Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

bluevoyant

Dangling DNS Is Off the Hook

Feb 2, 2026 By Lorri Janssen-Anessi In BlueVoyant
If your organization uses public cloud services or frequently spins up short‑lived web assets, there’s a good chance you already have at least one "dangling"DNS record. It's surprisingly easy to create one, and even easier to forget it exists. But a single forgotten record can give attackers a ready-made subdomain to host phishing pages, allow them to plant malware, or hijack your brand's reputation–without ever touching your infrastructure.
Read Post
bluevoyant

Operation Repo Ruse

Jan 15, 2026 By Thomas Elkins and Joshua Green In BlueVoyant
BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers identified an active campaign by the prolific threat actor Rift Brigantine (a.k.a. TA505, FIN11, and Graceful Spider). In this iteration, the actor is leveraging fraudulent GitHub repositories to distribute malicious batch script installers masquerading as legitimate IT and security software, including Microsoft Remote Desktop Connection Manager (RDCMan) and Palo Alto Networks GlobalProtect.
Read Post
bluevoyant

AI in the SOC

Jan 13, 2026 By Dan Petrillo In BlueVoyant
Gartner frames the AI SOC landscape as a dichotomy: providers pursuing full SOC replacement versus those building AI products to augment existing staff. Of these two approaches, only augmentation aligns with real-world security operations. It helps analysts triage alerts, investigate faster, enrich context, and summarize incidents with better consistency, all while keeping humans in the loop, even if their day-to-day efforts change.
Read Post
Featured Post
From Spend to Impact: Fixing the Disconnect in U.K. Supply Chain Security

From Spend to Impact: Fixing the Disconnect in U.K. Supply Chain Security

Jan 7, 2026 By Robert Hannigan, Chairman of International Business In BlueVoyant
In today's hyperconnected economy, supply chains are no longer just operational backbones; they are strategic lifelines, shaping resilience, competitiveness, and innovation across industries. Yet for many U.K. organisations, these lifelines are becoming increasingly fragile. The most recent iteration of our global supply chain defence research indicates that - despite pouring significant resources into third party risk management (TPRM) programs and embracing new technologies to shore up their supply chain defences - U.K. businesses continue to face a high rate of supply chain breaches.
Read Post
bluevoyant

Getting the Right People to the Table

Dec 10, 2025 By Tara Ragan and James Hart In BlueVoyant
Implementing Microsoft Purview is not just an IT project – it’s a company-wide transformation that touches nearly every aspect of how your organization manages, protects, and governs data. Success requires aligning diverse perspectives and building consensus across teams. The initial push for Purview can come from many departments. If you are leading the effort, identifying who needs to be involved and understanding why their input matters will be key to driving buy-in and long-term success.
Read Post
bluevoyant

Fake SAP Concur Extensions Deliver New FireClient Malware Variant

Dec 4, 2025 By Joshua Green and Thomas Elkins In BlueVoyant
The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) team are tracking an adversary luring users into downloading fake Concur browser extensions. The fake browser extension installer contains a FireClient Loader designed to gather host information and send to its command and control (C2) server. If execution succeeds with successful communication to the C2, the loader drops a backdoor BlueVoyant is naming FireClient Backdoor.
Read Post
bluevoyant

New Report Reveals Third-Party Risk Management's Next Chapter

Dec 2, 2025 By Joel Molinoff In BlueVoyant
After six years of tracking third-party risk management programs (TPRM), one thing has become clear: having a program doesn't necessarily mean it's working. Our latest The State of Supply Chain Defense report reveals an interesting shift. Organizations are spending more than ever on securing their vendor ecosystem, with 95% planning to increase their budgets in the next year. Programs are maturing, with nearly half of surveyed organizations reporting established and optimized initiatives.
Read Post
bluevoyant

Top Security Insights You Need to Know from Microsoft Ignite 2025

Nov 24, 2025 By Sophia Lagerkrans-Pandey and Micah Heaton In BlueVoyant
Microsoft Ignite 2025 delivered big news for security professionals. The theme this year is clear: Microsoft is giving customers more capability inside the tools they already own, focused on AI agents and integrations. Whether you are a small IT team, a mid-market group, or a global enterprise, these updates can transform your security posture.
Read Post
bluevoyant

Email Bombing Followed by Teams IT Impersonation Attacks Continue

Nov 17, 2025 By Joshua Green and Josh Trinh In BlueVoyant
BlueVoyant’s Threat Fusion Cell and SOC have been tracking a significant and persistent social engineering campaign that cleverly exploits trusted communication channels to gain initial access to target networks. Since at least mid-October 2025, BlueVoyant has observed a consistent playbook where threat actors employ inbox sabotage as a pretext for highly convincing IT support impersonation over Microsoft Teams.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.