Topic
Positive Technologies
Positive Technologies Discontinues Active Development of PT AF 3, Shifts Focus to PT AF PRO and PT Cloud AF
Other
Positive Technologies Acquires Stake in CyberOK to Advance EASM and PentOps Technologies
Vulnerabilities & Exploits
10 Non-Obvious S3 Integration Vulnerabilities Exposed in Web Application Bug Bounty Research
Vulnerabilities & ExploitsExploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access
A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.
Positive Technologies Develops Dynamic Crawler for Single-Page Applications in PT BlackBox Scanner
Positive Technologies engineers have detailed the development of a dynamic crawler for their PT BlackBox DAST scanner to handle modern single-page applications built with frameworks such as React and Vue. The crawler must discover attack surface elements that only appear after user interactions because static parsing of initial DOM fails on SPAs where navigation occurs without URL changes. Key challenges include identifying interactive elements whose handlers are attached via JavaScript, detecting state changes after clicks or inputs, and managing combinatorial explosion of states caused by independent UI toggles. The team models the application as a labeled transition system and defines state equivalence using sets of 64-bit fingerprints of interactive elements rather than raw HTML similarity or URL values. This equivalence relation satisfies reflexivity, determinism from external observations, cheap hash-based comparison, slower growth than action count, and preservation of enabled actions across equivalent states. The approach allows the crawler to visit representatives of equivalence classes instead of every reachable state, keeping scans finite and practical within action budgets of several thousand interactions.
Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A security researcher known as grizzzer detailed a full attack chain that resulted in defacing the authorization page of the First Partner Bank digital banking service inside the Standoff 365 online polygon. The demonstration began with a successful DNS zone transfer against the fpb.stf domain, revealing the dbo.fpb.stf host that hosted the target application. After identifying the Node.js, Express, and React stack, the researcher discovered that the receipt generation endpoint accepted an undocumented pretty parameter that was passed directly into the Pug template engine. This led to a server-side template injection vulnerability that was escalated to a Node.js reverse shell. With code execution, the attacker located and modified the translation.json localization file, replacing the welcome message with the string pwned by VON visible to all users. The write-up concludes with concrete hardening recommendations including disabling zone transfers, avoiding direct spread of req.query into templates, and restricting outbound connections.
Grep_Tribe Blue Team Shares SOC Defense Lessons from Standoff 17 Cyber Battle
The Grep_Tribe team participated in Standoff 17 for the third time, defending the RetailSTF Group infrastructure in a simulated State F environment against continuous red team attacks. They handled 37 confirmed incidents, 22 detected incidents, five investigated critical events, and maintained 88 percent average infrastructure availability. The team used familiar Positive Technologies tools alongside the new R-Vision SOAR platform to automate routine responses such as IP blocking and file sandboxing. Work was organized through a tribal system with role-based preparation and dynamic small-group investigations for complex attack chains. Participants highlighted how the event tested prioritization, Threat Intelligence attribution, and automation under high-intensity conditions unlike daily SOC operations. The experience reinforced plans to expand SOAR playbooks for repetitive tasks in their real internal SOC environment.
Starting in Bug Bounty: Understanding 1-Day Vulnerabilities
Mikhail Klyuchnikov, known in the bug hunting community as n1, shares his decade-long experience at Positive Technologies leading a team focused on software security analysis. The team specializes in discovering new zero-day vulnerabilities while also reproducing known 1-day issues to support penetration testing engagements. Klyuchnikov is also a member of the PT SWARM team, which regularly publishes technical articles, tips, and timely vulnerability breakdowns. With extensive participation in international bug bounty platforms and the Russian Standoff Bug Bounty program, he aims to explain the practical role of 1-day vulnerabilities for newcomers entering bug bounty hunting. The article provides foundational knowledge on how security researchers leverage publicly disclosed vulnerabilities in real-world testing scenarios.
Positive Technologies Enhances PT Dephaze with Local LLM for Automated Credential Discovery and Attack Expansion
Positive Technologies has released a major update to its automated penetration testing system PT Dephaze, integrating a local large language model that actively searches for login credentials and develops attacks. The LLM analyzes configuration and text files across network shares to locate potential usernames and passwords, then validates them against discovered corporate services while discarding invalid combinations. Working credentials are immediately used to extend the simulated attack chain, including privilege escalation on Unix and Linux systems and credential reuse across multiple services. The update also adds support for FreeIPA directory services commonly found in import-substituted infrastructures, enabling anonymous user enumeration when configurations permit. All processing occurs locally within the product distribution, ensuring no data leaves the customer environment. Positive Technologies positions this LLM integration as the first step in expanding AI-driven attack techniques, with future plans focused on Russian operating systems.
Positive Technologies Wraps Up Third Positive Hack Camp with 81 Students from 20 Countries
Positive Technologies has completed the third edition of its international Positive Hack Camp cybersecurity training program. More than 80 students from 20 countries traveled to Moscow at their own expense to receive intensive instruction in ethical hacking and information security. The two-week program featured 30 practical sessions delivered by experts from Positive Technologies and invited instructors from Lebanon. Participants studied attack modeling, network traffic analysis, privilege escalation in web applications, operating system security, and reverse engineering of complex devices. The camp also included cultural activities and concluded with examinations where all students passed and received diplomas. The initiative aims to strengthen global cyber resilience and build an international community of white hackers, with previous participants already contributing to national cybersecurity efforts in Algeria.
Why Automation Alone Fails to Improve SOC Efficiency: The Case for Managed Operational Models
Mature security infrastructure does not guarantee protection against cyber threats, as attacks can still cause downtime, crisis recovery, and financial damage even when key controls are deployed. Automation of routine tasks helps speed up responses but cannot raise SOC effectiveness without clear decision criteria, defined responsibilities, and repeatable incident-handling processes. Organizations using an average of 83 security tools from 29 vendors face fragmentation that automation alone cannot resolve. A managed SecOps model covering the full incident lifecycle—from detection and prioritization through investigation, response, closure, and post-incident improvement—is required. Positive Technologies highlights that SecOps platforms such as MaxPatrol 360 provide the unified environment needed to link context, processes, coordination, automation, metrics, and continuous improvement.
Positive Technologies Adds Unified Console to PT X for Centralized Incident and Asset Management
Positive Technologies has introduced a single console within its PT X platform that combines incident management, asset control, and security posture assessment. Customers can now monitor attack attempts around the clock, view possible causes, track response status, and prioritize events without switching between multiple interfaces. The system lets organizations predefine which assets Positive Technologies may act upon and choose between manual customer response, automatic PT X actions, or approval-based workflows, with full audit reports generated afterward. A dedicated dashboard highlights coverage gaps by showing hosts protected by MaxPatrol EDR and flagging assets without agents installed. Machine learning capabilities have been expanded through a combination of large language models and classical ML to accelerate early attack detection and automate handling of low- and medium-severity incidents. Additional features include external perimeter analysis that reveals internet-facing resources from an attacker’s perspective and a bug-bounty-style cyber testing program that rewards researchers for identifying unacceptable events.
Positive Technologies Uncovers Disinformation Factory Linking 45 Domains and 74 Telegram Channels
Researchers at Positive Technologies have exposed an integrated disinformation operation that combined fake government emails with a network of pseudo-news websites and synchronized social media channels. The campaign began with emails sent from lookalike domains such as minpromtorg.digital and gosuslugi.digital, requesting employee lists and salary data to prepare targeted phishing attacks. Parallel to the email activity, operators maintained at least 45 domains including rulenta.live and crime24.live that mixed genuine stories with fabricated content and cited nonexistent sources. These sites were amplified through dozens of Telegram channels and accounts on VKontakte, Odnoklassniki, YouTube, Instagram, and TikTok, creating a self-reinforcing loop where fabricated claims were quoted back as credible reporting. Investigators noted a possible infrastructure overlap with the cybercriminal group Rare Werewolf, although direct attribution remains unconfirmed. The operation demonstrates a complete information pipeline from initial reconnaissance via email to wide distribution of disinformation across multiple platforms.
Malicious npm Packages Deploy Multi-Stage Trojan with Embedded GitLab Keys
Positive Technologies researchers uncovered a campaign in which an attacker published multiple trojanized packages to the npm registry under the accounts alex05255, mdrafiqulislamrabby, b.w1001, abdev8773 and mollspotwood54400. The affected packages include svg-fetcher, tradepilot, polytrade, polymarket-kit, react-svg-chunk, gamified-trading-system, font-huge, font-hub, mdb-vite, router-processor and route-processor. Each package concatenates several constants to build a C2 URL, downloads the next stage identified as token versions 106, 107, 108 and 116, and sends the hardcoded value logo in the bearrtoken header. Later stages contain heavily obfuscated JavaScript that collects username, hostname and operating-system information before establishing a WebSocket channel for command execution. Releases 106 and 116 also embed a public-private key pair belonging to a private GitLab instance operated by the threat actor, suggesting the use of CI/CD pipelines for code obfuscation and stage generation. The findings highlight the continued risk of supply-chain attacks through popular open-source repositories and the value of automated package monitoring.
Star in the Machine Fog: How AI Became Weapon, Target and Voice in the Browser
AppSec engineer Yuri Tumanov from Rostelecom, together with Igor Korkin of Positive Technologies and Oksana Dokuchaeva of FMBA Russia, examines how generative AI reshapes attack economics and defensive controls. The article outlines five distinct roles of AI in cybersecurity: accelerator of attacks, trusted assistant under compromise, leakage vector, protective shield, and direct target of prompt injection and data poisoning. It stresses that AI does not invent new threats but removes friction from social engineering, code generation and tool orchestration while expanding the attack surface through browser sessions, retrieval corpora and agent permissions. The authors advocate deterministic policy engines, provenance tracking, step-up approvals and device posture checks rather than relying on system prompts alone. The piece is framed as a cyberpunk narrative grounded in real AppSec, blue-team and threat-modeling practices for authorized testing environments.