Your hash, please… Thank you!
Your hash, please… Thank you! 🙏 In early January, we discovered a file that drew attention for its content and structure. An examination of the document's metad…
[ ARCHIVE ]
Author: ti_author
One lazy driver
🚘 One lazy driver Recently, the PT ESC cyber intelligence group discovered an executable file with an "unusual" name, reinforced by a distinctive PDF file icon…
First steps in the hacking field
First steps on the hacking path 🐱 Open source is an interesting environment for observing how projects evolve. It's fascinating to study the implementation of t…
Can Stalin control your computer?
🥸 Can Stalin control your computer? Probably not. But PowerStalin definitely can. Recently, we came across a malicious PowerShell script that its author affecti…
PrevedMedved 👋 — it's Lumma Stealer again
PrevedMedved 👋 — it's Lumma Stealer again In mid-November, the PT ESC cyber threat intelligence team recorded a campaign distributing the malware Lumma Stealer…
Another Python stealer?!
Another stealer in Python?! 🫣 Since the beginning of September, we have been tracking attacks that at first glance could be attributed to the activity of the La…
TaxOff: it seems you have… a backdoor
📑 TaxOff: looks like you have… a backdoor In the third quarter, specialists from the TI department of the Positive Technologies Expert Security Center (PT Exper…
What is wrong with this AES?
What exactly is wrong with this AES? ❔ Attackers often use encryption to obfuscate parts of malware samples that may be of greatest interest during research. Wh…
Through blockchain to data
Through the blockchain to the data ⭐️ Researchers from Socket and Checkmarx have reported on an interesting malicious campaign in NPM. The attackers mimicked pl…
Copy, copy, can you hear us?
Over, over, can you hear us? 😲 Despite the fact that hackers have recently gotten lazy and increasingly don't develop anything of their own, original attack ide…
APT-C-60, or DarkHotel
APT-C-60, aka DarkHotel 💿 We once talked about the use of VHDX files in attacks and why it is convenient (no, this is not a call to action). You can find that p…
Repeat, it's hard to see
Come again, I can't see it well 😳 Recently, the PT ESC cyber intelligence team discovered an example of a multi-stage phishing attack in which the attackers fir…