Recognize STL code easily
Recognizing STL code with ease 😐 During reverse engineering, we often encounter STL code whose analysis at first glance seems difficult. An inexperienced eye ma…
[ FEED // CHRONO // 267 ITEMS ]
ALL MATERIALS
Do you use email for work?
👨💻 Do you use email for work? Keep in mind that… ...up to 80% of phishing attacks on organizations are carried out through it. Positive Technologies specialist…
CHM snap-in, alarm clocks, CIB of the Ministry of Defense of the Russian Federation, and bitcoin eggs
CHM snap-in, alarms, CIB of the Russian Ministry of Defense, and bitcoin eggs 🤖 At the end of December last year, the Threat Intelligence team of the Positive T…
A logging library and an infostealer to boot? No thanks
A logging library and an infostealer to boot? No thanks 👋 A lot has happened recently. For example, someone decided to play patron of the arts and published 30…
Friday newsletter
Friday Newsletter 🐽 Imagine: you're an employee of a Russian organization, and on Friday someone named Nadezhda Arturovna 😌 sends you an email (screenshot 1) as…
Where does one grouping end and another begin? 🧩
Where does one group end and another begin? 🧩 In a new study, we examined a case that clearly demonstrates how the MaaS model complicates attack attribution. Th…
Ghostly Gist
Ghostly Gist 😏 In March, PT ESC cyber intelligence specialists recorded activity from the Rare Werewolf group (Rezet, Librarian Ghouls). This time, an archive d…
Apple Notice of Compromise
Lately, we are increasingly encountering devices that have received a compromise notification from Apple 📲 If you receive a message on your device in iMessage f…
Again CFG
CFG again 👋 A common task when extracting malware configurations at scale is obtaining function boundaries and references. The most typical example is string de…
Unusual obfuscation is always beautiful...
Unusual obfuscation is always beautiful... 🥰 ... it's just a shame that you have to see it in trojanized open-source packages, and not only at Capture The Flag…
Basic minimum of cyber intelligence
Cyber Intelligence Basics 👍 This week we are holding the fifth episode of the webinar "Better Call PT ESC," where we break down practical scenarios for working…
Infect the state and earn 3 rubles
Infect a state and earn 3 rubles 🪙 In late February and early March, specialists from the PT ESC threat research department identified attacks on various organi…