Loading story…
Several cybersecurity news outlets and newsletters provided updates on recent developments in detection engineering, vulnerability disclosures, and threat intelligence. Notable highlights include the release of new detection rules for phishing, malware, and defense evasion tactics, as well as coverage of significant vulnerabilities such as a Windows Kernel elevation of privilege (CVE-2025-62215), Cisco ASA/FTD VPN bugs, and Citrix NetScaler issues. Additionally, there is discussion of the use of AI agents in security operations and the challenges of integrating such technologies into existing workflows.
The updates also mention the addition of a large corpus of breached data to Have I Been Pwned, the emergence of new Android spyware targeting Samsung devices, and the ongoing evolution of detection rules across platforms like Elastic, Splunk, Sigma, and YARA. These weekly digests aim to keep security professionals informed about the latest threats, detection strategies, and operational changes in the cybersecurity landscape.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Detection Engineering Weekly reported the discovery of LANDFALL, an Android spyware strain targeting Samsung devices through a DNG exploit chain. The disclosure added new technical details about the malware and its targeting.
Detection Engineering Weekly reported that a former L3Harris cyber executive pleaded guilty to selling trade secrets to a Russian firm. The plea is a discrete legal development involving cyber-related intellectual property theft.
Detection Engineering Weekly reported the indictment of two U.S. nationals accused of acting as initial access brokers for BlackCat ransomware operations. The legal action represents a law-enforcement development tied to the ransomware ecosystem.
Detection Engineering Weekly cited reporting from Google Threat Intelligence Group that threat actors are increasingly using LLM-based tools. This marked a notable shift in attacker tradecraft discussed in the coverage.
Detection Engineering Weekly highlighted Google's use of AI agents in security operations as a notable development in defensive practice. The report positioned agentic workflows and AI-assisted detection engineering as an emerging operational trend.
Detection Engineering Weekly reported a critical AWS Trusted Advisor bypass discovered by Fog Security. The reference presents the bypass as a newly surfaced security finding in the reporting period.
WatchTowr Labs published technical details on a Citrix NetScaler vulnerability tracked as CVE-2025-12101, describing a memory leak and reflected XSS condition. The disclosure framed the issue as distinct from prior 'CitrixBleed'-style bugs but still security-relevant.
Between 2025-11-03 and 2025-11-10, maintainers updated detection content across 14 GitHub repositories, adding 26 new rules and modifying 38 existing ones. The changes expanded coverage for phishing, Windows malware, defense evasion, cloud IAM risks, suspicious process and network activity, and privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
detectionengineering.net
Open sourcetroyhunt.com
Open sourceblog.alphahunt.io
Open sourcelabs.watchtowr.com
Open sourcedetections-digest.rulecheck.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A roundup of recent developments in information security and detection engineering highlights both evolving cyber threats and the community's response through updated detection rules. Notable news includes AI-powered cyber attacks targeting Russian arms firms, concerns over open-source software supply chain risks raised by U.S. Senate leadership, and the increasing use of automated data analysis in government enforcement. These stories underscore the growing sophistication of threat actors and the need for vigilance in both public and private sector cybersecurity. In parallel, detection engineering teams released 19 new and 87 updated rules across major platforms such as Sigma, Splunk, YARA, KQL, Elastic, and Sublime Security. Key improvements include expanded phishing detections for services like Monday.com and SendGrid, enhanced rules for defense evasion using Windows processes, and refined cloud threat detection for AWS and Azure environments. These updates aim to improve threat coverage and operational efficiency in response to the latest attack techniques and adversary behaviors.
Jun 29, 2026
Detection engineering teams released several new and updated detection rules across multiple platforms, including YARA, KQL, Fibratus, and Elastic, to address emerging threats. Notable additions include YARA rules for identifying VMware ESXi exploit payloads and the CoralWave loader, which masquerades as a Lenovo DLL to deploy Remcos RAT. Updates to Fibratus rules enhance detection of credential access, MS Office attack chains, and defense evasion techniques, while Elastic introduced a higher-order rule to correlate multiple EDR alerts from the same process tree, improving the identification of related malicious activities. In parallel, recent malware and threat intelligence newsletters highlighted a range of active campaigns and vulnerabilities, such as DNS poisoning by Evasive Panda APT to deliver MgBot, supply chain attacks involving EmEditor and Trust Wallet, and the spread of the RondoDoX botnet exploiting React2Shell. Other reports covered the evolution of APTs like HoneyMyte and Mustang Panda, major data breaches, and the exploitation of critical vulnerabilities like MongoBleed. These updates underscore the rapidly evolving threat landscape and the need for continuous improvement in detection capabilities.
Jun 29, 2026
A weekly threat-intelligence roundup highlighted **Microsoft’s January Patch Tuesday** release addressing **112 vulnerabilities** across Windows and *Microsoft Edge*, spanning multiple classes including elevation of privilege, remote code execution, and information disclosure. The same briefing reported active interest in **CVE-2025-64155**, a **critical FortiSIEM** vulnerability, with observed exploitation activity against honeypot environments following an out-of-band alert from Kroll Threat Intelligence—an indicator of likely broader scanning and attempted exploitation. The update also covered multiple threat developments: Check Point research described **VOIDLINK**, a Linux-focused malware framework (implants/rootkits/loaders) designed for long-term access, including in cloud environments; **North Korean-linked KTA082 (Kimsuky/APT43)** was reported using **QR-code phishing (“quishing”)** to target government, education, and think tanks; and **Iran-linked KTA060 (MuddyWater)** was associated with development of the **RUSTYWATER RAT**. Separately, detection-engineering updates noted new and refined rules for **OAuth/Entra ID consent phishing** patterns (including *ConsentFix*-style authorization flows), correlations between Entra ID risk events and privileged actions (e.g., PIM elevation/device-code auth), Windows persistence/defense-evasion behaviors (e.g., scheduled tasks by unsigned executables, Chrome security feature tampering), and updated YARA/behavioral detections for malware families (e.g., **Agent Tesla**, **MintsLoader**) and **Cobalt Strike** TTPs; the briefing also referenced a leak of a database purportedly containing ~**324,000 BreachForums** user records posted to `shinyhunte[.]rs`.
Jun 29, 2026