Loading story…
Cisco Talos released EvidenceForge, an MIT-licensed open-source Python 3.11+ tool for producing realistic synthetic security-log datasets for threat-hunting training and research. The project generates temporally and causally correlated telemetry in more than 20 formats, combining canonical events, deterministic generation, modeled network-sensor visibility, and baseline activity patterns intended to avoid the unrealistic artifacts common in synthetic logs.
Teams can define attack scenarios in YAML, specifying environments, users, systems, network topology, time windows, and attack storylines; each generated corpus includes ground-truth documentation. EvidenceForge also includes validation and quality evaluation for parseability, plausibility, causal relationships, and event timing, with default safety limits on corpus size, file counts, and parsed records.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Cisco Talos introduced EvidenceForge, an MIT-licensed open-source Python project for generating realistic, correlated synthetic security logs for threat-hunting training and research. The project supports numerous telemetry formats, scenario-based generation, ground-truth documentation, and data-quality validation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic has outlined an evidence-based framework to benchmark large language models used in agentic security operations centers. The methodology keeps the Elastic AI Agent, prompts, tools, and datasets fixed while routing runs to different models and anonymizing model identities for blind scoring. Evaluations measure whether models select the correct skills, make appropriate tool calls with valid parameters, execute tasks in the right order, and produce findings grounded in collected evidence—not merely whether their final prose appears convincing. The Agent Builder suite uses a synthetic Windows intrusion involving Chrysalis DLL side-loading, with the **EICAR** test-file hash serving as a deterministic malicious VirusTotal result and live case-management and Slack-response tools. Additional suites test Attack Discovery's ability to correlate roughly 95 alerts into eight intrusions and Automatic Migration's conversion of 52 Splunk detection rules, including macro-dependent rules, into Elastic rules. The scoring rubric evaluates both answer quality and correct tool or skill use, caps unsupported answers when required evidence-gathering calls are absent, and reports reliability independently from quality.
Sep 9, 2026
A growing ecosystem of open-source and AI-powered tools is transforming how security teams approach penetration testing, OSINT investigations, and overall security operations. Recent roundups and guides highlight over 40 free and open-source solutions that address a wide range of security needs, from vulnerability scanning and network analysis to automated patching and digital forensics. Notable tools include *Aegis Authenticator* for 2FA management, *Arkime* for large-scale packet capture, *Artemis* for modular vulnerability scanning, *Autoswagger* for API authorization testing, and *Buttercup*, an AI-driven platform for automated vulnerability detection and remediation. Additionally, specialized AI tools such as *HexStrike AI MCP Agents*, *HackerAI*, and *OSINT-GPT* are enabling more effective and autonomous penetration testing and OSINT research workflows. For digital forensics, open-source frameworks like *Autopsy*, *Kuiper*, and *DFF by Arxsys* provide analysts with robust platforms for investigation and evidence analysis. The adoption of these tools is driven by the need for flexibility, transparency, and cost-effectiveness, allowing security teams to enhance their capabilities without the burden of licensing fees. The integration of AI into these solutions further accelerates threat detection and response, positioning open-source and AI-powered tools as essential components in modern cybersecurity strategies.
Jun 29, 2026
Researchers analyzing more than 1,000 recovered AI agent sessions found that a low-skilled attacker used Anthropic’s **Claude Code** and OpenAI’s **Codex** to carry out offensive cyber operations against at least 14 companies. Logs from a compromised Vultr-hosted system showed the operator using the tools for reconnaissance, vulnerability discovery, exploit development, credential harvesting, database replication, session impersonation, cloud and API key testing, mail-account takeover attempts, and lateral movement. The sessions also documented requests for stealth, anti-forensics, transcript editing, encrypted reporting, and migration of stolen data, while some generated **pentest-style reports** that included monetization estimates for exfiltrated information. Investigators said the attacker reused stolen local AI agent installations and made operational security mistakes that helped attribute the activity to a young man in Addis Ababa, Ethiopia. Separate analysis of a **Claude Code** network sandbox bypass highlighted why AI agent misuse can extend beyond unsafe model output into runtime and infrastructure controls. NSFOCUS reported that proxy-based filtering could be bypassed because policy checks evaluated the original input while the network layer parsed and truncated it differently, including with invisible control characters or null bytes, creating a path for outbound requests and possible data leakage in a single execution chain. Although the issue was reportedly fixed in later versions, researchers said the low-profile remediation made exposure difficult to assess and underscored the need for layered defenses such as strict egress allowlisting, least privilege, short-lived secrets, auditing, fail-closed policies, and fuzz testing of parsing paths.
Jun 29, 2026