en
Feedback
APT

APT

Open in Telegram

This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat

Show more
Russia40 429Technologies & Applications7 782

📈 Analytical overview of Telegram channel APT

Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 16 236 subscribers, ranking 7 782 in the Technologies & Applications category and 40 429 in the Russia region.

📊 Audience metrics and dynamics

Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 16 236 subscribers.

According to the latest data from 29 August, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 560 over the last 30 days and by 13 over the last 24 hours, overall reach remains high.

  • Verification status: Not verified
  • Engagement rate (ER): The average audience engagement rate is 39.15%. Within the first 24 hours after publication, content typically collects 18.08% reactions from the total number of subscribers.
  • Post reach: On average, each post receives 6 354 views. Within the first day, a publication typically gains 2 934 views.
  • Reactions and interaction: The audience actively supports content: the average number of reactions per post is 26.

📝 Description and content policy

The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat”

Thanks to the high frequency of updates (latest data received on 30 August, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.

16 236
Subscribers
+1324 hours
+1017 days
+56030 days
Posts Archive
APT
APT
16 238
👻 Ghost: Shellcode Loader Ghost is a shellcode loader project designed to bypass multiple detection capabilities that are us
👻 Ghost: Shellcode Loader Ghost is a shellcode loader project designed to bypass multiple detection capabilities that are usually implemented by an EDR. 🚀 Feature: — Bypassing kernel callbacks with fiber threads — Stack spoofing (Return Address Spoofing and Function Hooking) — Hiding shellcode within large, randomized memory regions — Disabling ETW — Removing EDR function hooks with suspended processes — Custom API hashing for resolving functions 🔗 Source: https://github.com/cpu0x00/Ghost #edr #shellcode #kernel #memory #evasion

APT
APT
16 238
Repost from 1N73LL1G3NC3
Exploit for Windows Kernel-Mode Driver Elevation of Privilege Flaw (CVE-2024-35250)

APT
APT
16 238
Repost from 1N73LL1G3NC3
CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Injection Firing up the SQLMAP tool, and supplying it the endpoint an
CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Injection Firing up the SQLMAP tool, and supplying it the endpoint and parameter to inject and table to dump, it successfully dumps the entire users table: 
python3 sqlmap.py -u "https://10.0.40.64/bin/configurations/parsers/Checkpoint/CHECKPOINT.php?action=im port&type=test&project=pandbRBAC&signatureid=1" -p signatureid -T users --dump
CVE-2024-5910: Expedition: Missing Authentication Leads to Admin Account Takeover for attackers with network access 
curl -k 'https://10.0.40.64/0S/startup/restore/restoreAdmin.php'
CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Exploit CVE-2024-9466: Cleartext Credentials in Logs 
/home/userSpace/devices/debug.txt
This world-readable file contained the raw request logs of the Expedition server when it exchanged cleartext credentials for API keys in the device integration process. The Expedition server only stores the API keys, and is not supposed to retain the cleartext credentials, but this log file showed all the credentials used in cleartext. This issue was reported and assigned CVE-2024-9466. Blog: https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/ Shodan dork: 
html:"Expedition Project"

APT
APT
16 238
Repost from 1N73LL1G3NC3
KrbRelay-SMBServer This krbrelay version acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP. Re
+1
KrbRelay-SMBServer This krbrelay version acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP.
Relaying SMB to HTTP (ADCS) with a modified version of krbrelay using DFSCoerce and PetitPotam - classic ESC8 attack with Kerberos, no DCOM involved ;)

APT
APT
16 238
Repost from haxx
📖 Тем временем в NetExec (nxc) подвезли поддержку протокола NFS. Из функций сейчас доступен энум файловых шар (права и файлы
📖 Тем временем в NetExec (nxc) подвезли поддержку протокола NFS. Из функций сейчас доступен энум файловых шар (права и файлы рекурсивно), погрузка и разгрузка файлов. Базовый энум 
NetExec nfs IP --shares
Рекурсивный энум 
NetExec nfs IP --enum-shares
Забираем файл 
NetExec nfs IP --get-file /home/user/Desktop/test/lolkekpohek.txt lolkekpohek.txt
Заливаем файл 
NetExec nfs IP --put-file lolkekpohek.txt /home/user/Desktop/
🔗 Где почитать подробнее: Энум https://www.netexec.wiki/nfs-protocol/enumeration Льем/качаем файлы https://www.netexec.wiki/nfs-protocol/download-and-upload-files Исходники https://github.com/Pennyw0rth/NetExec/tree/main/nxc/protocols/nfs

APT
APT
16 238
Repost from 1N73LL1G3NC3
CVE-2024-26808 Linux kernel Netfilter Use-After-Free leads to LPE CVE-2024-26808 is a use-after-free vulnerability within the
CVE-2024-26808 Linux kernel Netfilter Use-After-Free leads to LPE CVE-2024-26808 is a use-after-free vulnerability within the Linux Kernel Netfilter, a powerful framework integral to the Linux networking stack. Netfilter provides essential networking operations such as packet filtering, network address translation (NAT), and port forwarding. The flaw arises from improper handling of network packet processing, leading to the potential for unauthorized memory access. Writeup: https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2024-26808_cos/docs/exploit.md

APT
APT
16 238
Underconf Конференция получилась просто огонь! Полезные доклады, превосходные спикеры и невероятная атмосфера. Отдельный респ
Underconf Конференция получилась просто огонь! Полезные доклады, превосходные спикеры и невероятная атмосфера. Отдельный респект за ностальгическую игровую зону, которая вернула в прошлое, и трек Pentest AD. Особая благодарность ISTINA lounge за уют и потрясающие чаи ❤️ «12 мундштуков из 10!» Спасибо организаторам за крутой эвент! 🔥

APT
APT
16 238
🚀 Elevating Privileges in Windows via Activation Cache Poisoning A deep dive into CVE-2024-6769, which leverages two chained
🚀 Elevating Privileges in Windows via Activation Cache Poisoning A deep dive into CVE-2024-6769, which leverages two chained bugs to escalate privileges from medium to high integrity. The first stage involves remapping the root drive, followed by a DLL hijacking exploit. The second stage poisons the Activation Cache through the CSRSS process to gain full administrator access. 🔗 Research: https://www.coresecurity.com/core-labs/articles/cve-2024-6769-poisoning-activation-cache-elevate-medium-high-integrity 🔗 Source: https://github.com/fortra/CVE-2024-6769 #windows #privesc #dll #hijacking

APT
APT
16 238
Repost from PT SWARM
ATTACKING UNIX SYSTEMS VIA CUPS, PART I 👤 by Simone Margaritelli A remote unauthenticated attacker can silently replace exis
ATTACKING UNIX SYSTEMS VIA CUPS, PART I 👤 by Simone Margaritelli A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer). Entry Points • WAN / public internet: a remote attacker sends an UDP packet to port 631. No authentication whatsoever. • LAN: a local attacker can spoof zeroconf / mDNS / DNS-SD advertisements and achieve the same code path leading to RCE. RCE chain • Force the target machine to connect back to our malicious IPP server. • Return an IPP attribute string that will inject controlled PPD directives to the temporary file. • Wait for a print job to be sent to our fake printer for the PPD directives, and therefore the command, to be executed. 📝 Contents: ● Summary ● Intro ● What is cups-browsed? ● Stack Buffer Overflows and Race Conditions ● Back to found_cups_printer ● Internet Printing Protocol ● PostScript Printer Description ● The problematic child: foomatic-rip ● Remote Command Execution chain ● Personal Considerations ● One More Thing https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

APT
APT
16 238
🔐 Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation This article explains how atta
🔐 Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation This article explains how attackers use malware virtualization, custom virtual machines, code obfuscation, and polymorphic packers to evade detection by EDR systems, allowing Red Teams to remain undetected in secure environments. 🔗 Source: https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/ #edr #evasion #virtualization #obfuscation #redteam

APT
APT
16 238
💻 Microsoft Office NTLMv2 Disclosure (CVE-2024-38200) A new vulnerability related to capturing NTLMv2 hashes via Office URI schemes has been discovered. The http:// protocol can be used for attacks such as NTLM relay to a Domain Controller. Microsoft 365 and Office 2019 versions are vulnerable, as they open remote files without warnings, unlike earlier versions. The exploit involves using a 302 redirect and abusing GPO misconfigurations to capture NTLMv2 hashes over SMB and HTTP. 🔗 Source: https://github.com/passtheticket/CVE-2024-38200 #windows #office #ntlm #relay

APT
APT
16 238
Repost from Волосатый бублик
Yeehaw! In TrustedSec new blog post, CSO & VP of Consulting Services Martin Bos highlights some new command line interface (C
Yeehaw! In TrustedSec new blog post, CSO & VP of Consulting Services Martin Bos highlights some new command line interface (CLI) tools so you can navigate your workflow like a console cowboy 🤠 Read it now! https://trustedsec.com/blog/console-cowboys-navigating-the-modern-terminal-frontier Table of contents: 1. tldr 2. cheat 3. bat 4. lsd 5. Atuin 5. Delta 6. Fastfetch 7. bottom 8. zoxide 9. fd 10. ripgrep 11. Broot 12. fzf 13. gping 14. procs 15. HTTPie 16. dust 17. speedtest-cli 18. Putting it all together

APT
APT
16 238
📜 DGPOEdit Disconnected GPO Editor - A Group Policy Manager launcher to allow editing of domain GPOs from non-domain joined machines 🔗 Source: https://github.com/CCob/DGPOEdit #ad #windows #gpo #policy

APT
APT
16 238
Repost from RedTeam brazzers
Эксплуатация ядерных уязвимостей - довольно рискованное дело, особенно когда нет уверенности, что эксплойт отработает корректно. @hummelchen0 специально для нашего сообщества разобрал вопрос применения таких эксплойтов в статье (https://hummelchen.gitbook.io/linux_lpe) "Ядерные LPE в Linux на практике". В ней вы сможете узнать, как на своей системе протестировать ядерный сплойт для практически любого ядра Linux и автоматизировать такие проверки для самых популярных дистрибутивов.

APT
APT
16 238
🔑 Three-Headed Potato Dog: NTLM and Kerberos Coercion New research demonstrates how DCOM can coerce Windows systems to authe
🔑 Three-Headed Potato Dog: NTLM and Kerberos Coercion New research demonstrates how DCOM can coerce Windows systems to authenticate remotely, allowing attackers to relay NTLM or Kerberos authentication to AD CS over HTTP. This enables remote and cross-session authentication relay attacks, targeting both machine and user accounts. 🔗 Research: https://blog.compass-security.com/2024/09/three-headed-potato-dog/ 🔗 Source: https://github.com/sploutchy/impacket/blob/potato/examples/potato.py #ad #windows #dcom #relay #potato

APT
APT
16 238
Repost from Offensive Xwitter
😈 [ Aleem Ladha @LadhaAleem ] I've fully automated the lab used for @_leHACK_ Active Directory 2024 workshop done by @mpgn_x
😈 [ Aleem Ladha @LadhaAleem ] I've fully automated the lab used for @_leHACK_ Active Directory 2024 workshop done by @mpgn_x64 and it's available for everyone ! 🔥 Also big kudos to @M4yFly for the playbooks and NetExec dev teams for this awesome tool ! Hope you enjoy, more to come 🔗 https://github.com/Pennyw0rth/NetExec-Lab 🐥 [ tweet ]

APT
APT
16 238
🖥 Veeam Backup & Response — RCE (CVE-2024-40711) A critical deserialization vulnerability in .NET Remoting has been discovered in Veeam Backup & Replication, allowing unauthenticated remote code execution (RCE). The flaw affects versions 12.1.2.172 and earlier. 🔗 Research: https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/ 🔗 Source: https://github.com/watchtowrlabs/CVE-2024-40711 #veeam #backup #deserialization #unauth #rce

APT
APT
16 238
👻 Ghost in the PPL Part 3: LSASS Memory Dump In the third part of the series, the author explores methods for dumping the memory of LSASS, including indirectly calling MiniDumpWriteDump, loading arbitrary DLLs into LSASS via the WinSock2 Autodial feature, and dynamically resolving addresses. 🔗 Source: https://itm4n.github.io/ghost-in-the-ppl-part-3/ #lsa #lsass #ppl #dll #maldev

APT
APT
16 238
🍪 GlobalUnProtect PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows cl
🍪 GlobalUnProtect PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows client installations. 🔗 Research: https://rotarydrone.medium.com/decrypting-and-replaying-vpn-cookies-4a1d8fc7773e 🔗 Source: https://github.com/rotarydrone/GlobalUnProtect #paloalto #globalprotect #cookie #vpn

APT
APT
16 238
⚙️From COM Object Fundamentals To UAC Bypasses A 25-minute crash course covering Tokens, Privileges, UAC, COM, and ultimately bypassing UAC. 🔗Research: https://www.youtube.com/watch?v=481SI_HWlLs 🔗Source: https://github.com/tijme/conferences/tree/master/2024-09%20OrangeCon/code #windows #com #uac #bypass