# Reconnaissance A MITRE ATT&CK tactic in which adversaries gather information to support targeting and plan future operations. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CrowdStrike Delivers the Next Evolution of the Agentic SOC DevFeed: [CrowdStrike Delivers the Next Evolution of the Agentic SOC]() Original publisher: [Read original article]() Author: Brandon Benke Published: 2026-09-12T11:17:51.295154Z Content type: article Language: en Sources: [Blog]() Topics: [Agentic SOC](), [SOC](), [Security](), [Artificial Intelligence](), [Automation](), [data](), [real-time](), [Reconnaissance](), [Cloud](), [Network]() Tags: [2026](), [agentic](), [agentic-soc](), [agents](), [ai](), [automation](), [cloud](), [data](), [identity](), [network](), [operations](), [platform](), [real-time](), [saas](), [security](), [soc]() ### AI overview CrowdStrike describes the next evolution of its agentic SOC, where analysts and AI agents work together in a unified system to investigate and respond to threats in real time. The Falcon platform combines data generation, enrichment, investigation, orchestration, and governance, with capabilities for detection-ready third-party data and coordinated specialist agents. ### Source excerpt Expert agents that reason together, learn your environment, and run on data CrowdStrike owns. See how we deliver the agentic SOC. Learn more! ## AI-driven OSINT in the wrong hands - and why everyone could be a target for fraud DevFeed: [AI-driven OSINT in the wrong hands - and why everyone could be a target for fraud]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-08-27T09:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Artificial Intelligence](), [Reconnaissance](), [Social engineering](), [Web](), [Malware]() Tags: [ai](), [attacks](), [fraud](), [malware](), [phishing](), [privacy](), [research](), [social-engineering](), [vulnerability]() ### AI overview AI-powered OSINT is making it faster and easier for cybercriminals to gather publicly available information about potential victims. By linking accounts, relationships, images, and videos at machine speed, these tools can make fraud and social engineering more convincing and scalable, lowering the barrier to entry for attackers. ### Source excerpt It's getting cheaper and easier for cybercriminals to research potential victims. Here's what's still in your control. ## Frequently asked questions about the active threat to Siemens S7 Series PLCs DevFeed: [Frequently asked questions about the active threat to Siemens S7 Series PLCs]() Original publisher: [Read original article]() Author: Research Special Operations Published: 2026-08-20T14:01:58Z Content type: article Language: en Sources: [Tenable Blog]() Topics: [Cybersecurity](), [Artificial Intelligence](), [Critical Infrastructure](), [Reconnaissance](), [Script](), [Networks](), [Threat Research]() Tags: [ai](), [attacks](), [critical-infrastructure](), [cybersecurity](), [infrastructure](), [networks](), [research](), [security](), [techniques]() ### AI overview This FAQ explains an active threat targeting internet-exposed or insufficiently segmented Siemens S7 Series PLCs. It describes how threat actors use AI-generated exploitation scripts for reconnaissance and capability building, and outlines mitigations including removing direct internet exposure, segmenting OT from IT networks, and hardening access controls. ### Source excerpt A joint cybersecurity advisory released by multiple U.S. government agencies warns that threat actors are using AI-generated exploitation scripts to target exposed Siemens S7 Series PLCs across critical infrastructure sectors. Key Takeaways Unattributed threat actors are exploiting known weaknesses and unnecessary internet exposure to conduct reconnaissance and possible pre-positioning for future disruptive attacks against Siemens S7 Series PLCs. The attackers are leveraging AI to build and refine exploit scripts faster than manual development would allow. AI use lowers the technical bar for ICS attacks in a way defenders haven't had to plan for before. There is no single patch, because there is no single flaw. Mitigation depends on removing Siemens S7 Series PLCs from direct internet exposure, segmenting OT from IT networks and hardening access controls. Background On August 19, 2026, the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Energy (DOE) and the Environmental Protection Agency (EPA) released a joint Cybersecurity Advisory (AA26-231A) warning that threat actors are actively targeting Siemens S7 Series programmable logic controllers (PLCs) that are exposed to the internet or insufficiently segmented from it. The activity spans the S7-200, S7-300, S7-400, S7-1200 and S7-1500 series and most heavily affects the Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture and Commercial Facilities sectors, with potential exposure in the Defense Industrial Base as well. According to the authoring agencies, threat actors are using AI-generated exploitation scripts, disguised as legitimate operational technology (OT) monitoring tools, to conduct reconnaissance and build capability against exposed PLCs. The Tenable Research Special Operations Team (RSO) has put together this frequently asked questions (FAQ) blog to help security and OT ## What Is AI Pentesting and How Does It Work? DevFeed: [What Is AI Pentesting and How Does It Work?]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-07-27T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [Security](), [vulnerability](), [AI Models](), [Authorization](), [large-language-models](), [Reconnaissance](), [payload](), [SQL]() Tags: [ai](), [application-security](), [article](), [awareness](), [developer](), [devops](), [devsecops](), [interest](), [large-language-models](), [models](), [payload](), [security](), [security-labs](), [snyk-platform](), [sql](), [systems](), [tech](), [tools](), [vulnerabilities](), [vulnerability]() ### AI overview AI pentesting uses reasoning-capable models, deterministic testing tools, independent validation, and target context to continuously find, exploit, and verify application vulnerabilities that traditional scanners may miss. The article explains its workflow and contrasts context-dependent flaws with heuristic-detectable issues such as SQL injection and misconfigurations. ### Source excerpt AI pentesting uses reasoning-capable models to continuously find and validate the flaws scanners miss, especially broken authorization and business-logic abuse. ## Burp Extensibility 2026: Awards, Talks, and Highlights DevFeed: [Burp Extensibility 2026: Awards, Talks, and Highlights]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-06-19T12:18:14Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Extension](), [Reconnaissance](), [Authentication](), [Authorization](), [JSON Web Tokens](), [Vulnerabilities]() Tags: [auth](), [awards](), [community](), [discord](), [extension](), [pii](), [secrets](), [tokens](), [vulnerabilities](), [workshops]() ### AI overview PortSwigger's Extensibility Month highlighted Burp Suite extensions, Bambdas, and BChecks through talks, workshops, community sessions, and the 2026 Burp Extension Awards. The article summarizes the community-voted award process and notable tools for reconnaissance, authentication, access control, workflow manipulation, and vulnerability discovery. ### Source excerpt The 2026 Burp Suite Extension Awards Best Recon & Discovery Best Auth & Access Control Best Workflow & Manipulation Best API & Specialist Testing Hidden Gem Most Nominated The talks In ## Mapping out your unknown: A threat hunter's guide to Salesforce DevFeed: [Mapping out your unknown: A threat hunter's guide to Salesforce]() Original publisher: [Read original article]() Author: Julie Agnes Sparks Published: 2026-06-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Security](), [Reconnaissance](), [Software as a service](), [OAuth](), [Single sign-on (SSO)](), [MFA](), [API](), [log management](), [Monitoring]() Tags: [api](), [data](), [guide](), [logging](), [monitoring](), [oauth](), [post](), [saas](), [salesforce](), [security](), [tokens]() ### AI overview A threat-hunting guide to Salesforce that describes common attack paths, including compromised OAuth applications, stolen SSO and MFA credentials, resource discovery, data extraction, and ransomware. It provides detection queries and explains how Salesforce audit logging tiers support investigation, with queries mapped to MITRE ATT&CK tactics. ### Source excerpt In this post, we walk through different threats to Salesforce and how to detect them. ## EvilTokens: A phishing attack that doesn't steal your password DevFeed: [EvilTokens: A phishing attack that doesn't steal your password]() Original publisher: [Read original article]() Author: Christian Ali Bravo Published: 2026-06-15T08:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [OAuth 2.0](), [account takeover](), [microsoft 365](), [Microsoft](), [MFA](), [Reconnaissance](), [Authorization]() Tags: [account-takeover](), [attacks](), [authentication](), [cybercrime](), [microsoft](), [microsoft-365](), [oauth](), [phishing](), [process](), [time](), [tokens]() ### AI overview EvilTokens is a phishing-as-a-service kit that abuses Microsoft 365's OAuth 2.0 device authorization flow to compromise accounts without directly stealing passwords. Victims authenticate on Microsoft's genuine login page, unknowingly approving an attacker-controlled device; the resulting access and refresh tokens can enable account takeover and business email compromise. ### Source excerpt A phishing kit subverting Microsoft's legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages ## Webworm: New burrowing techniques DevFeed: [Webworm: New burrowing techniques]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-05-20T08:40:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [backdoor](), [Reconnaissance](), [Discord](), [GitHub](), [API](), [Microsoft](), [Bash](), [Virtual Private Network](), [Amazon S3]() Tags: [api](), [apt](), [backdoor](), [bash](), [china](), [discord](), [eset-research](), [europe](), [github](), [ip](), [malware](), [microsoft](), [s3](), [server](), [techniques](), [tools]() ### AI overview ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging. ### Source excerpt ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal ## As breakout time accelerates, prevention-first cybersecurity takes center stage DevFeed: [As breakout time accelerates, prevention-first cybersecurity takes center stage]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-04-07T09:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Cybersecurity](), [Threat Research](), [Artificial Intelligence](), [Automation](), [MFA](), [passwords](), [Reconnaissance](), [Social engineering](), [spoofing](), [ransomware]() Tags: [ai](), [ai-automation](), [attacks](), [authentication](), [automation](), [business-security](), [cybersecurity](), [exploits](), [malware](), [mfa](), [passwords](), [phishing](), [ransomware](), [social-engineering](), [tools]() ### AI overview Threat actors are using AI, automation, credential theft, phishing, zero-day exploits, reconnaissance, and AI-powered scripts to accelerate attacks. The article argues that shrinking breakout times require defenders to adopt a prevention-first cybersecurity strategy. ### Source excerpt Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy. ## Cyber fallout from the Iran war: What to have on your radar DevFeed: [Cyber fallout from the Iran war: What to have on your radar]() Original publisher: [Read original article]() Author: Tomáš Foltýn Published: 2026-03-12T14:17:33Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Security & Privacy](), [Threat Research](), [cloud-infrastructure](), [Amazon Web Services (AWS)](), [DDoS](), [Reconnaissance]() Tags: [amazon-web-services-aws](), [business-security](), [canada](), [cloud](), [cybersecurity](), [ddos](), [iran](), [united-kingdom](), [us]() ### AI overview The article examines the cybersecurity fallout from the Iran war, including attacks on AWS data centers and the rapid mobilization of pro-Iranian cyber groups. It describes hacktivism, APT reconnaissance and initial access, espionage, disruption, sabotage, and the heightened risks to organizations with Middle East supply-chain or cloud dependencies. ### Source excerpt The cybersecurity implications of the war in the Middle East extend far beyond the region. Here's where to focus your defenses. ## The big catch: How whaling attacks target top executives DevFeed: [The big catch: How whaling attacks target top executives]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2025-12-09T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Security](), [Social engineering](), [Reconnaissance](), [Vishing](), [MFA]() Tags: [attacks](), [business](), [business-security](), [corporate](), [mfa](), [phishing](), [security](), [social-engineering](), [vishing]() ### AI overview This article explains whaling attacks, a form of targeted phishing, vishing, smishing, or business email compromise aimed at senior corporate executives. It describes how attackers exploit executives' limited time, public visibility, and access to sensitive information and financial authority, including through malware-laced Zoom invitations and detailed reconnaissance. ### Source excerpt Is your organization's senior leadership vulnerable to a cyber-harpooning? Learn how to keep them safe. ## Exploiting a custom tetris game in CSAW Quals 2020 DevFeed: [Exploiting a custom tetris game in CSAW Quals 2020]() Original publisher: [Read original article]() Published: 2020-09-13T00:00:00Z Content type: tutorial Language: en Sources: [mahaloz.re]() Topics: [Code](), [arcade](), [Ghidra](), [Reconnaissance](), [Script]() Tags: [ctf](), [game](), [ghidra](), [pwn](), [reversing](), [solve](), [writeup]() ### AI overview This writeup explains how a custom Tetris game in CSAW Quals 2020 was analyzed and exploited. The challenge involved discovering cheat-piece placements, obtaining the binary, reverse-engineering its checks, and using an out-of-bounds write to obtain a partial write primitive and ultimately the flag. ### Source excerpt Pwning a custom Tetris game through an out-of-bounds write to memory through block manipulation and changes to the `.text` segment.