Yara Yara Daze
Yara Yara Daze Anyone involved in malware analysis is certainly familiar with a tool like YARA 😉. With its help, many companies 🔴 build sets of signature rules…
The PT ESC cyber intelligence team has prepared a report on the results of the first quarter of 2025.
PT ESC cyber intelligence team has prepared a report on the results of the first quarter of 2025 ✍️ It compiles the most notable attacks by hacker groups on the…
APT group Cloud Atlas attacks Russian defense industry enterprises
APT group Cloud Atlas attacks Russian defense industry enterprises 🌎 At the end of last year and the beginning of this year, a cyber intelligence group discover…
Big Browser is watching you
Big Browser is watching you 👹 The cyber intelligence group has recorded a new campaign using an updated stealer Unicorn, which began in mid-February and continu…
In Puma's footsteps: how to detect a rootkit through its own interface
🐾 Following in Puma's Footsteps: How to Detect a Rootkit Through Its Own Interface Today, our review covers a technically interesting and multifunctional Linux…
Looking for the necessary system calls
@The malware got into the system... @The malware wants to pull a prank... @The malware calls a WinAPI and... @The EDR system detects it and starts screaming ver…
Are you using cryptography correctly?
Are you using cryptography correctly? 🔓 The Advanced Threat Research Group of the Threat Intelligence department often has to solve interesting tasks in the pro…
1C_shell for "1C"
1C_shell for "1C" 🦞 Sometimes situations arise when, during an information security incident investigation, the traditionally used OS artifacts contain extremel…
Desert Dexter is a group targeting residents of Arab states.
Desert Dexter — a group targeting residents of Arab states👽 Specialists from the cyber intelligence group of the PT ESC TI department have discovered a maliciou…
Evolution of Dark Caracal tools
Evolution of Dark Caracal Tools 🐱 In the first quarter of 2024, a malicious sample came to the attention of the Threat Intelligence department at the Positive T…
C2 hunting: part 2.
C2 hunting: part 2. Hunting for hacker servers by external signs 😁 In the previous part, we talked about how to expand knowledge about hackers' infrastructure u…
A sucker is not a mammoth, an APK is not a video.
A fool and his money are soon parted, APK is not a video 🦣 In late 2024 — early 2025, information about the spread of the Mamont virus in Telegram was actively…