Operation Tartaria — PlugX 🤝 DevTunnels
Operation Tartaria — PlugX 🤝 DevTunnels At the end of May, PHDays Fest wrapped up, during which, on the Defense track, the 4RAYS team discussed the specifics of…
OldGremlin with old tricks
OldGremlin with old tricks OldGremlin is known as a ransomware group 😭. To stop antiviruses (and any programs, for that matter) from running, it loads TinyKille…
The Return of the Blood Wolf
The Return of the Bloody Wolf 🐺 Since early May, the PT ESC cyber intelligence team has discovered a new wave of attacks by the Bloody Wolf group against organi…
Jade metal: is the not-so-new Telemanmilconfav group attacking military organizations?
Jade Metal: the not-so-new Telemanmilconfav group attacks military organizations? 🪖 In March, researchers from F6 published a report on the Telemancon group, wh…
DarkGaboon. The venom of a cyber-viper in the digital veins of Russian companies
DarkGaboon. The venom of a cyber viper in the digital veins of Russian companies 🐍 In January of this year, the cyber intelligence group of the TI department at…
No longer Rezet, or the New Attacks of Rare Wolf
No Longer Rezet, or New Rare Wolf Attacks 🐺 The PT ESC cyber intelligence group continues to record attacks by the Rare Wolf group: for example, in late May, th…
New PhaseShifters Campaign
New PhaseShifters campaign 👽 Throughout May, the PT ESC cyberthreat intelligence team has been tracking a wave of activity by the PhaseShifters hacking group, w…
🛡 Puma: how a rootkit provides covert SSH access through stealthy key substitution
🛡 Puma: how a rootkit provides covert SSH access through stealthy key substitution Continuing our story about the activities of the ExCobalt group and its new t…
The PT ESC cyber intelligence team has prepared a report on the results of the first quarter of 2025.
PT ESC cyber intelligence team has prepared a report on the results of the first quarter of 2025 ✍️ It compiles the most notable attacks by hacker groups on the…
How did SaT entangle several groups at once in a tangle?
How did CaT entangle several groups at once? 🧶 In the fall of 2024, our attention was drawn to an interesting tool discovered while studying the activity of the…
(Ex)Cobalt == (Ex)Carbanak
(Ex)Cobalt == (Ex)Carbanak 🤔 Since the beginning of 2025, the PT ESC team has observed a rise in the number of attacks using the SshDoor backdoor. Russian gover…
Team46 and TaxOff: two sides of the same coin
Team46 and TaxOff: Two Sides of the Same Coin😑 In March 2025, specialists from the TI department of the Positive Technologies Expert Security Center (PT Expert…