This is Siemens...
Recently, our colleagues from the Positive Industrial Expertise Center discovered a curious Windows sample on MalwareBazaar. Here is its SHA-256: e014dadf6d93b3…
[ ARCHIVE ]
Author: global_author
Anti-antivirus
Recently, we came across an APK with an intriguing and trust-inspiring name: «Антивирус ФСБ.apk». After installing it, we discovered that upon launch, the user…
.exe .docm .xlsm
.exe .docm .xlsm Malicious files with these extensions are most often found in corporate network traffic. Let's take a basic look at why. 🖥 .exe — the classic e…
Chaos, shock, private keys from a not-so-private GitLab 💻
Over the past couple of months, the attacker has been distributing trojans from several npm accounts: alex05255, mdrafiqulislamrabby, b.w1001, abdev8773, and mo…
::%16777216 — so what exactly are you?
::%16777216 — so what exactly are you? It is known that during attacks, adversaries can use tunneling. For example, to punch a reverse tunnel from a compromised…
Hello! The Supply Chain Security team is here
Hello! The Supply Chain Security group is here 🩷 We scan open source in real time for malicious code. We are also responsible at ESCalator for publications abou…
Dirty Frag 🐧
Dirty Frag 🐧💥 A week after the widely discussed Copy.Fail, researcher v4bel disclosed a new privilege escalation technique in the Linux kernel — Dirty Frag. As…
Copy.Fail
Copy.Fail 🐧 Researchers discovered a bug in the Linux kernel that has existed in systems since 2017 and affects virtually all distributions. Vulnerability CVE-2…
Why IDA doesn't fold constants and how to fix it
Why IDA doesn't fold constants and how to fix it 👨💻 Recently, obfuscation has been increasingly common in software where constants are replaced with arithmetic…
Confusion in WSUS vulnerabilities: setting the record straight
Confusion Around WSUS Vulnerabilities: Setting the Record Straight 🕷 One of the most pressing vulnerabilities in Windows Server Update Services (WSUS) is a crit…
Recognize STL code easily
Recognizing STL code with ease 😐 During reverse engineering, we often encounter STL code whose analysis at first glance seems difficult. An inexperienced eye ma…
Do you use email for work?
👨💻 Do you use email for work? Keep in mind that… ...up to 80% of phishing attacks on organizations are carried out through it. Positive Technologies specialist…