Topic
Positive Technologies
Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
Vulnerabilities & Exploits
Grep_Tribe Blue Team Shares SOC Defense Lessons from Standoff 17 Cyber Battle
OtherStarting in Bug Bounty: Understanding 1-Day Vulnerabilities
Vulnerabilities & ExploitsPositive Technologies Enhances PT Dephaze with Local LLM for Automated Credential Discovery and Attack Expansion
Positive Technologies has released a major update to its automated penetration testing system PT Dephaze, integrating a local large language model that actively searches for login credentials and develops attacks. The LLM analyzes configuration and text files across network shares to locate potential usernames and passwords, then validates them against discovered corporate services while discarding invalid combinations. Working credentials are immediately used to extend the simulated attack chain, including privilege escalation on Unix and Linux systems and credential reuse across multiple services. The update also adds support for FreeIPA directory services commonly found in import-substituted infrastructures, enabling anonymous user enumeration when configurations permit. All processing occurs locally within the product distribution, ensuring no data leaves the customer environment. Positive Technologies positions this LLM integration as the first step in expanding AI-driven attack techniques, with future plans focused on Russian operating systems.
Positive Technologies Wraps Up Third Positive Hack Camp with 81 Students from 20 Countries
Positive Technologies has completed the third edition of its international Positive Hack Camp cybersecurity training program. More than 80 students from 20 countries traveled to Moscow at their own expense to receive intensive instruction in ethical hacking and information security. The two-week program featured 30 practical sessions delivered by experts from Positive Technologies and invited instructors from Lebanon. Participants studied attack modeling, network traffic analysis, privilege escalation in web applications, operating system security, and reverse engineering of complex devices. The camp also included cultural activities and concluded with examinations where all students passed and received diplomas. The initiative aims to strengthen global cyber resilience and build an international community of white hackers, with previous participants already contributing to national cybersecurity efforts in Algeria.
Why Automation Alone Fails to Improve SOC Efficiency: The Case for Managed Operational Models
Mature security infrastructure does not guarantee protection against cyber threats, as attacks can still cause downtime, crisis recovery, and financial damage even when key controls are deployed. Automation of routine tasks helps speed up responses but cannot raise SOC effectiveness without clear decision criteria, defined responsibilities, and repeatable incident-handling processes. Organizations using an average of 83 security tools from 29 vendors face fragmentation that automation alone cannot resolve. A managed SecOps model covering the full incident lifecycle—from detection and prioritization through investigation, response, closure, and post-incident improvement—is required. Positive Technologies highlights that SecOps platforms such as MaxPatrol 360 provide the unified environment needed to link context, processes, coordination, automation, metrics, and continuous improvement.
Positive Technologies Adds Unified Console to PT X for Centralized Incident and Asset Management
Positive Technologies has introduced a single console within its PT X platform that combines incident management, asset control, and security posture assessment. Customers can now monitor attack attempts around the clock, view possible causes, track response status, and prioritize events without switching between multiple interfaces. The system lets organizations predefine which assets Positive Technologies may act upon and choose between manual customer response, automatic PT X actions, or approval-based workflows, with full audit reports generated afterward. A dedicated dashboard highlights coverage gaps by showing hosts protected by MaxPatrol EDR and flagging assets without agents installed. Machine learning capabilities have been expanded through a combination of large language models and classical ML to accelerate early attack detection and automate handling of low- and medium-severity incidents. Additional features include external perimeter analysis that reveals internet-facing resources from an attacker’s perspective and a bug-bounty-style cyber testing program that rewards researchers for identifying unacceptable events.
Positive Technologies Uncovers Disinformation Factory Linking 45 Domains and 74 Telegram Channels
Researchers at Positive Technologies have exposed an integrated disinformation operation that combined fake government emails with a network of pseudo-news websites and synchronized social media channels. The campaign began with emails sent from lookalike domains such as minpromtorg.digital and gosuslugi.digital, requesting employee lists and salary data to prepare targeted phishing attacks. Parallel to the email activity, operators maintained at least 45 domains including rulenta.live and crime24.live that mixed genuine stories with fabricated content and cited nonexistent sources. These sites were amplified through dozens of Telegram channels and accounts on VKontakte, Odnoklassniki, YouTube, Instagram, and TikTok, creating a self-reinforcing loop where fabricated claims were quoted back as credible reporting. Investigators noted a possible infrastructure overlap with the cybercriminal group Rare Werewolf, although direct attribution remains unconfirmed. The operation demonstrates a complete information pipeline from initial reconnaissance via email to wide distribution of disinformation across multiple platforms.
Malicious npm Packages Deploy Multi-Stage Trojan with Embedded GitLab Keys
Positive Technologies researchers uncovered a campaign in which an attacker published multiple trojanized packages to the npm registry under the accounts alex05255, mdrafiqulislamrabby, b.w1001, abdev8773 and mollspotwood54400. The affected packages include svg-fetcher, tradepilot, polytrade, polymarket-kit, react-svg-chunk, gamified-trading-system, font-huge, font-hub, mdb-vite, router-processor and route-processor. Each package concatenates several constants to build a C2 URL, downloads the next stage identified as token versions 106, 107, 108 and 116, and sends the hardcoded value logo in the bearrtoken header. Later stages contain heavily obfuscated JavaScript that collects username, hostname and operating-system information before establishing a WebSocket channel for command execution. Releases 106 and 116 also embed a public-private key pair belonging to a private GitLab instance operated by the threat actor, suggesting the use of CI/CD pipelines for code obfuscation and stage generation. The findings highlight the continued risk of supply-chain attacks through popular open-source repositories and the value of automated package monitoring.
Star in the Machine Fog: How AI Became Weapon, Target and Voice in the Browser
AppSec engineer Yuri Tumanov from Rostelecom, together with Igor Korkin of Positive Technologies and Oksana Dokuchaeva of FMBA Russia, examines how generative AI reshapes attack economics and defensive controls. The article outlines five distinct roles of AI in cybersecurity: accelerator of attacks, trusted assistant under compromise, leakage vector, protective shield, and direct target of prompt injection and data poisoning. It stresses that AI does not invent new threats but removes friction from social engineering, code generation and tool orchestration while expanding the attack surface through browser sessions, retrieval corpora and agent permissions. The authors advocate deterministic policy engines, provenance tracking, step-up approvals and device posture checks rather than relying on system prompts alone. The piece is framed as a cyberpunk narrative grounded in real AppSec, blue-team and threat-modeling practices for authorized testing environments.