One on one with Rust
One on One with Rust ☹️ Recently, the complex threat research group of Positive Technologies' TI department has been increasingly encountering malware written i…
We will protect your money… Just give it to us.
We will protect your money… Just give it to us 😏 At the beginning of the year, specialists from the cyber intelligence group of the TI department at the Positiv…
New PhaseShifters Campaign
New PhaseShifters campaign 👽 Throughout May, the PT ESC cyberthreat intelligence team has been tracking a wave of activity by the PhaseShifters hacking group, w…
🛡 Puma: how a rootkit provides covert SSH access through stealthy key substitution
🛡 Puma: how a rootkit provides covert SSH access through stealthy key substitution Continuing our story about the activities of the ExCobalt group and its new t…
Trust but verify, or How to choose TI sources wisely
Trust but verify, or How to choose TI sources wisely 😏 In the life of the vast majority of SOC centers, there comes a time when you need to supplement your tool…
The PT ESC cyber intelligence team has prepared a report on the results of the first quarter of 2025.
PT ESC cyber intelligence team has prepared a report on the results of the first quarter of 2025 ✍️ It compiles the most notable attacks by hacker groups on the…
How did SaT entangle several groups at once in a tangle?
How did CaT entangle several groups at once? 🧶 In the fall of 2024, our attention was drawn to an interesting tool discovered while studying the activity of the…
(Ex)Cobalt == (Ex)Carbanak
(Ex)Cobalt == (Ex)Carbanak 🤔 Since the beginning of 2025, the PT ESC team has observed a rise in the number of attacks using the SshDoor backdoor. Russian gover…
Team46 and TaxOff: two sides of the same coin
Team46 and TaxOff: Two Sides of the Same Coin😑 In March 2025, specialists from the TI department of the Positive Technologies Expert Security Center (PT Expert…
APT group Cloud Atlas attacks Russian defense industry enterprises
APT group Cloud Atlas attacks Russian defense industry enterprises 🌎 At the end of last year and the beginning of this year, a cyber intelligence group discover…
Big Browser is watching you
Big Browser is watching you 👹 The cyber intelligence group has recorded a new campaign using an updated stealer Unicorn, which began in mid-February and continu…
In Puma's footsteps: how to detect a rootkit through its own interface
🐾 Following in Puma's Footsteps: How to Detect a Rootkit Through Its Own Interface Today, our review covers a technically interesting and multifunctional Linux…