Information Security *

Can you train a cyberattack detector without ever showing it a real cyberattack?

It sounds like a contradiction. If you want a neural network to detect lateral movement, you would expect to show it lateral movement. I did the opposite: I generated an entire corporate network with its login history, staged an attack inside that artificial world, and trained networks on it. Not a single real row in the training data. The whole world is a 135-line config; each network has four thousand parameters and trains in seconds on a laptop, and the best result came from six of them, trained on six different invented worlds.

Then I pointed them at real data: the authentication logs of Los Alamos National Laboratory, 1.65 billion events, with red-team exercises labelled in them.

And it worked. The networks rank 3.6 million windows by suspicion, and the top twenty-three rows of that list hold sixteen real attacks and seven false alarms: all the analyst has to do is open those rows. A threshold counter on the same data needs a hundred and sixty-one thousand false alarms to reach the sixteenth attack. By AUC the synthetic training landed inside the range of published research trained on real labelled data, although the two cannot be compared head-on, and I will explain why.

When I added mobile personas to a browser that already had desktop ones working, I assumed the work was mostly string substitution: swap the user agent, set touch points to 5, shrink the viewport, done. That assumption survived about a day.

Mobile fingerprints aren’t a variant of desktop fingerprints. They’re a different set of constraints, and most of the desktop toolkit either doesn’t apply or actively gives you away. Here’s what I ran into, in the order it hurt.

Finding a misconfiguration and proving an attack path are different tasks. ADhammer is an open-source Rust toolkit built around that distinction.

The workflow is simple:

Collect → Graph → Validate → Report

Collection first

The collector reads directory objects, ACLs, trusts, delegation, GPO signals, privileged principals, and certificate-template data. The result is an observation of the directory state—not an automatic compromise claim.

Graph context

AD relationships become typed edges: membership, control, delegation, enrollment, trust, and privilege. This makes a finding reviewable. A reader can ask which object creates the edge, which control is missing, and whether the route reaches a Tier 0 target.

Validation with a boundary

Validation is optional and intended for an authorized lab. When a supported workflow captures the expected proof, the finding records that validation state. Unsupported routes stay marked as potential instead of being promoted to confirmed exploits.

Evidence in the report

A useful finding keeps the affected objects, impact, remediation, commands, and proof metadata together. ADhammer exports JSON for automation, Markdown and HTML for human review, and graph-oriented data for existing identity-analysis workflows.

Why this matters

A report should let another operator understand what was observed, what was tested, and what remains unconfirmed. That makes remediation easier to prioritize and makes technical criticism productive.

ADhammer is still early software. It does not claim universal exploitability or replace operator judgment. The project is intended for authorized assessments and research environments, and technical review is welcome.

Two months ago I gave an agent a simple job: log into a vendor portal, download last month’s invoice PDF, rename it, drop it in a folder. It worked on my laptop. It failed on the server, silently, in a way that took me a full day to understand — the page loaded, the DOM was there, the login form was there, and the credentials were rejected with a generic error. No CAPTCHA. No block page. Just “something went wrong.”

In spring 2026, researchers at the Positive Technologies Expert Security Center (PT ESC) identified an unusual campaign targeting users in Saudi Arabia. The campaign used a previously unknown APK named Chrome.apk. The sample immediately stood out. Behind a benign-looking Google Chrome update screen and an unexpected request to enable Accessibility Services, we found a heavily protected execution chain that ultimately deployed Android spyware.

In the first half of 2026, we discovered activity by the East Asian threat group FamousSparrow. Its attacks targeted several countries in South Asia and Europe. In these attacks, the threat actor used its own malware: a heavily reworked variant of the modular SparrowDoor backdoor and a new backdoor that we named SquawkDoor.

FamousSparrow, also known as Salt Typhoon and Earth Estries, is an East Asian threat group that has been active since 2019. The group is known for using its proprietary SparrowDoor backdoor and initially focused on attacks against hotels worldwide, as well as government and international organizations. Later, FamousSparrow began actively targeting telecommunications companies and internet service providers, apparently seeking long-term access to lawful communications intercept systems.

In these attacks, the threat actor used both malicious LNK files and a website compromise vector involving malicious JavaScript. The injected script displayed a fake error message when a user visited the page and prompted them to download a new certificate. In reality, the download was a malicious executable that led to backdoor infection. The attacks were tailored to specific countries: the JavaScript samples and payloads contained text customized for the target country.

I write about the point where software abstractions meet irreversible authority, with an emphasis on threat models, negative tests, and systems that fail closed.

AI-generated code often looks cleaner than code written by a tired developer at 2 a.m. It has sensible names, neat layers, comments, tests and even error handling. The problem starts when the code meets something the prompt forgot to mention: two requests at once, a repeated webhook, a cancelled task or a database failure halfway through an operation.

This article is about bugs that stay invisible during a normal code review. I took several ordinary backend tasks, generated working solutions and then tried to break them with timing, retries and bad input. The code compiled. The tests were green. Some of it was still unsafe.

The idea appeared after a normal working evening went slightly wrong.

I opened a repository, started a build, and noticed that nearly every useful action required a connection to somebody else’s server. The source code was hosted remotely. The CI runner was remote. Package metadata came from remote registries. Test files were downloaded from object storage. API collections were synchronized through a cloud account. Documentation lived in another browser tab. Even code completion waited for a remote model.

My laptop was powerful enough to compile the project, run several databases, and heat the room better than the radiator. Still, it behaved more like a terminal connected to a collection of external services.

So I made a simple rule for one month:

The main development workflow had to remain usable with the network disconnected.

I did not try to recreate the entire Internet in Docker. Public package registries, operating system updates, and communication tools were still allowed during planned synchronization periods. But coding, commits, builds, tests, documentation, API experiments, and basic code review had to work locally.

The first assumption was that this would mostly be a Docker Compose exercise.

It was not.

The containers were the easy part. The difficult part was discovering all the invisible contracts hidden inside a normal cloud-based workflow.

Have you ever hidden something inside a PNG? A basic way to securely hide something inside an image. And all in your favorite JavaScript!

A lot of security conversations still start with a familiar question:

EV charging platforms look familiar at first: APIs, cloud infrastructure, mobile apps, CI/CD, Kubernetes, telemetry, admin tools, and billing-adjacent logic. But the risk model is different. A weakness in authorization, release governance, device identity, or observability can affect not only data, but also charging sessions, stations, firmware, fleet operations, and recovery workflows.

This article explains how to approach EVSE as a Product Security problem, not just an AppSec problem.

На прошлой неделе исследователи «Лаборатории Касперского» опубликовали разбор свежей кампании по распространению вредоносного ПО в Steam Workshop, встроенной в игровую платформу Steam мастерской для обмена пользовательским контентом. Для заражения пользователей злоумышленники используют программу Wallpaper Engine — это платная утилита для создания кастомных обоев рабочего стола. Возможности программы достаточно широки — от анимации и воспроизведения видео до запуска приложений. Именно этой особенностью и воспользовались организаторы атаки.

Исследователи наблюдали два варианта распространения вредоносного ПО под видом анимированных обоев. В самом простом варианте жертве доставлялся архив, внутри которого содержались и обещанные обои, и вредоносные файлы. Чуть более сложный метод предполагал распространение в уже запароленном архиве. К нему был приложен скрипт, который распаковывал архив и запускал вредоносную нагрузку автоматически. Обои публиковались в Steam Workshop с конца 2025 года. Авторы отчета обнаружили десятки вредоносных обоев, причем некоторые из них имели десятки тысяч скачиваний. Результат установки такого ПО ожидаемый: кража учетной записи Steam, установка вымогателя-шифровальщика и запуск криптомайнера.

Malicious code was injected into four Laravel-Lang projects, presumably stealing credentials from the devices on which it was run.

Popular projects were affected: Lang, Actions, Attributes, and HTTP Statuses.

The incident concerns not only Laravel...

I've run both platforms in a real production environment — 600+ users, 50+ SaaS platforms, an international software company with distributed teams across multiple timezones. This isn't a vendor comparison page. This is what I actually experienced running both, migrating between them, and managing the transition in parallel.

The question "JumpCloud or Okta?" comes up constantly in IT communities. It almost always gets the same frustrating non-answer: "it depends." That's technically true — but let me break down exactly what it depends on, and why.

In Part II we saw that an API key is essentially a long, secret password your software shows to a server. It works, but it has a hidden cost: every time the key is used, the server must look it up in a database to find out what the key is allowed to do, whether it has expired, and whether it has been switched off. A JSON Web Token (JWT) removes that lookup by carrying all of that information inside the token itself. This article explains the problem JWT solves and shows where it sits in the larger story of web authentication.

Part I covered Basic Authentication — sending a username and password with every request. Part II covered API keys — replacing that reusable password with a single opaque secret string that identifies an application rather than a person.

In early 2026, one new law and one far‑reaching legislative initiative are expected to seriously affect digital freedoms in the EU. The first allows police to collect biometric data and target individuals; the second aims to put all metadata into one box and then use AI to run investigations. Naturally, both laws were adopted under the mantra of protecting democratic values, rights, and freedoms. Xeovo has examined the sprawling regulatory texts and explains what exactly Members of the European Parliament are aiming at.

C++ has trapped itself in an evolutionary dead end due to backward compatibility and UB, and the only realistic successor capable of displacing it in large codebases will be a transpiler that generates C++ and enables gradual, low-risk adoption.

Это перевод на английский язык статьи моей статьи Ахиллесова пята C++ и будущая р̶е̶ эволюция

Analyzing a Denuvo bypass approach based on virtualization (Resident Evil: Requiem).

This article serves more or so to analyze this bypass approach and how to circumvent it on Denuvo’s side.

In November, 2025 Russia-based web host Media Land was sanctioned by several countries as a bulletproof service — the one hackers relied on to launch DDoS attacks and attack businesses in the United States and in allied countries. “Bulletproof” may refer to a VPN as well, as it usually means abuse resistant and private. Xeovo explains how genuinely reliable anonymous VPNs and hostings differ from bulletproof services — and why the real bulletproof operators are often not those who call themselves that.

Hey, Habr! Ivan Glinkin is here again, head of the hardware research group from the Bastion team. 

"A flash drive with a combination lock," "a flash drive with hardware encryption," "an encrypted USB drive," and finally, the proper term — "Cryptographic Module". An encrypted USB flash drive goes by many names, but the core concept remains the same.

The purpose of such a device is to protect sensitive information from unauthorized access at both the software and hardware levels through encryption, anti-tampering mechanisms, and various other safeguards. But are these secure USB drives really as reliable as they're made out to be, or is it all just smoke and mirrors? 

We decided to look past the marketing claims and conduct our own investigation, attempting to crack several of these devices using hardware reverse engineering. We attempted to extract data, identify the encryption algorithms used, physically open the drives, and read their memory chips.

The results were quite interesting. Read on for the details.