HabrJuly 20, 2026🇷🇺Translated from Russian

New Russian Translations of Leading Cybersecurity Books on Ethical Hacking, Reverse Engineering, Malware Analysis, and Privacy Released

A well-known Russian-language cybersecurity library has released a substantial batch of new translations of leading English books on ethical hacking, bug bounty hunting, reverse engineering, malware analysis, and privacy.

The project, which continues the long-running series “Materials on Hacking in Russian,” focuses on translating high-quality resources and hosting them on the Hackbooks site. The latest update adds more than a dozen titles that span web application security, network discovery, protocol exploitation, binary analysis, and defensive techniques.

Web Application Security and Bug Hunting

Web Hacking 101: How to Make Money Hacking Ethically presents more than thirty real-world vulnerability disclosures, covering HTML injection, XSS, CSRF, open redirects, remote code execution, and business logic flaws, each accompanied by attack classification, original reports, bounty amounts, and key takeaways.

Real-World Bug Hunting: A Field Guide to Web Hacking by Peter Yaworski walks readers through rewarded vulnerability reports, dedicating chapters to XSS, CSRF, SSRF, SQL injection, XXE, subdomain takeover, IDOR, OAuth issues, race conditions, and logic errors while also explaining how to select bug bounty programs and write effective reports.

Network Security and Protocol Analysis

The official Nmap Network Scanning guide covers host and service detection, firewall and IDS evasion, performance tuning, and automation via the Nmap Scripting Engine, with practical scenarios for network inventory, penetration testing, rogue access point discovery, and worm response.

Attacking Network Protocols: A Hacker’s Guide to Capture, Analysis, and Exploitation teaches traffic capture, modification, and replay, followed by static and dynamic analysis, protocol reverse engineering, custom proxy and dissector development, fuzzing, debugging, memory corruption exploitation, authentication bypass, and denial-of-service techniques.

Reverse Engineering and Binary Analysis

Reverse Engineering for Beginners is a large free textbook that teaches assembly reading and logic reconstruction, illustrating how C and C++ constructs appear after compilation, covering function calls, stack, memory, optimizations, system APIs, multiple architectures, and operating systems.

How to Approach Binary File Format Analysis explains encodings, endianness, numbers, flags, structures, alignment, signatures, and headers, offering a practical workflow using histograms, string searches, section extraction, and pattern matching for digital forensics, malware analysis, data recovery, and converter development.

Privacy, Surveillance, and Cryptography

Obfuscation: A User’s Guide for Privacy and Protest explores creating ambiguous or misleading data to resist mass surveillance, drawing examples from WWII chaff, social media bots, and search query masking tools while discussing technical and ethical limits.

Gigabytes of Power by Kiwi Bird connects societal and technological history with growing state and corporate control, covering mass surveillance, biometrics, cryptography, GSM and satellite TV hacking, propaganda, and counter-terrorism restrictions.

Crypto Wars: The Fight for Privacy in the Digital Age traces fifty years of conflict between privacy advocates and governments, examining debates around DES, academic freedom, crypto export controls, key escrow, and post-Snowden developments.

Windows Security and Malware Analysis

Windows Security Internals: A Deep Dive into Windows Authentication, Authorization, and Auditing by James Forshaw details kernel and user-mode security mechanisms including access tokens, security descriptors, rights checking, auditing, SAM, Active Directory, NTLM, and Kerberos, with PowerShell examples for hands-on exploration.

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software guides readers through the full malware investigation lifecycle—from initial file inspection to logic reconstruction—using static and dynamic analysis, disassemblers, debuggers, memory forensics, network behavior, packers, and shellcode, reinforced by laboratory exercises.

Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats focuses on malware that detects virtual machines, sandboxes, and analysis tools, covering anti-disassembly and anti-debugging methods, process injection, rootkits, fileless techniques, packers, obfuscation, and laboratory setup recommendations.

Fuzzing and Automated Testing

The Fuzzing Book is an interactive textbook demonstrating random, mutational, grey-box, grammar-based, search-based, and symbolic fuzzing, complete with executable Python examples and Jupyter notebooks that readers can run while studying.

Readers are encouraged to explore the full collection on Hackbooks and share the resources with the community. The translations significantly lower the barrier for Russian-speaking professionals and students seeking authoritative material on information security, reverse engineering, and antivirus research.

Related articles

AntiMalwareMalware & Botnets

MacSync Malware Evolves to Steal Cryptocurrency and Conceal Components in iCloud

Updated MacSync malware for macOS now arrives bundled with a stealer and backdoor, allowing attackers to harvest browser history, cookies, passwords, Telegram data, and cryptocurrency wallet details while maintaining persistent remote access. Discovered by Kaspersky researchers in September 2026, the new variant uses a multi-stage infection chain that begins with a fake application download, such as a document collaboration tool or crypto wallet. One component is delivered through a publicly shared iCloud calendar entry in ICS format, bypassing traditional loaders. After execution, MacSync requests administrator credentials, displays a fake macOS damage notification, and installs the stealer alongside a Finder-masquerading backdoor. The backdoor enables arbitrary code execution, file theft, browser extension installation, and replacement of the legitimate Ledger application with a malicious version to drain cryptocurrency funds. Users are advised to download software only from trusted sources and remain cautious of unexpected administrator password prompts.

HabrMalware & Botnets

Network Traffic Analysis Reveals 75% Malware Threats Over 10 Months of Monitoring

Positive Technologies analyzed anonymized data from PT Sandbox and PT Network Attack Discovery collected between October 2025 and July 2026. The study found that malicious software accounted for 75% of all detected threats in organizational network traffic. Information-stealing trojans made up 24% of malware samples, with 85% of those focused on credential theft. RATs, loaders, and ransomware each represented smaller but high-impact shares. Legacy vulnerabilities such as CVE-2017-0199 and CVE-2017-11882 remained active attack vectors. Activity from groups including MustangPanda, TA505, and APT37 was observed across finance, manufacturing, and government sectors.

BoletimSecMalware & Botnets

HEAVYGRAM Spyware Uses Telegram Bots for Command and Control Against Iranian Targets

Researchers at Group-IB have published a detailed analysis of HEAVYGRAM, a spyware family that abuses the Telegram messaging platform as its command-and-control infrastructure. The malware family was first observed in the second half of 2023 and has since been linked with moderate confidence to the Handala Hack group. Instead of operating dedicated servers, the operators rely on Telegram bots, accounts, and groups to register infected hosts, receive commands, exfiltrate stolen data, and deliver additional payloads. Once active, HEAVYGRAM captures screenshots, records audio, harvests cached files, and steals data from Telegram Desktop installed on the victim machine. The campaign primarily targets Iranian journalists, dissidents, and individuals opposed to the Iranian government. Infection vectors include malicious files distributed via messengers, disguised as legitimate applications such as Pictory, KeePass, or Telegram-related tools, sometimes delivered as HTML applications or scripts.

BoletimSecMalware & Botnets

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens in Brazil

Elastic Security Labs researchers have detailed the operations of the KREMLIN banking malware, tracked under the identifier REF9334, which targets Chrome and Edge browsers to harvest credentials and session tokens. The campaign focuses almost exclusively on Brazil, with 98 percent of the 1,515 identified infections located in the country and impersonating a dozen Brazilian banks. Infection begins with multi-stage JavaScript loaders disguised as banking documents, invoices, or corporate papers that require manual execution by the victim. The loaders then deploy C++ installers and malicious browser extensions that modify the Secure Preferences file, enable developer mode, and overwrite protection objects with forged metadata using a technique called Phantom Extension. Once active, the extension collects session tokens, cookies, sessionStorage and localStorage data, 15 days of browsing history, screenshots, open tab information, and full HTML of visited pages. The operation has run since May 2025 across seven distinct campaigns and began using Ethereum smart contracts for infrastructure on 19 May 2026.