New actor: Citrus Ransomware Group
A Trusted Relationship is used as the initial attack vector
Blog
Attacks via GPO: no need for malware
How compromising group policies disrupted manufacturing operations
What we learned this spring: 1H 2026 digest
10 most popular PurpleShift posts from January to June
Labooboo backdoor: detailed analysis
Malware communicates with C2 via the Element messenger and the HiveMQ MQTT broker
Attack via xattr: how malware hides in Linux
Detecting attempts to hide payloads in extended file attributes
Cypher injection into Neo4j exposes passwords
Vulnerability in Cypher query construction gives attackers broad capabilities
How to detect ClickFix
Breaking down an attack that makes a user run malicious code
Using LLM to build Mythic C2 agents
How we accelerated the development of pentesting tools
bind_tcp_agent: сonnecting Mythic to remote agents via TCP
Unlike traditional C2 agents, this virtual callback generates no binary payload
Certighost: a new vulnerability in Windows Server
How to find out if your servers have been attacked
Hacker group Labooboo developed its own backdoor
New malware uses MQTT and Matrix protocols to talk to C2
Attacks on Education
Schools and universities are hacked through stolen accounts and outdated software
Turning a TURN server into an evil proxy
A video conferencing relay host can redirect traffic to C2
Our Incident Response talks at DEFCON
Guts of ransomware, Bitlocker abuse, and a workshop on investigative skills
Privilege escalation through trusts in AD
Trust relationships between domains facilitate various attacks
HeartlessSoul APT uses blockchain to hide C2
Command & control addresses are transmitted in BNB Smart Chain and Solana transactions
How BitLocker becomes ransomware
Incidents in Latin America show how secure configuration could prevent encryption
Extracting secrets from Octopus Deploy
Attackers can get valuable data even if they don’t have access to the web version of the tool
Leaks through Claude Code and other missed incidents
Our Compromise Assessment service report features such a hidden threat as generative AI
Large-scale attack via stealthy ScreenConnect installation
Users receive attackers’ remote access tool along with popular freeware