Graphics with a surprise: when vectors hide malicious code
Graphics with a Surprise: When Vectors Hide Malicious Code 🤨 In this post, we will examine an example of a phishing email in which malicious content was deliver…
.NET Reactor: evolution of protection from 6.7 to 7.0 and methods for removing obfuscation
.NET Reactor: The Evolution of Protection from 6.7 to 7.0 and Methods for Removing Obfuscation 🔄 .NET Reactor is a powerful tool for protecting executables writ…
Do you automate debugging?
Do you automate debugging? 🧐 The PT Sandbox expert team often has to debug various Windows kernel components in their work, and a kernel debugger is indispensab…
Move like water. Be still like a mirror. Respond like an echo...
Move like water. Be still like a mirror. Respond like an echo... 🪞 In this post, we will discuss a discovered instance of a phishing page. It is notable for emp…
How long have you been reverse engineering JavaScript?
How long has it been since you reversed JavaScript? 😲 Continuing the phishing theme (we previously looked at targeted suspicious documents leading to initial ac…
Your hash, please… Thank you!
Your hash, please… Thank you! 🙏 In early January, we discovered a file that drew attention for its content and structure. An examination of the document's metad…
Lok'tar ogar!
Lok'tar ogar! 👺 In today's world, attacks aimed at gaining initial access have become more sophisticated. Threat actors use multi-stage payloads, which allows t…
PrevedMedved 👋 — it's Lumma Stealer again
PrevedMedved 👋 — it's Lumma Stealer again In mid-November, the PT ESC cyber threat intelligence team recorded a campaign distributing the malware Lumma Stealer…
Copy, copy, can you hear us?
Over, over, can you hear us? 😲 Despite the fact that hackers have recently gotten lazy and increasingly don't develop anything of their own, original attack ide…
Repeat, it's hard to see
Come again, I can't see it well 😳 Recently, the PT ESC cyber intelligence team discovered an example of a multi-stage phishing attack in which the attackers fir…
An endless series of transitions
An endless chain of redirects ♾️ Quite often, when sending phishing links via email, attackers do not attach them explicitly to the email but use various redire…
Colonels write first!
Colonels write first! (🔞) The collection of malicious mass mailings sent in the name of law enforcement agencies has a new addition. In September, several recip…