At the red team operation against the macOS fleet of one fintech company in early 2026, we received an initial access through credential phishing - and stumbled in a minute to CrowdStrike Falcon. He shot every reverse-shell payload before the first callback. Recompilation, ellcode encryption...
At a gap analysis of a chemical enterprise last year, we found the SIS (Safety Instrumented System) Triconex controller, connected to the corporate network via an unmanageable switch. Without a firewall, without a VLAN, without traffic recording in SIEM. In the asset, this connection did not...
The company is 80 hosts. Bakapi via Veeam every night, storage policy - 14 days. Monday, morning - accounting can not open the database of 1C, file extensions on the file server have changed. After 40 minutes, the picture is clear: the ransomware walked through the file server, two domain...
On PHDays 9, the organizers launched an AI CTF of six tasks - out of 130 registered at least one flag, only 14 people handed over. Fourteen. One of the tasks, the Prediction Challenge, offered to download the model in pickle format to the Kaggle-analytah server and gain 1.0 accuracy on randomly...
About 139 000 activations of the string-aggressor for a 64-millisecond refresh interval. It is necessary so much that the charge leakage in the next cell breaks the threshold voltage and turns the bit. Figure from the work of Kim et al. (Carnegie Mellon + Intel, ISCA 2014) - for the most...
11 of the 11 password managers tested – 1Password, Bitwarden, LastPass, Dashlabe, iCloud Passwords and six more – were vulnerable to DOM-based Extension Clickjacking in the default configuration. That's it. No exceptions. Marek Tot showed this at DEF CON 33 in August 2025. One click of the user...
According to CrowdStrike Global Threat Report 2025, the average time of the email movement after initial access is 62 minutes. The record is 51 seconds. In a team of five analysts where I built a TI process, the processing cycle of the new IOC from the appearance in the feed to the triggering of...
In 2022, LastPass servers compromised, and the attackers took out the encrypted store of users - in total. Passwords inside were encrypted on the client side, but the URL of the sites, records names and metadata lay in the open form. In the following months, the crypto community recorded theft...
Business logic of hidden mining: why is it an intruder
The hidden miner is one of the “quiet” threats. Unlike a ransomware that claims to itself, the cryptominer generates a stable passive income for months. The scheme is simple: infect the maximum of cars, to mine Monero (XMR) through pools...
How the response to incidents of ICS SCADA differs from IT
Responding to incidents in industrial networks is based on another model of priorities. In the IT classic - CIA (Confidentiality, Integrity, Availability). In OT - Safety, Availability, Integrity, and only then Confidentiality. It does...
Business logic: why are the expansions attacked and what does it threaten the company
A browser extension is a JavaScript code with preferred access to DOM visited sites, cookies, storage and browser API. For the attacker, this is a ready-made bridgehead: you do not need to bypass EDR or exploit...
DDoS-attack business logic: TTPs on MITRE AT&CK and what SOC should see
Before building a DDoS-resistant infrastructure, let’s see how the attack looks through the TTPs prism – without that, the correlation rules and the detection will be curved.
The preparatory phase. The attacker assembles IP...
On the fintech pedest, the developers swore that the CSRF attack is impossible - "we have a set-off of CORS." After 40 minutes, a working PoC was ready: the POST-form automatically sent changed email linking the account. CORS had nothing to do with this query - the browser honestly sent the...
On the audit of the mobile arsenal of fintech companies from the top 30, we found the iPhone of the CFO, who for three weeks leaked the microphone records on the C2-server via HTTPS. At the same time, Intune cheerfully reported "compliant": encryption is actively installed, PIN is installed, iOS...
What is WAPT / WAPT
Web Application Penetration Testing (WATT or WAPT) is a systemic method of analyzing the security of web applications that simulates the actions of a real attacker. Unlike simply crawling vulnerabilities, where the program automatically checks the code and configurations...
Kill chain macOS operations: where C2 stands
Corporate Mac is Keychain with OAuth tokens, VPN configurations, active Slack and Teams sessions, SSH keys without a pass-free. According to CrowdStrike Global Threat Report 2025, 79% of attacks are delayed without malware (living off the land), and...
Threat model: how an attacker breaks the protection of the wireless network of the enterprise
A wireless network is the only segment of corporate infrastructure where an attacker does not need physical access to the switch port. Enough parking, floors above or cafe through the wall. According to...
яIntroduction: WebSocket in a modern web
WebSocket is a communication protocol that provides a two-way data transmission channel over a single TCP connection.
WS Protocol: handshake, frames, opcodes
The Client sends an HTTP request (GET method) and, if successful, the server returns an HTTP...
Why DLP System Without Behavioral Analytics Is Blind to Slices
DLP sees content and transmission channel. It works when a document with a “confidential” stamp goes to personal mail or is copied to USB. But the insider, who worked in the company for three years, knows which files are marked with...
On February 13, 2026, CISA gave the organizations three days to eliminate CVE-2026-1731 - pre-authentiction RCE in BeyondTrust Remote Support with CVSS 9.9. Three days. The operation was in active ransomware campaigns even before most teams managed to download the patch, not to mention testing...
