Purpleshift
Recent
New actor: Citrus Ransomware Group
A Trusted Relationship is used as the initial attack vector
Attacks via GPO: no need for malware
How compromising group policies disrupted manufacturing operations
What we learned this spring: 1H 2026 digest
10 most popular PurpleShift posts from January to June
Labooboo backdoor: detailed analysis
Malware communicates with C2 via the Element messenger and the HiveMQ MQTT broker
Attack via xattr: how malware hides in Linux
Detecting attempts to hide payloads in extended file attributes
Cypher injection into Neo4j exposes passwords
Vulnerability in Cypher query construction gives attackers broad capabilities
How to detect ClickFix
Breaking down an attack that makes a user run malicious code
Using LLM to build Mythic C2 agents
How we accelerated the development of pentesting tools
bind_tcp_agent: сonnecting Mythic to remote agents via TCP
Unlike traditional C2 agents, this virtual callback generates no binary payload