Rare fixation techniques. Part 2
Rare persistence techniques. Part 2 Also read about: Zabbix Agent, TimeProvider. 3️⃣ COM Hijacking For persistence in the infrastructure, the attackers used a r…
[ FEED // CHRONO // 267 ITEMS ]
ALL MATERIALS
Rare retention techniques
Rare persistence techniques In the first six months of 2026, the PT ESC IR team recorded a number of rare persistence techniques on compromised hosts, which we…
⚠️ Enabled Wi-Fi debugging — got Mamont
⚠️ Turned on Wi-Fi debugging — got Mamont In early May, a vulnerability CVE-2026-0073 was discovered on Android devices that allows remote execution of commands…
The diamond is barely visible
The diamond is barely visible 💎 During the analysis of PT ESC IR dumps, we periodically encounter new malware families that are not detected by known indicators…
Hello! The Supply Chain Security team is here
Hello! The Supply Chain Security group is here 🩷 We scan open source in real time for malicious code. We are also responsible at ESCalator for publications abou…
The attacker publishes .bash_history view without registration and SMS
Attacker publishes .bash_history watch without registration and SMS 😱 The Supply Chain Security team sent a report to the npm registry administration about an a…
Dirty Frag 🐧
Dirty Frag 🐧💥 A week after the widely discussed Copy.Fail, researcher v4bel disclosed a new privilege escalation technique in the Linux kernel — Dirty Frag. As…
PT ESC cyber intelligence group presented an overview of cyberattacks for Q1 2026 ✍️
PT ESC Cyber Intelligence Group presented an overview of cyberattacks for Q1 2026 ✍️ The report analyzes the activity of hacker groups targeting Russian organiz…
Copy.Fail
Copy.Fail 🐧 Researchers discovered a bug in the Linux kernel that has existed in systems since 2017 and affects virtually all distributions. Vulnerability CVE-2…
Why IDA doesn't fold constants and how to fix it
Why IDA doesn't fold constants and how to fix it 👨💻 Recently, obfuscation has been increasingly common in software where constants are replaced with arithmetic…
Hiding in plain sight: how PhantomCore masks its activity using legitimate tools
🫣 Hiding in plain sight: how PhantomCore masks its activity using legitimate tools The PT ESC IR team has presented a new study dedicated to the activities of t…
Confusion in WSUS vulnerabilities: setting the record straight
Confusion Around WSUS Vulnerabilities: Setting the Record Straight 🕷 One of the most pressing vulnerabilities in Windows Server Update Services (WSUS) is a crit…