Reflection Relay. It never happened before, and now it's happening again (CVE-2025-33073) 😐 One of the most popular techniques for privilege escalation in an Ac…
Did you know that malicious actors don't like LNK file parsers? 👿 In March we wrote about XDSpy attacks on Russian organizations. The LNK files used in this att…
⚠️ PT ESC experts have detected attempts to exploit the CVE-2025-24071 vulnerability The vulnerability CVE-2025-24071, affecting a wide range of Windows operati…
A complex password won't help 📮 The practice of the PT ESC IR information security incident response team shows that attackers, upon gaining access to companies…
😐 “Why aren't you answering?”, or The Story of How to Steal a Telegram Account Without Registration or SMS Recently we published an article about the most popul…
Roots of the CVE-2024-30085 Vulnerability 🌳 Back in September of last year, we at ESC-VR successfully reproduced an exploit for CVE-2024-30085 — a vulnerability…
Net group "babyk" /add During the investigation of one of the incidents, we discovered the exploitation of the CVE-2024-37085 vulnerability. It allows…
[SCCM NTLM Relay] Hello everyone! 👋 My article about SCCM attacks was recently published. It describes in sufficient detail the testing lab, the attacks themsel…
Where can the history of PowerShell commands be found? 🧐 Surely the first things that come to mind are Windows logs and the ConsoleHost_history.txt file, but th…
😏 Exclusively for Escalator, the ESC-VR team shares details about the vulnerability (CVE-2024-43629) that we found in the Desktop Window Manager component, allo…
⚠️ OWOWAsome module, or IIS kOWOWAren Researchers reported on the malicious IIS module Owowa, designed to intercept user credentials, back in 2021. And in 2022…
Where to look for network indicators of compromise on Windows? For example, in the DNS cache 💡 The DNS cache is a mechanism for caching records that map domain…
