Purpleshift
Recent
How BitLocker becomes ransomware
Incidents in Latin America show how secure configuration could prevent encryption
Extracting secrets from Octopus Deploy
Attackers can get valuable data even if they don’t have access to the web version of the tool
Leaks through Claude Code and other missed incidents
Our Compromise Assessment service report features such a hidden threat as generative AI
Large-scale attack via stealthy ScreenConnect installation
Users receive attackers’ remote access tool along with popular freeware
Ghost in the RAM: weaponizing memfd_create() for fileless attacks
How to detect malware that runs on Linux systems without writing on disk
Web shells in backups: natural persistence
Some stats on threats found in backups during compromise assessment
NTLM Reflection attack: when it works
Under what conditions can a non-domain Windows host be compromised
Hacker group VasyGrek expands its arsenal
New attacks use .vbs droppers, .com droppers, and .com stealer written in Rust
Malicious Network Provider DLL allows stealing credentials
Registration of a malicious provider can be detected in ProviderOrder and ProviderPath parameters