A heap buffer overflow vulnerability exists in the ntfs!PageUpdateAnalysis function of the Microsoft Windows NTFS driver. A specially crafted NTFS volume can cause an out-of-bounds write into kernel NonPagedPoolNx memory…
Recently, our colleagues from the Positive Industrial Expertise Center discovered a curious Windows sample on MalwareBazaar. Here is its SHA-256: e014dadf6d93b3…
Recently, we came across an APK with an intriguing and trust-inspiring name: «Антивирус ФСБ.apk». After installing it, we discovered that upon launch, the user…
[ FEED // CHRONO // 267 ITEMS ]
At the end of June, the PT ESC team, during incident investigations, discovered a new group targeting at least oil and gas companies and the financial sector. D…
Recently, our PT ESC IR team encountered a new attack by ransomware groups on Zimbra mail servers using the vulnerability CVE-2026-73570 and the TargetZimbra en…
Ding, ding — who's there? 🔔 The cyber intelligence group of Positive Technologies' expert security center has discovered a new group that we have named DENOmina…
He's not gsocket to you 😑 During the investigation of one of the incidents, PT ESC IR specialists came across a rather curious tool called hsocket (not to be co…
Recently, the Department for Comprehensive Response to Cyberthreats (PT ESC IR) received a number of samples of an Android banking trojan with remote control ca…
We will croc you 👻 PhantomCore continues to actively exploit misconfigurations in 1C to attack Russian organizations. We previously wrote about attacks on 1C us…
Enterprise-grade validation system with schema support (c) The author of a dozen trojans who forgot to add "Enterprise-grade" obfuscation We discovere…
One less feathered thief — plus one hundred rating points! 😵 The Threat Intelligence team at Positive Technologies' Expert Security Center has discovered a camp…
DragonDoll: a matryoshka in the world of Android spies 🪆 At the beginning of this spring, PT ESC specialists discovered a previously unknown APK file uploaded f…
⚡Fake news — B U L L S H I T PT ESC specialists discovered an interconnected network of news sites, email domains, and social media accounts that were used to s…
Over the past couple of months, the attacker has been distributing trojans from several npm accounts: alex05255, mdrafiqulislamrabby, b.w1001, abdev8773, and mo…
PT ESC Cyber Intelligence Group presented an overview of cyberattacks for Q2 2026 ✍️ The report analyzes the activity of hacker groups targeting Russian organiz…
