Information security

Can you train a cyberattack detector without ever showing it a real cyberattack?

It sounds like a contradiction. If you want a neural network to detect lateral movement, you would expect to show it lateral movement. I did the opposite: I generated an entire corporate network with its login history, staged an attack inside that artificial world, and trained networks on it. Not a single real row in the training data. The whole world is a 135-line config; each network has four thousand parameters and trains in seconds on a laptop, and the best result came from six of them, trained on six different invented worlds.

Then I pointed them at real data: the authentication logs of Los Alamos National Laboratory, 1.65 billion events, with red-team exercises labelled in them.

And it worked. The networks rank 3.6 million windows by suspicion, and the top twenty-three rows of that list hold sixteen real attacks and seven false alarms: all the analyst has to do is open those rows. A threshold counter on the same data needs a hundred and sixty-one thousand false alarms to reach the sixteenth attack. By AUC the synthetic training landed inside the range of published research trained on real labelled data, although the two cannot be compared head-on, and I will explain why.

When I added mobile personas to a browser that already had desktop ones working, I assumed the work was mostly string substitution: swap the user agent, set touch points to 5, shrink the viewport, done. That assumption survived about a day.

Mobile fingerprints aren’t a variant of desktop fingerprints. They’re a different set of constraints, and most of the desktop toolkit either doesn’t apply or actively gives you away. Here’s what I ran into, in the order it hurt.

Finding a misconfiguration and proving an attack path are different tasks. ADhammer is an open-source Rust toolkit built around that distinction.

The workflow is simple:

Collect → Graph → Validate → Report

Collection first

The collector reads directory objects, ACLs, trusts, delegation, GPO signals, privileged principals, and certificate-template data. The result is an observation of the directory state—not an automatic compromise claim.

Graph context

AD relationships become typed edges: membership, control, delegation, enrollment, trust, and privilege. This makes a finding reviewable. A reader can ask which object creates the edge, which control is missing, and whether the route reaches a Tier 0 target.

Validation with a boundary

Validation is optional and intended for an authorized lab. When a supported workflow captures the expected proof, the finding records that validation state. Unsupported routes stay marked as potential instead of being promoted to confirmed exploits.

Evidence in the report

A useful finding keeps the affected objects, impact, remediation, commands, and proof metadata together. ADhammer exports JSON for automation, Markdown and HTML for human review, and graph-oriented data for existing identity-analysis workflows.

Why this matters

A report should let another operator understand what was observed, what was tested, and what remains unconfirmed. That makes remediation easier to prioritize and makes technical criticism productive.

ADhammer is still early software. It does not claim universal exploitability or replace operator judgment. The project is intended for authorized assessments and research environments, and technical review is welcome.

Two months ago I gave an agent a simple job: log into a vendor portal, download last month’s invoice PDF, rename it, drop it in a folder. It worked on my laptop. It failed on the server, silently, in a way that took me a full day to understand — the page loaded, the DOM was there, the login form was there, and the credentials were rejected with a generic error. No CAPTCHA. No block page. Just “something went wrong.”

In spring 2026, researchers at the Positive Technologies Expert Security Center (PT ESC) identified an unusual campaign targeting users in Saudi Arabia. The campaign used a previously unknown APK named Chrome.apk. The sample immediately stood out. Behind a benign-looking Google Chrome update screen and an unexpected request to enable Accessibility Services, we found a heavily protected execution chain that ultimately deployed Android spyware.

In the first half of 2026, we discovered activity by the East Asian threat group FamousSparrow. Its attacks targeted several countries in South Asia and Europe. In these attacks, the threat actor used its own malware: a heavily reworked variant of the modular SparrowDoor backdoor and a new backdoor that we named SquawkDoor.

FamousSparrow, also known as Salt Typhoon and Earth Estries, is an East Asian threat group that has been active since 2019. The group is known for using its proprietary SparrowDoor backdoor and initially focused on attacks against hotels worldwide, as well as government and international organizations. Later, FamousSparrow began actively targeting telecommunications companies and internet service providers, apparently seeking long-term access to lawful communications intercept systems.

In these attacks, the threat actor used both malicious LNK files and a website compromise vector involving malicious JavaScript. The injected script displayed a fake error message when a user visited the page and prompted them to download a new certificate. In reality, the download was a malicious executable that led to backdoor infection. The attacks were tailored to specific countries: the JavaScript samples and payloads contained text customized for the target country.

Have you ever hidden something inside a PNG? A basic way to securely hide something inside an image. And all in your favorite JavaScript!

A lot of security conversations still start with a familiar question:

EV charging platforms look familiar at first: APIs, cloud infrastructure, mobile apps, CI/CD, Kubernetes, telemetry, admin tools, and billing-adjacent logic. But the risk model is different. A weakness in authorization, release governance, device identity, or observability can affect not only data, but also charging sessions, stations, firmware, fleet operations, and recovery workflows.

This article explains how to approach EVSE as a Product Security problem, not just an AppSec problem.

На прошлой неделе исследователи «Лаборатории Касперского» опубликовали разбор свежей кампании по распространению вредоносного ПО в Steam Workshop, встроенной в игровую платформу Steam мастерской для обмена пользовательским контентом. Для заражения пользователей злоумышленники используют программу Wallpaper Engine — это платная утилита для создания кастомных обоев рабочего стола. Возможности программы достаточно широки — от анимации и воспроизведения видео до запуска приложений. Именно этой особенностью и воспользовались организаторы атаки.

Исследователи наблюдали два варианта распространения вредоносного ПО под видом анимированных обоев. В самом простом варианте жертве доставлялся архив, внутри которого содержались и обещанные обои, и вредоносные файлы. Чуть более сложный метод предполагал распространение в уже запароленном архиве. К нему был приложен скрипт, который распаковывал архив и запускал вредоносную нагрузку автоматически. Обои публиковались в Steam Workshop с конца 2025 года. Авторы отчета обнаружили десятки вредоносных обоев, причем некоторые из них имели десятки тысяч скачиваний. Результат установки такого ПО ожидаемый: кража учетной записи Steam, установка вымогателя-шифровальщика и запуск криптомайнера.

Even among the dots and dashes, you can recognize the hand of a radio operator. And by the style of typing on a computer keyboard, it has become possible to determine the author of the text with almost 100% accuracy.

As a result, we get another sign of identification and authorization.

Malicious code was injected into four Laravel-Lang projects, presumably stealing credentials from the devices on which it was run.

Popular projects were affected: Lang, Actions, Attributes, and HTTP Statuses.

The incident concerns not only Laravel...

In Part II we saw that an API key is essentially a long, secret password your software shows to a server. It works, but it has a hidden cost: every time the key is used, the server must look it up in a database to find out what the key is allowed to do, whether it has expired, and whether it has been switched off. A JSON Web Token (JWT) removes that lookup by carrying all of that information inside the token itself. This article explains the problem JWT solves and shows where it sits in the larger story of web authentication.

Part I covered Basic Authentication — sending a username and password with every request. Part II covered API keys — replacing that reusable password with a single opaque secret string that identifies an application rather than a person.

In early 2026, one new law and one far‑reaching legislative initiative are expected to seriously affect digital freedoms in the EU. The first allows police to collect biometric data and target individuals; the second aims to put all metadata into one box and then use AI to run investigations. Naturally, both laws were adopted under the mantra of protecting democratic values, rights, and freedoms. Xeovo has examined the sprawling regulatory texts and explains what exactly Members of the European Parliament are aiming at.

Analyzing a Denuvo bypass approach based on virtualization (Resident Evil: Requiem).

This article serves more or so to analyze this bypass approach and how to circumvent it on Denuvo’s side.

In November, 2025 Russia-based web host Media Land was sanctioned by several countries as a bulletproof service — the one hackers relied on to launch DDoS attacks and attack businesses in the United States and in allied countries. “Bulletproof” may refer to a VPN as well, as it usually means abuse resistant and private. Xeovo explains how genuinely reliable anonymous VPNs and hostings differ from bulletproof services — and why the real bulletproof operators are often not those who call themselves that.

The Art of Comeback of the European Bureaucracy 

On November 26, Members of the European Parliament rejected the Chat Control Act in its current version, i.e, mandatory scanning of the user traffic before it gets encrypted. Lawmakers, however, will hardly give up: requirement for mandatory scanning shall be reconsidered every three years. Xeovo explains what is the story behind this law and why, in reality, there’s little justification for passing it.

Hey, Habr! Ivan Glinkin is here again, head of the hardware research group from the Bastion team. 

"A flash drive with a combination lock," "a flash drive with hardware encryption," "an encrypted USB drive," and finally, the proper term — "Cryptographic Module". An encrypted USB flash drive goes by many names, but the core concept remains the same.

The purpose of such a device is to protect sensitive information from unauthorized access at both the software and hardware levels through encryption, anti-tampering mechanisms, and various other safeguards. But are these secure USB drives really as reliable as they're made out to be, or is it all just smoke and mirrors? 

We decided to look past the marketing claims and conduct our own investigation, attempting to crack several of these devices using hardware reverse engineering. We attempted to extract data, identify the encryption algorithms used, physically open the drives, and read their memory chips.

The results were quite interesting. Read on for the details.

This article is not about Puppeteer being a bad tool. Puppeteer is excellent. And competent TLS fingerprinting will bypass most defenses. But there is a class of tasks where even a perfect network stack won't save you — because detection has long since landed at the level of rendering engine behavior. Let's take a look at how Cloudflare and Akamai expose you through WebGL and Canvas, and why “clean” code no longer works.

In this guide, we will install the v2rayA package on OpenWRT using the stable 23.05.0. A router with at least 128 MB of RAM (256 is preferable) and more than 16 MB of storage is recommended (the installation takes about 30 MB of storage)

v2rayA is a simple-to-use and powerful client focused on Linux. Despite its name, the current version uses xray-core, although it's also possible to use v2ray-core. It has a web interface for managing settings and importing configurations and subscriptions. It supports everything that xray-core supports:

Shadowsocks (incl. 2022), ShadowsocksR, Trojan, Vless (including XTLS-Reality, XHTTP), Vmess, Juicity, Tuic

The guide will include:

1. Installation from the repository

2. Configuring v2rayA and bypassing blocks using Re:filter, Antifilter GeoIP, Geosite

Recently, I needed to run a VLESS subscription on Windows, make it work with my work VPN, and deal with all the associated 'joys.' I tried v2rayN, Nekoray, and Hiddify—and quickly realized I wanted to write my own client.
And so, singbox-launcher was born:
👉 https://github.com/Leadaxe/singbox-launcher

Below are a few details about why and what came of it.