CVE-2024-37085
Net group "babyk" /add During the investigation of one of the incidents, we discovered the exploitation of the CVE-2024-37085 vulnerability. It allows…
Don't throw away your old iPhone until you read this post (and after that too)
Don't throw away your old iPhone until you read this post (and after, too) 🚮 Recently, our expert Vitaly, who investigates incidents involving mobile devices, r…
C2 hunting: part 2.
C2 hunting: part 2. Hunting for hacker servers by external signs 😁 In the previous part, we talked about how to expand knowledge about hackers' infrastructure u…
(Ex)Cobalt in container
(Ex)Cobalt in a Container 🛂 During the response to a computer incident, the PT ESC IR team established the fact that attackers had gained a foothold in Docker c…
How long have you been reverse engineering JavaScript?
How long has it been since you reversed JavaScript? 😲 Continuing the phishing theme (we previously looked at targeted suspicious documents leading to initial ac…
Mount point. Pt 2
Mount point. Pt 2 Hello! We decided to talk about disk mounting again. Today we'll tell you how to work with LVM containers. Here's a short manual so you don't…
You can't just take and offload information from a mobile phone
😏 You can't just simply extract information from a mobile phone A mobile phone is a portable computer, but in most cases, extracting the data needed for an inve…
Mount Point — pt.1
Mount Point — pt.1 🙂 Any investigation is an analysis of operating system artifacts. And to obtain them, you often have to work with virtual machine images, suc…
Cloud services from the operator "MeHaFon"
📲 Cloud services from the "MeHaFon" operator News from the field: the PT ESC team is observing a new campaign by the Cloud Atlas group targeting government orga…
Stealer infection: a new USB strain
Stealer infection: a new USB strain 👾 Today we're going to talk about an unusual modification of the WorldWind stealer that we discovered. It is a real, bona fi…
Ngrok. Finding and figuring it out
Ngrok. Finding and understanding it 🔍 In the process of investigating numerous incidents, we repeatedly encounter a tool such as ngrok. It is a convenient legit…
SSH-IT. Guide to detecting a popular tool
SSH-IT. Guide to detecting a popular tool 🔭 In the course of investigating numerous incidents involving the compromise of Linux nodes, we sometimes discover var…