New actor: Citrus Ransomware Group
A Trusted Relationship is used as the initial attack vector
BlueTeam
Attacks via GPO: no need for malware
How compromising group policies disrupted manufacturing operations
What we learned this spring: 1H 2026 digest
10 most popular PurpleShift posts from January to June
Labooboo backdoor: detailed analysis
Malware communicates with C2 via the Element messenger and the HiveMQ MQTT broker
Attack via xattr: how malware hides in Linux
Detecting attempts to hide payloads in extended file attributes
How to detect ClickFix
Breaking down an attack that makes a user run malicious code
Hack yourself: breaking down ClickFix
How to detect an attack that masquerades as a CAPTCHA
Certighost: a new vulnerability in Windows Server
How to find out if your servers have been attacked
Hacker group Labooboo developed its own backdoor
New malware uses MQTT and Matrix protocols to talk to C2
Detecting Certighost attack
A user with minimal privileges can gain control over the domain
Attacks on Education
Schools and universities are hacked through stolen accounts and outdated software
Our Incident Response talks at DEFCON
Guts of ransomware, Bitlocker abuse, and a workshop on investigative skills
HeartlessSoul APT uses blockchain to hide C2
Command & control addresses are transmitted in BNB Smart Chain and Solana transactions
How BitLocker becomes ransomware
Incidents in Latin America show how secure configuration could prevent encryption
Leaks through Claude Code and other missed incidents
Our Compromise Assessment service report features such a hidden threat as generative AI
Large-scale attack via stealthy ScreenConnect installation
Users receive attackers’ remote access tool along with popular freeware
Ghost in the RAM: weaponizing memfd_create() for fileless attacks
How to detect malware that runs on Linux systems without writing on disk
Web shells in backups: natural persistence
Some stats on threats found in backups during compromise assessment
Hacker group VasyGrek expands its arsenal
New attacks use .vbs droppers, .com droppers, and .com stealer written in Rust
Malicious Network Provider DLL allows stealing credentials
Registration of a malicious provider can be detected in ProviderOrder and ProviderPath parameters