Search results

The Gentlemen ransomware showed how dangerous the old problem of Windows with vulnerable drivers has become. In the Ecle-investigated attack, the group did not try to “dispute” the defense at the level of conventional processes, but rose lower to the nucleus of the system, and through an unknown...

The PolinRider attack no longer looks like a point story about malicious npm packages. Socket researchers found 162 malicious release artifacts in 108 packages and extensions, and the campaign’s footprints are now leading to multiple open source ecosystems, including npm, Packagist, Go modules...

DeepKeep researchers showed a new attack on multimodal AI systems, where the malicious team hides not in the text, but right inside the picture. This technique is called InkJect and hits the weak spot of modern defenses, which are well looking for suspicious instructions in the exercises, but...

On the internal pentest fintech company, I captured the manager’s session through a stolen session cookie - Use Alternate Authentication Material: Web Session Cookies (T1550.004, Lateral Movement) Twelve minutes later, the session was killed. Not timeout, not logout, not rotation of the token -...

The FUXA platform behind these identifiers is open-source SCADA/HMI on Node.js, which is typically raised by one team docker run -d -p 1881:1881 frangoteam/fuxa:latest and forget. Secure Mode, the only built-in FUXA authentication mechanism to protect API engrades, turned out to be so leaky that...

The business logic of the attack: why bypass authentication GlobalProtect needs an attacker GlobalProtect is a VPN solution of Palo Alto Networks built into PAN-OS. On the perimeter of enterprise networks, this is the entry point for remote employees, and for the attacker - an initial source...

Attacker infrastructure as a threat intelligence object Without a communication channel between the implant and the control server, the attack freezes at the post-exploitation stage: the operator cannot give commands, unload data, navigate the network. MITRE ATT&CK will classify the preparation...

Older components can last for decades in the Linux kernel, even when the original systems have long disappeared from operation, but the EFS file system is likely to leave the project already in the Linux 7.3 version. The driver code was put in line for deletion after more than 20 years without...

In the Linux kernel, a vulnerability has been found that turns an ordinary user into a root and can hurt not only servers and workstations, but also Android devices. The problem was named Bad Epoll and CVE-2026-46242. Researcher Jayön Jiang found an error in the subsystem epoll, assembled a...

Malware for macOS is increasingly using the standard mechanisms of the system, and the new PamStealer styler masks the theft of the password for the installation of the manager of the Maccy buffer. The malware is spread in the image of the disk and works in two stages. Inside is the AppleScript...

Wi-Fi router is usually remembered when the Internet disappears in the house, although this small device remains on for years and transmits all network traffic through itself. In OpenWrt 25.12.5, developers have closed several dangerous vulnerabilities in services that run by default and can...

Network gateways again found a weak point in working with memory, and this time the error allowed you to remotely receive data before logging in. Citrix revealed the vulnerability CVE-2026-8451 NetScaler ADC and NetScaler Gateway, which watchTown found in March 2026. The problem...

Extortion programs for decades demanded a person behind the keyboard – the one who writes a malicious scenario and is attacking. However, the IB-F. The Sysdig described The first documented case when the entire operation of extortion from beginning to end was carried out by a large language...

Business logic: why an attacker covert introduction of the code Process Injection (T1055, Defense Evasion / Privilege Escalation) - one of the most exploited techniques by both APT groups and commodity-malwarri operators. Purpose: to run arbitrary code on behalf of the legitimate process...

Educational goal is the basis of a good CTF task Before you open the code editor, answer one question: what specific skill will the participant work when solving this hand? Not “hanging” and not “feel” and “feel like a hacker” – but what he will learn. Task without an educational goal - just a...