In Puma's footsteps: how to detect a rootkit through its own interface
🐾 Following in Puma's Footsteps: How to Detect a Rootkit Through Its Own Interface Today, our review covers a technically interesting and multifunctional Linux…
Malware in open source!
Mmaallwwaarree iinn ooppeennssoouurrccee! A notable campaign by a single researcher is unfolding online. The following packages belong to him: User lastbright…
⚠️ PT ESC experts have detected attempts to exploit the CVE-2025-24071 vulnerability
⚠️ PT ESC experts have detected attempts to exploit the CVE-2025-24071 vulnerability The vulnerability CVE-2025-24071, affecting a wide range of Windows operati…
Spy is back in action
😆Spy is back in action A cyber intelligence team has recorded a new campaign by the hacker group XDSpy aimed at compromising the IT infrastructure of government…
Graphics with a surprise: when vectors hide malicious code
Graphics with a Surprise: When Vectors Hide Malicious Code 🤨 In this post, we will examine an example of a phishing email in which malicious content was deliver…
What is the steganographic mafia hiding from us?
What is the steganographic mafia hiding from us? 👤 In November 2024, we told you about the PhaseShifters group and also mentioned the subscription-based crypter…
Are you using cryptography correctly?
Are you using cryptography correctly? 🔓 The Advanced Threat Research Group of the Threat Intelligence department often has to solve interesting tasks in the pro…
Desert Dexter is a group targeting residents of Arab states.
Desert Dexter — a group targeting residents of Arab states👽 Specialists from the cyber intelligence group of the PT ESC TI department have discovered a maliciou…
Evolution of Dark Caracal tools
Evolution of Dark Caracal Tools 🐱 In the first quarter of 2024, a malicious sample came to the attention of the Threat Intelligence department at the Positive T…
Radio amateurs, get ready 📻
Radio enthusiasts, get ready 📻 The internal systems of the cyber intelligence group have discovered a hack of a website for radio enthusiasts. The site has exis…
C2 hunting: part 2.
C2 hunting: part 2. Hunting for hacker servers by external signs 😁 In the previous part, we talked about how to expand knowledge about hackers' infrastructure u…
Move like water. Be still like a mirror. Respond like an echo...
Move like water. Be still like a mirror. Respond like an echo... 🪞 In this post, we will discuss a discovered instance of a phishing page. It is notable for emp…