Pennsylvania was suspected of assisting the group, which claimed responsibility for a September breach exposing sensitive information about FBI employees.&nbsp;</p> <p>The complaint detailing the allegations against Dubrovsky remains sealed. His specific alleged conduct, including any role in the FBI intrusion linked to ShinyHunters, has not been publicly established.</p> <p>The arrest brings scrutiny to an executive whose professional reputation rested on helping victims navigate cyber incidents. Dubrovsky held leadership positions at incident-response companies, taught cybersecurity courses and recently published a book about how organizations should handle extortion incidents.&nbsp;</p> <p>He<a href=“Cyber Security Just Got Stronger As Iconic Operator Ed Dubrovsky Joins CYPFER”> joined CYPFER in 2022</a> to lead consulting and threat intelligence operations and later served as its chief operating officer and managing partner. The company&rsquo;s announcement described him as a veteran of three decades in cybersecurity and technology who had helped thousands of organizations recover from attacks and advised executives, lawyers and insurance carriers.&nbsp;</p> <p>Before that, Dubrovsky headed cyber breach response at Cytelligence, which Aon acquired in 2020. A<a href=“https://continue.yorku.ca/event/cyber-webi-s21-ondemand/”> York University biography</a> identified him as Cytelligence&rsquo;s chief operating officer and Aon&rsquo;s Canadian cyber leader. He also taught courses in cybersecurity engineering and security assessment and testing.&nbsp;</p> <p>More recently, Dubrovsky publicly promoted his work with CyberSteward, including ransomware negotiations and extortion advisory services. In a<a href=“https://ca.linkedin.com/in/edubrovs”> LinkedIn post</a> ahead of the NetDiligence Cyber Risk Summit in Philadelphia this month, he said he planned to attend with the company&rsquo;s team.&nbsp;</p> <p>FBI Director Kash Patel announced Friday that the bureau had <a href=“FBI arrests another ShinyHunters suspect after massive breach of employee data - Nextgov/FCW”>arrested</a> another suspected ShinyHunters co-conspirator, without naming the person or disclosing charges. Canadia
First reported Oct 10, 2026 16:20 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
﷽ Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Hello, cybersecurity enthusiasts and white hackers! In part 1 we reversed the WAMR .aot container from real bytes and wrote unaot - a tiny, dependency-free C parser that verifies the \0aot magic, walks the section table (handling the 4-byte alignment rule), and decodes TARGET_INFO so we know exactly which CPU the embedded TEXT blob is compiled for. That told us where the native code is and how to disassemble it. But a disassembly of a few hundred anonymous functions is nearly useless. What a reverse engineer actually wants is names: which blob of machine code is add, which is fib, which is the exported entry point. This part builds exactly that - a symbolized function table - by decoding two more sections, EXPORT and FUNCTION, and joining them. We will also give the tool some color so the output is readable. Still one small C file, still no libraries. the plan The information we need is split across two sections, and neither one is enough on its own: FUNCTION gives us, for every defined function, the offset into TEXT where its native code starts (and its type index). It gives us the geography - but no names. EXPORT gives us names mapped to function indices - but no offsets. The two share a key: the function index. So the whole trick of part 2 is: Decode both, join on the index, and we have a symbol table that maps every native function to a name and a precise file offset. Let’s take the sections one at a time. the EXPORT section EXPORT is the name source. Its layout (from WAMR’s aot_loader.c, load_export_section) is a count followed by that many export entries: u32 count entry[count]: u32 index (4-byte aligned) u8 kind 0=func 1=table 2=memory 3=global 4=tag str name The one part that will trip you up is how WAMR stores a string. It is not a plain C string and not a bare length-prefixed buffer. It is: u16 length (2-byte aligned) u8 bytes[length] <- the trailing '\0' IS counted in length So a name like add is stored with length = 4: the three characters a, d, d, plus a trailing NUL that is included in the count. If you print length bytes you get a stray NUL at the end; if you assume the length excludes the terminator you read one byte short on the next field and desync. We copy length bytes and then drop the last one. Here is decode_export. Note the two alignment steps - index is 4-aligned, the string length is 2-aligned - mirroring the loader’s alignment-aware reads from part 1: /* EXPORT: u32 count, then { u32 index(align4), u8 kind, string name }. * string = u16 len(align2) + len bytes (trailing '\0' counted in len). */ static void decode_export(reader_t *r, size_t body, uint32_t size) { size_t end = body + size, pos = body; uint32_t count = rd_u32_at(r, pos); pos += 4; if (r->err) { printf(" <export truncated>\n"); return; } printf(" %u export(s):\n", count); for (uint32_t i = 0; i < count; i++) { pos = align_up(pos, 4); uint32_t index = rd_u32_at(r, pos); pos += 4; uint8_t kind = rd_u8_at(r, pos); pos += 1; pos = align_up(pos, 2); uint16_t slen = rd_u16_at(r, pos); pos += 2; if (r->err || pos + slen > end) { printf(" <export %u truncated>\n", i); break; } char name[96]; size_t n = slen < sizeof(name) ? slen : sizeof(name) - 1; for (size_t j = 0; j < n; j++) name[j] = (char) rd_u8_at(r, pos + j); name[n ? n - 1 : 0] = 0; /* drop the counted trailing '\0' */ pos += slen; printf(" [%u] %-6s index=%-3u \"%s\"\n", i, export_kind_name(kind), index, name); if (kind == 0 && g_expn < MAXF) { /* remember func names for symbolization */
First reported Oct 12, 2026 05:26 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The Credit Union Cybersecurity Handbook Protect member data and essential banking services with a practical guide to credit union cybersecurity. Written for U.S. credit union security leaders, IT teams, executives, and boards, this handbook covers cyber threats, ransomware, NCUA compliance, third-party risk, and security maturity. Article Link: Validate Cyber Readiness Across Every Credit Union System 1 post - 1 participant Read full topic
First reported Oct 12, 2026 18:30 UTCCatalog metadata updated Oct 13, 2026 05:17 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.