#yara#awesome_list#blueteam#blueteam_tools#cti#detection#detection_engineering#dfir#hacktools#incident_response#ioc#iocs#ir#ransomware#redteam#rmm#security#siem#soc#threat_hunting#threat_intelligence
You can access comprehensive security detection lists and threat hunting resources that help identify malicious activity across your infrastructure. These curated collections include indicators like suspicious file hashes, domain names, IP addresses, and behavioral patterns organized by threat type—from ransomware and phishing to command-and-control servers and vulnerable drivers. By integrating these lists into your security tools like SIEM platforms and endpoint detection systems, you gain immediate visibility into known threats while learning detection methodologies through guides and YARA rules. This accelerates your ability to hunt for compromises, validate security controls, and stay current with emerging attack techniques without building detection logic from scratch.
https://github.com/mthcht/awesome-lists
http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
#security
This should have been obvious to me for a longer time, but until earlier today I did not really realize the severity of the issues caused by str.format on untrusted user input. It came up as a way to bypass the Jinja2 Sandbox in a way that would permit retrieving information that you should not have access to which is why I just pushed out a security release for it.
However I think the general issue is quite severe and needs to be a discussed because most people are most likely not aware of how easy it is to exploit.
🛑 A SystemBC-linked server exposed 1,570+ infected systems, mostly corporate.
An affiliate of The Gentlemen #ransomware used the proxy malware for covert access and staging—not all were confirmed ransomware victims.
🔗 Read → https://thehackernews.com/2026/04/systembc-c2-server-reveals-1570-victims.html
🛑 Qilin and Warlock #ransomware are disabling defenses before attacks using BYOVD techniques.
Qilin uses a side-loaded DLL to kill 300+ EDR drivers via vulnerable kernel drivers. Warlock exploits SharePoint and uses similar drivers to bypass kernel-level security, often delaying ransomware execution.
🔗 Find the technique disabling EDR tools → https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html
🔥 Germany’s BKA has identified a key figure behind the REvil #ransomware group.
Daniil Shchukin (“UNKN”) is accused of leading REvil, linked to 130 attacks in Germany causing over €35.4M in damage, with €1.9M in ransom paid.
🔗 Learn more here → https://thehackernews.com/2026/04/bka-identifies-revil-leaders-behind-130.html
⚡ A Russian botnet operator tied to #ransomware attacks on U.S. firms has been sentenced.
2 years prison + $100K fine for co-running TA551, which sold access to hacked systems used by gangs like BitPaymer, leading to $14M+ in extortion.
🔗 How TA551 enabled ransomware attacks on 70+ companies → https://thehackernews.com/2026/03/russian-hacker-sentenced-to-2-years-for.html
Five attacks. Five lessons. One goal: resilience.
From Boeing to Ascension, cybersecurity experts from Halcyon examined #ransomware incidents that reshaped cyber strategy - and the takeaways defenders can apply today.
Curious which decisions changed the outcome? Swipe → to see the high-level hits.
Don’t wait for an incident to learn from one.
Download the full guide: https://thn.news/5-attacks-lessons
Five attacks. Five lessons. One goal: resilience.
From Boeing to Ascension, cybersecurity experts from Halcyon examined #ransomware incidents that reshaped cyber strategy - and the takeaways defenders can apply today.
Curious which decisions changed the outcome? Swipe → to see the high-level hits.
Don’t wait for an incident to learn from one.
Download the full guide: https://thn.news/attacks-changed-everything
🤦 Hackers built #ransomware — then left the key behind.
CyberVolk’s new VolkLocker targets 💻 Windows and 🐧 Linux.
The flaw? the lock key is hard-coded and saved as a plain file on the system.
Files can be unlocked for free — but after 48 hours, it can wipe 🗑️ personal folders.
🔗 Read: https://thehackernews.com/2025/12/volklocker-ransomware-exposed-by-hard.html