# Digital forensics Published articles for Digital forensics. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## NATO's Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training DevFeed: [NATO's Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-11-03T08:49:03Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [AI in cybersecurity](), [national security](), [Local AI](), [Threat Hunting & Intel]() Tags: [agents](), [ai](), [ai-agents](), [ccdcoe](), [critical-infrastructure](), [crossed-swords](), [cyber](), [cyber-defense](), [defense](), [defensive](), [digital-forensics](), [effects](), [elastic](), [eset](), [exercise](), [government](), [human-oversight](), [nato](), [openai](), [operations](), [training](), [training-awareness]() ### AI overview Crossed Swords 2026 trains more than 250 participants from over 40 countries to coordinate cyber operations with kinetic and special operations actions, where timing may need to be measured in minutes. Its new AI-agent track has participants build, deploy, and assess agents, then operate alongside them. The exercise uses locally hosted AI and, for the first time, OpenAI's Daybreak cyber defense offering; the source does not describe how the two differ. National cyber forces also plan with civilian partners to account for critical infrastructure protection, with more than 20 industry, academic, and NGO organizations supporting the event. ### Source excerpt The NATO CCDCOE exercise in Estonia introduces AI agents and OpenAI Daybreak into joint cyber and kinetic operations training. The post NATO's Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training appeared first on SecurityWeek. ## Inside Republika Srpska's Chinese Tech Deal and Russian Influence Network DevFeed: [Inside Republika Srpska's Chinese Tech Deal and Russian Influence Network]() Original publisher: [Read original article]() Author: Digital Power Investigation Published: 2026-10-28T08:11:02Z Content type: article Language: en Sources: [HackerNoon]() Topics: [network security](), [digital sovereignty](), [national security](), [Digital forensics]() Tags: [1-5](), [2](), [2014](), [2015](), [2016](), [2017](), [2018](), [2020](), [2022](), [contracts](), [cyber](), [cybercrime](), [cybersecurity](), [deal](), [digital](), [digital-forensics](), [fbi](), [foreign-policy](), [geopolitics](), [influence](), [inside](), [insider](), [network](), [politics](), [privacy](), [propaganda](), [surveillance](), [tech]() ### AI overview Republika Srpska signed a BAM 57 million agreement with China's ELINC before establishing independent oversight, according to the supplied text. AIKT director Dražen Višnjić described a system combining Chinese technology, Russian organizational practices and Israeli training, spanning 15 locations and potentially serving institutions and businesses. He said it would protect critical infrastructure and children, not monitor communications, but the excerpt leaves configuration, access, data retention and safeguards unverified. It also reports separate accountability concerns: an AIKT advertising tender added to the procurement plan 12 minutes before notice, confirmed plans to cooperate with Russian propaganda network leader Mikhail Zvinchuk, and a sanctions-workaround questionnaire reportedly circulated from an official AIKT email account, which the agency denied sending. The text distinguishes these episodes and notes that it does not establish Višnjić's authorship of the questionnaire or that a sanctions-evasion transaction occurred. It identifies contracts, technical audits, authenticated email records and oversight arrangements as unresolved evidence needed to assess the actions ### Source excerpt An FBI-honored cyber chief, a 57M BAM Chinese deal, and Russian propaganda ties: the secret contracts of Dodik's digital insider. ## Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations DevFeed: [Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations]() Original publisher: [Read original article]() Author: Frank Breitinger, Jan Gruber, Christopher Hargreaves, Jan-Niclas Hilgert, Ga\\"etan Michelet, Mark Scanlon Published: 2026-10-22T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [LLM security](), [Digital forensics](), [Large Language Model](), [Adversarial attacks]() Tags: [adversarial](), [attacks](), [cs-cr](), [digital-forensics](), [llm-assisted](), [prompt-injection](), [taxonomy]() ### AI overview The paper argues that attacker-controlled forensic evidence makes an LLM's reasoning a new anti-forensic target: evidence can manipulate the model while remaining unnoticed by the examiner because tools, people, and models may perceive it differently. It proposes a taxonomy organized by attacker objective, technique, payload location, and concealment method. In a proof of concept, text planted on a seized device changed a reported conclusion, wrote attacker-chosen content to an analyst's workstation, and caused outbound network traffic. The abstract says the paper also proposes mitigations but does not describe them. ### Source excerpt arXiv:2610.29747v1 Announce Type: new Abstract: Large language models (LLMs) are entering digital forensics as examination assistants and autonomous agents. Digital forensics inverts the usual setting for indirect prompt injection: the evidence under analysis is attacker-controlled by definition, and the examiner is obliged to read it closely. This makes the reasoning layer a new anti-forensic target, next to the classical ones of data and tools. Classical anti-forensic taxonomies do not cover it, and prompt injection defences do not anticipate it. We extend the anti-forensic model to reflect the manipulation of reasoning, and present a taxonomy of attacks carried through adversarial evidence: an attacker selects an objective, a technique, a payload location, and a concealment method. We observe a perception gap, i.e., the fact that deterministic tools, the human examiner, and the model perceive the same evidence differently, which is what lets an injection reach the model unseen by the examiner. We demonstrate three attacks against an LLM-assisted analysis pipeline, changing a reported conclusion, writing attacker-chosen content to the analyst's workstation, and causing outbound network traffic, each driven only by text planted on the seized device. Mitigations to these attacks are also proposed. ## CrowdStrike Achieves NCSC CIR Enhanced Level Assurance DevFeed: [CrowdStrike Achieves NCSC CIR Enhanced Level Assurance]() Original publisher: [Read original article]() Author: Max Gebhardt Published: 2026-10-21T09:12:28.590874Z Content type: release Language: en Sources: [Crowdstrike]() Topics: [incident](), [known exploitable vulnerabilities](), [national security]() Tags: [ai](), [cni](), [crowdstrike](), [digital-forensics](), [from-the-front-lines](), [incident-response](), [ncsc](), [uk-government]() ### AI overview CrowdStrike says it has achieved Enhanced Level assurance under the UK NCSC Cyber Incident Response scheme, building on its earlier Standard Level assurance. The scheme's Enhanced Level is intended for the highest-risk incidents and requires providers to demonstrate high-quality response capabilities against capable adversaries in large, complex environments; baseline requirements include digital forensics, network traffic inspection and malware analysis. The NCSC recommends assured providers for UK organizations generally and Enhanced providers where incidents could have especially serious consequences, including for critical national infrastructure, central government, likely nation-state targets, regulated sectors and organizations operating across countries. CrowdStrike says its Services Retainer provides guaranteed access to its incident response team and describes preparation services including exposure reviews, detection and response improvements, tabletop exercises, compromise assessments and red teaming. ### Source excerpt CrowdStrike has been assured at the Enhanced Level of the NCSC CIR scheme, the highest level of incident response assurance the UK government offers, building on the CIR Standard Level assurance announced earlier this year. ## Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) DevFeed: [Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)]() Original publisher: [Read original article]() Author: Rapid7 Published: 2026-10-13T17:06:05Z Content type: news Language: en Sources: [Rapid7 Cybersecurity]() Topics: [known exploitable vulnerabilities](), [cve remediation](), [cybersecurity and infrastructure security agency](), [Digital forensics]() Tags: [2026](), [authentication-bypass](), [cisa](), [commands](), [connect-secure](), [cve](), [cybersecurity-company](), [digital-forensics](), [emergency](), [emergent-threat-response](), [emerging-threats](), [enterprise](), [exploited](), [exposure-assessment-platform](), [exposure-management](), [ivanti](), [kev-catalog](), [labs](), [managed-detection-and-response](), [managed-security-solutions](), [privilege-escalation](), [product-security](), [rapid7-intelligence](), [vulnerabilities-and-exploits](), [vulnerability-management](), [wild](), [zero-day]() ### AI overview CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure that lets remote, unauthenticated attackers execute arbitrary commands. Ivanti and CISA confirmed exploitation before disclosure, affecting a limited number of customers; Volexity also reported attacker use of a separate, still-unpatched privilege escalation flaw. Ivanti says part of the issue was fixed in release 25.1.3.0 in July 2026 while fixes were being backported to other supported versions; versions 22.7.x and below are listed as unaffected. Rapid7 recommends emergency application of the appropriate vendor update, checking for compromise even after patching, and following Ivanti recovery steps if exploitation is suspected. Reliable indicators were unavailable in Ivanti's advisory, though Volexity published some. Rapid7's vulnerability check was expected in its October 14 content release. ### Source excerpt Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands. Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-day vulnerability. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirms exploitation in the wild, and added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on the same day as the vendor's public disclosure. The digital forensics firm Volexity has published a detailed blog post describing the threat actor activity, which was detected in early October 2026. Volexity notes that in addition to leveraging CVE-2026-104935 as a zero-day, the threat actor also leveraged an as-yet unpatched privilege escalation vulnerability which Ivanti are planning to patch at a later date. According to the vendor, a portion of the vulnerability was initially discovered through its product security program and patched in the July 2026 release of 25.1.3.0. Exploitation occurred while Ivanti was working to backport the fix to the remaining supported versions. Ivanti Connect Secure is a popular enterprise VPN solution and naturally sits on the edge of a corporate environment. The product has a history of being targeted by attackers, with zero-day exploitation of other vulnerabilities occurring back in both 2024 and 2025. Given the confirmed exploitation, the ability to execute commands without authentication, along with the history of the product, Rapid7 recommends that organizations running affected versions apply the appropriate update on an emergency basis outside of normal patching cycles. Mitigation guidance Vendor-supplied updates are available to remedia ## Part 1 - Cybersecurity journeys: I didn't plan this DevFeed: [Part 1 - Cybersecurity journeys: I didn't plan this]() Original publisher: [Read original article]() Author: Shannon Brazil Published: 2026-10-07T16:21:19Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Cybersecurity](), [Hacking](), [OSINT](), [Incident response]() Tags: [amazon-web-services](), [aws-security-profiles](), [bug-bounty](), [career](), [computer](), [cybersecurity](), [defcon](), [digital-forensics](), [foundational-100](), [plan](), [security](), [security-blog](), [security-identity-compliance](), [shannon](), [thought-leadership]() ### AI overview This article shares three professionals' unconventional paths into cybersecurity, including transitions from warehouse work, marketing, and youth IT programs. Their stories emphasize curiosity, persistence, hands-on learning, mentoring, and demonstrating work as ways to build a security career without a conventional route. ### Source excerpt If you've ever wondered whether your background qualifies you for a career in cybersecurity, you're not alone -- and you're probably more prepared than you think. My name is Shannon Brazil, and I work in security communications at Amazon Web Services (AWS). I have been in the security space for over a decade, and my [...] ## Google adds intrusion logging, USB controls, and other safeguards to Android Advanced Protection DevFeed: [Google adds intrusion logging, USB controls, and other safeguards to Android Advanced Protection]() Original publisher: [Read original article]() Author: Il-Sung Lee Published: 2026-10-01T16:00:00Z Content type: news Language: en Sources: [Security]() Topics: [Android Security](), [Android](), [online privacy](), [Google Chrome](), [adb](), [rowhammer]() Tags: [accessibility](), [android](), [android-16](), [android-17](), [android-security](), [applications](), [assistive-technology](), [attack](), [attacks](), [chrome](), [data-theft](), [developers](), [digital-forensics](), [exploit](), [failed](), [forensics](), [google-play](), [google-play-protect](), [hardware](), [none](), [protection]() ### AI overview Google describes updates to Advanced Protection on Android, including optional encrypted intrusion logs retained for 12 months, USB connection restrictions, limits on AccessibilityService access, disabling WebGPU, and a lock after repeated authentication failures. The post also says developers can be notified when an app user enables Advanced Protection. ### Source excerpt A woman with Advanced Protection on Android enabled on her phone ## Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO DevFeed: [Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO]() Original publisher: [Read original article]() Author: Ahmad Zaidi Said, Elsayed Elrefaei, Kaspersky Security Services Published: 2026-09-21T10:00:40Z Content type: article Language: en Sources: [Securelist]() Topics: [active directory](), [ransomware](), [Security](), [incident](), [enterprise deployment](), [Windows](), [data]() Tags: [active-directory](), [data-exfiltration](), [data-leaks](), [data-theft](), [detection](), [detection-and-response](), [detection-engineering](), [digital-forensics](), [full](), [gpo](), [group-policies](), [incident](), [incident-response](), [infrastructure](), [kaspersky](), [large](), [linux](), [medium](), [ransomware](), [thumbnail]() ### AI overview Kaspersky describes a 2026 incident in which an attacker with domain administrator-equivalent control abused an Active Directory Group Policy Object named PAYLOAD to affect Windows workstations across a manufacturing organization. The operation delivered ransom notes and altered system settings without deploying a ransomware binary or encrypting Windows data; data exfiltration was also observed. ### Source excerpt Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.