Phantom pains
Phantom pains 👻 In May, the Threat Intelligence department of the Positive Technologies Expert Security Center (PT ESC TI) discovered a new large-scale cyber es…
[ FEED // CHRONO // 267 ITEMS ]
ALL MATERIALS
Through phantom payments to confidential data
From Phantom Payments to Confidential Data 🫰 In June, we published an article about discovered Exchange keyloggers. At that time, nine victim companies were ide…
The PT ESC cyber intelligence group has presented an overview of cyberattacks for Q2 2025 ✍️
PT ESC cyber intelligence group presents a review of cyberattacks for Q2 2025 ✍️ The report examines the most notable attacks on the IT infrastructure of Russia…
Operation Tartaria Part 2
Operation Tartaria Part 2 In addition to the passive backdoor PlugX, we managed to discover another version of it that mimicked the launch of Yandex Browser. {&…
Operation Tartaria — PlugX 🤝 DevTunnels
Operation Tartaria — PlugX 🤝 DevTunnels At the end of May, PHDays Fest wrapped up, during which, on the Defense track, the 4RAYS team discussed the specifics of…
OldGremlin with old tricks
OldGremlin with old tricks OldGremlin is known as a ransomware group 😭. To stop antiviruses (and any programs, for that matter) from running, it loads TinyKille…
Deep dive into imports: continuing to explore static resolution methods
Deep Dive into Imports: Continuing to Explore Static Resolution Techniques 🕵️♂️ Earlier we discussed how static import resolution can be implemented. However…
Node JS. Malicious activity at the installation stage
Node JS. Malicious activity at the installation stage As part of researching the actions of attackers in npm (Node Package Manager, the main repository of JS co…
The Return of the Blood Wolf
The Return of the Bloody Wolf 🐺 Since early May, the PT ESC cyber intelligence team has discovered a new wave of attacks by the Bloody Wolf group against organi…
Pass Back vulnerabilities: what they are and how dangerous they are
Pass Back vulnerabilities: what they are and how dangerous they are 🧐 There is a whole class of vulnerabilities that at first glance look harmless, and even hav…
All Hackers Go To Cloud
All Hackers Go To Cloud ☁️💻 During the investigation of an incident in a fully encrypted infrastructure, we identified an autonomous web server hosting the clie…
Drama around PyPI: 🪰⮕🐘?
Drama around PyPI: 🪰⮕🐘? Last week, CNews published a news item: "Russians driven out of the Python community. Only the chosen ones for now, but the selection cr…