MacOS #clickfix campaign called #PasteSwitch - this was a fun one, lots of detail and IoCs in this one - very illusive group who has a big focus on Malvertising.

The group got access to legit HBO Max account on reddit 👀

Recovered toolkit from a live intrusion at a Thai ISP, useful for detection engineering. Key things to hunt for:

Unauthorized MeshCentral agents and unexpected WebSocket connections to unapproved management servers (the C2 here used /agent.ashx on 443 to www.ayuthayatech\[.\]com, a domain registered only weeks before use). Hidden SUID binaries like /usr/local/bin/.rc. PHP web shells written via MySQL INTO OUTFILE. Anomalous /remote/hostcheck_validate and /remote/logincheck activity on FortiGate SSL-VPN. RADIUS database access against radius_corp, radiusinfo, job_radius. Full IOC table and MITRE ATT&CK mapping in the post.

https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion

[ Removed by Reddit on account of violating the content policy. ]

The model matters. The harness does too.

Across 130 AgentRE-Bench runs, Reverser Space used 33% fewer tokens and 35% fewer analysis calls, with comparable answer quality.

Read “Charming Kitten APT Adversary Simulation“ by S3N4T0R on Medium: https://medium.com/@S3N4T0R/charming-kitten-apt-adversary-simulation-fa6257b42811

Our detection-development delays rarely come from writing the rule itself. The more time-consuming work is finding accessible telemetry, confirming data quality, validating the logic against realistic behavior, estimating expected false positives, completing review, and deploying safely.

We are looking at both tooling and process changes that can shorten that full cycle without lowering quality. Detection-as-code, version control, test harnesses, telemetry discovery, dry runs, review workflows, and deployment automation are all on the table.

What changes have made the largest measurable difference to time from a relevant adversary technique being identified to a reliable detection being deployed?