<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Babels — Detection Engineering Articles]]></title><description><![CDATA[AI Detection Engineering Solutions and News for Cyber Defense Practitioners]]></description><link>https://babels.dev</link><generator>GatsbyJS</generator><lastBuildDate>Wed, 08 Jul 2026 14:29:21 GMT</lastBuildDate><atom:link href="https://babels.dev/rss.xml" rel="self" type="application/rss+xml"/><item><title><![CDATA[ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit]]></title><description><![CDATA[Detect the initial infection chain with `cmd /c curl ... | cmd.exe` and later stages like `ClipCursor`, UAC loops, or kiosk mode browser launches.]]></description><link>https://babels.dev/articles/clickfix-to-cash-out-anatomy-of-a-mexican-banking-fraud</link><guid isPermaLink="false">https://babels.dev/articles/clickfix-to-cash-out-anatomy-of-a-mexican-banking-fraud</guid><pubDate>Wed, 08 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Felons, Fraudsters Flog Offensive Cybersecurity Startup]]></title><description><![CDATA[Understanding this actor's brazen exploit acquisition model helps detection teams monitor and hunt for activities related to the sale and development of new vulnerabilities rather than just known malware.]]></description><link>https://babels.dev/articles/felons-fraudsters-flog-offensive-cybersecurity-startup</link><guid isPermaLink="false">https://babels.dev/articles/felons-fraudsters-flog-offensive-cybersecurity-startup</guid><pubDate>Wed, 08 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Meet the 33 cybersecurity startups joining the Gemini Startup Forum]]></title><description><![CDATA[Highlights emerging security domains like EDR for AI agents and the push toward quantum-resistant infrastructure.]]></description><link>https://babels.dev/articles/meet-the-33-cybersecurity-startups-joining-the-gemini</link><guid isPermaLink="false">https://babels.dev/articles/meet-the-33-cybersecurity-startups-joining-the-gemini</guid><pubDate>Wed, 08 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Drive proactive security, prioritize risks with Google Threat Intelligence and Wiz ASM]]></title><description><![CDATA[Automates the prioritization of which exposures matter most by correlating known exploits against your specific environment.]]></description><link>https://babels.dev/articles/drive-proactive-security-prioritize-risks-with-google-threat</link><guid isPermaLink="false">https://babels.dev/articles/drive-proactive-security-prioritize-risks-with-google-threat</guid><pubDate>Tue, 07 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI]]></title><description><![CDATA[Monitor Event ID 385 to detect configuration drift and enforce automated certificate management for safer key lifecycle handling.]]></description><link>https://babels.dev/articles/the-ghost-in-the-database-recovering-active-adfs-signing</link><guid isPermaLink="false">https://babels.dev/articles/the-ghost-in-the-database-recovering-active-adfs-signing</guid><pubDate>Tue, 07 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Shift into high gear with agents: Securing the software-defined vehicle]]></title><description><![CDATA[Detection engineers can monitor the entire trust chain from certificate validation and JWT issuance down to granular NATS subject permissions rather than chasing leaked keys.]]></description><link>https://babels.dev/articles/shift-into-high-gear-with-agents-securing-the-software</link><guid isPermaLink="false">https://babels.dev/articles/shift-into-high-gear-with-agents-securing-the-software</guid><pubDate>Mon, 06 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[FBI Seizes NetNut Proxy Platform, Popa Botnet]]></title><description><![CDATA[Understanding how compromised home networks are used as exit nodes helps engineers model adversary obfuscation and identify indicators from NetNut's SDK/backend infra.]]></description><link>https://babels.dev/articles/fbi-seizes-netnut-proxy-platform-popa-botnet</link><guid isPermaLink="false">https://babels.dev/articles/fbi-seizes-netnut-proxy-platform-popa-botnet</guid><pubDate>Thu, 02 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Google’s Continued Disruption of Malicious Residential Proxy Networks]]></title><description><![CDATA[Detection engineers can use shared indicators for NetNut's SDKs and C2 to identify malicious proxy activity and compromised home devices used as exit nodes.]]></description><link>https://babels.dev/articles/google-s-continued-disruption-of-malicious-residential-proxy</link><guid isPermaLink="false">https://babels.dev/articles/google-s-continued-disruption-of-malicious-residential-proxy</guid><pubDate>Thu, 02 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3]]></title><description><![CDATA[Offload routine triage to code so analysts only touch high-signal, non-deterministic investigations.]]></description><link>https://babels.dev/articles/inside-elastic-infosec-s-agentic-soc-cutting-alert-triage</link><guid isPermaLink="false">https://babels.dev/articles/inside-elastic-infosec-s-agentic-soc-cutting-alert-triage</guid><pubDate>Thu, 02 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval]]></title><description><![CDATA[Validates Google Cloud’s security posture through independent audit, reducing compliance risk for public sector migrations.]]></description><link>https://babels.dev/articles/google-cloud-confirmed-to-offer-a-safer-choice-for-eu-public</link><guid isPermaLink="false">https://babels.dev/articles/google-cloud-confirmed-to-offer-a-safer-choice-for-eu-public</guid><pubDate>Wed, 01 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[New IDC study: The business value of Mandiant Consulting]]></title><description><![CDATA[Use third-party validation and quantified business metrics to justify security investments and resource allocation at the executive level.]]></description><link>https://babels.dev/articles/new-idc-study-the-business-value-of-mandiant-consulting</link><guid isPermaLink="false">https://babels.dev/articles/new-idc-study-the-business-value-of-mandiant-consulting</guid><pubDate>Wed, 01 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Three Pitfalls When Converting SIGMA Rules to Elastic]]></title><description><![CDATA[Most broken SIGMA-to-Elastic conversions come down to three fixable causes: mismatched field mappings, ignored log-source scoping, and skipping post-conversion tuning against real data.]]></description><link>https://babels.dev/articles/sigma-to-elastic-pitfalls</link><guid isPermaLink="false">https://babels.dev/articles/sigma-to-elastic-pitfalls</guid><pubDate>Wed, 01 Jul 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Train, triage, repeat: The AI agent changing how we fight phishing]]></title><description><![CDATA[Offload high-volume triage to an automated pipeline so analysts can focus on nuanced threat hunting instead of manual classification.]]></description><link>https://babels.dev/articles/train-triage-repeat-the-ai-agent-changing-how-we-fight</link><guid isPermaLink="false">https://babels.dev/articles/train-triage-repeat-the-ai-agent-changing-how-we-fight</guid><pubDate>Tue, 30 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Cloud CISO Perspectives: How Google Cloud Security uses AI internally]]></title><description><![CDATA[Demonstrates how agentic workflows can automate high-volume tasks like security review, vulnerability verification, and patch generation at scale.]]></description><link>https://babels.dev/articles/cloud-ciso-perspectives-how-google-cloud-security-uses-ai</link><guid isPermaLink="false">https://babels.dev/articles/cloud-ciso-perspectives-how-google-cloud-security-uses-ai</guid><pubDate>Mon, 29 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira]]></title><description><![CDATA[This case highlights a multi-stage campaign from initial SEO lure to credential theft and ransomware deployment — useful for building detections across the full kill chain (sideloading, persistence, lateral movement).]]></description><link>https://babels.dev/articles/from-bing-search-to-ransomware-bumblebee-and-adaptixc2</link><guid isPermaLink="false">https://babels.dev/articles/from-bing-search-to-ransomware-bumblebee-and-adaptixc2</guid><pubDate>Mon, 29 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem]]></title><description><![CDATA[Understanding these evolving tactics and the use of AI helps defenders anticipate wider targeting beyond Ukraine and build more comprehensive detection strategies.]]></description><link>https://babels.dev/articles/the-bear-necessities-a-look-at-the-drivers-dynamics-and</link><guid isPermaLink="false">https://babels.dev/articles/the-bear-necessities-a-look-at-the-drivers-dynamics-and</guid><pubDate>Mon, 29 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Why Babels: Sharper Detection Engineering in the Age of AI]]></title><description><![CDATA[Babels exists to make high-quality detection engineering more accessible — pairing open-source tooling with AI-assisted workflows so practitioners can convert, validate, and deploy detections faster.]]></description><link>https://babels.dev/articles/why-babels</link><guid isPermaLink="false">https://babels.dev/articles/why-babels</guid><pubDate>Sun, 28 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[Securing agentic AI with perimeter guardrails: What's new in VPC Service Controls]]></title><description><![CDATA[VPC Service Controls act as a critical safety net by blocking data exfiltration at the API layer even when an agent possesses valid IAM credentials.]]></description><link>https://babels.dev/articles/securing-agentic-ai-with-perimeter-guardrails-what-s-new-in</link><guid isPermaLink="false">https://babels.dev/articles/securing-agentic-ai-with-perimeter-guardrails-what-s-new-in</guid><pubDate>Fri, 26 Jun 2026 00:00:00 GMT</pubDate></item><item><title><![CDATA[STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus]]></title><description><![CDATA[Detection can focus on inter-process communication via WM_COPYDATA messages and the use of websocket-sharp for C2 tunneling.]]></description><link>https://babels.dev/articles/stockstay-another-day-the-latest-addition-to-turla-s</link><guid isPermaLink="false">https://babels.dev/articles/stockstay-another-day-the-latest-addition-to-turla-s</guid><pubDate>Thu, 25 Jun 2026 00:00:00 GMT</pubDate></item></channel></rss>