Graphics with a surprise: when vectors hide malicious code
Graphics with a Surprise: When Vectors Hide Malicious Code 🤨 In this post, we will examine an example of a phishing email in which malicious content was deliver…
[ FEED // CHRONO // 267 ITEMS ]
ALL MATERIALS
What is the steganographic mafia hiding from us?
What is the steganographic mafia hiding from us? 👤 In November 2024, we told you about the PhaseShifters group and also mentioned the subscription-based crypter…
A complex password won't help
A complex password won't help 📮 The practice of the PT ESC IR information security incident response team shows that attackers, upon gaining access to companies…
"Why aren't you answering?", or The Story of How to Hijack a Telegram Account Without Registration or SMS
😐 “Why aren't you answering?”, or The Story of How to Steal a Telegram Account Without Registration or SMS Recently we published an article about the most popul…
Roots of the CVE-2024-30085 vulnerability
Roots of the CVE-2024-30085 Vulnerability 🌳 Back in September of last year, we at ESC-VR successfully reproduced an exploit for CVE-2024-30085 — a vulnerability…
Are you using cryptography correctly?
Are you using cryptography correctly? 🔓 The Advanced Threat Research Group of the Threat Intelligence department often has to solve interesting tasks in the pro…
1C_shell for "1C"
1C_shell for "1C" 🦞 Sometimes situations arise when, during an information security incident investigation, the traditionally used OS artifacts contain extremel…
Desert Dexter is a group targeting residents of Arab states.
Desert Dexter — a group targeting residents of Arab states👽 Specialists from the cyber intelligence group of the PT ESC TI department have discovered a maliciou…
CVE-2024-37085
Net group "babyk" /add During the investigation of one of the incidents, we discovered the exploitation of the CVE-2024-37085 vulnerability. It allows…
.NET Reactor: evolution of protection from 6.7 to 7.0 and methods for removing obfuscation
.NET Reactor: The Evolution of Protection from 6.7 to 7.0 and Methods for Removing Obfuscation 🔄 .NET Reactor is a powerful tool for protecting executables writ…
Evolution of Dark Caracal tools
Evolution of Dark Caracal Tools 🐱 In the first quarter of 2024, a malicious sample came to the attention of the Threat Intelligence department at the Positive T…
Don't throw away your old iPhone until you read this post (and after that too)
Don't throw away your old iPhone until you read this post (and after, too) 🚮 Recently, our expert Vitaly, who investigates incidents involving mobile devices, r…