Detection Engineering

6 articles

ResearchEducation & AcademiaHigh
Eight new ransomware brands in one week: why tracking group names has stopped working
One tracker logged 315 leak-site posts from 40 groups in a single August week, eight of them new. Brand-based detection cannot keep pace. Here is what to instrument instead.
Daniel Okafor10 Sep 2026, 19:15 IST6 min read
ThreatsGovernment & DefenceHigh
APT28 Ran Its C2 Through Filen Cloud Storage. Reputation Filtering Never Stood a Chance
Trellix says APT28 routed command-and-control through filen.io during a three-day European phishing burst. Here is the behavioural detection logic that catches it when reputation cannot.
Mei-Lin Chen10 Sep 2026, 16:40 IST6 min read
ResearchEducation & AcademiaHigh
Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away
Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
Mei-Lin Chen9 Sep 2026, 13:30 IST6 min read
ThreatsGovernment & DefenceHigh
Gunra ransomware: what AA26-222A actually gives your detection engineers
Six agencies detailed Gunra's Fortinet entry, its forticloud-sync backdoor and an MFA bypass planted in a VDI server. Here is how to turn that into detection coverage.
Daniel Okafor8 Sep 2026, 21:00 IST6 min read
GuidesIndustrial, OT & IoT
Playbook: hardening the edge appliance you cannot put an agent on
Two of this year’s fastest CISA remediation deadlines hit devices that cannot run EDR. A practical checklist for the class attackers reach for first.
Aisha Noor8 Sep 2026, 17:30 IST7 min read
ResearchEducation & Academia
Breakout time falls to 72 minutes — and most SOCs are not built for it
The 2026 benchmark from foothold to active exfiltration is 72 minutes, a fourfold reduction. Human-paced triage no longer fits inside the window.
Priya Raman5 Sep 2026, 21:30 IST7 min read

Eight new ransomware brands in one week: why tracking group names has stopped working

APT28 Ran Its C2 Through Filen Cloud Storage. Reputation Filtering Never Stood a Chance

Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away

Gunra ransomware: what AA26-222A actually gives your detection engineers

Playbook: hardening the edge appliance you cannot put an agent on

Breakout time falls to 72 minutes — and most SOCs are not built for it