APT
Open in Telegram
This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat
Show more📈 Analytical overview of Telegram channel APT
Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 16 236 subscribers, ranking 7 782 in the Technologies & Applications category and 40 429 in the Russia region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 16 236 subscribers.
According to the latest data from 29 August, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 560 over the last 30 days and by 13 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 39.15%. Within the first 24 hours after publication, content typically collects 18.08% reactions from the total number of subscribers.
- Post reach: On average, each post receives 6 354 views. Within the first day, a publication typically gains 2 934 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 26.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses:
— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc
Disclaimer:
t.me/APT_Notes/6
Chat Link:
t.me/APT_Notes_PublicChat”
Thanks to the high frequency of updates (latest data received on 30 August, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
16 236
Subscribers
+1324 hours
+1017 days
+56030 days
Posts Archive
16 236
Repost from 1N73LL1G3NC3
CVE-2024-21338
LPE from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.
Blog: https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/
16 236
Evilginx ❤️ Gophish
The highly anticipated official integration between Evilginx and Gophish has been unveiled in the latest Evilginx 3.3 update. Alongside this major feature, the update brings numerous quality-of-life enhancements.
🔗 https://breakdev.org/evilginx-3-3-go-phish/
#evilginx #gophish #phishing
16 236
Repost from 1N73LL1G3NC3
CVE-2024-1086 Linux kernel LPE
Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.
A full write-up of the exploit - including background information and loads of useful diagrams - can be found in the Flipping Pages blogpost.
16 236
Repost from PT SWARM
🎁 Source Code Disclosure in IIS 10.0! Almost.
There is a method to reveal the source code of some .NET apps. Here's how it works.
👉 https://swarm.ptsecurity.com/source-code-disclosure-in-asp-net-apps/
16 236
Repost from 1N73LL1G3NC3
CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC
📜 Description
This script presents a proof of concept (PoC) for CVE-2024-21413, a significant security vulnerability discovered in Microsoft Outlook with a CVSS of 9.8. Termed the #MonikerLink bug, this vulnerability has far-reaching implications, including the potential leakage of local NTLM information and the possibility of remote code execution. Moreover, it highlights an attack vector that could bypass Office Protected View, thereby extending its threat to other Office applications.
16 236
Repost from Ralf Hacker Channel
CVE-2024-21413: Microsoft Outlook Leak Hash
https://github.com/duy-31/CVE-2024-21413
#exploit #pentest #redteam #ad
16 236
Repost from SecuriXy.kz
Теперь можно извлекать учетные данные без обращения к диску (Dumping credentials without touching disk) с помощью утилиты #go-secdump которая поддерживает и SOCKS Proxy решая проблему #Impacket
https://github.com/jfjallid/go-secdump
скоро и в Impacket запилят и будет красота
https://github.com/fortra/impacket/pull/1698
16 236
🔑 I Know What Your Password Was Last Summer...
This is a blog post about password analysis and some research regarding frequently hacked NTLM passwords.
🔗 https://labs.lares.com/password-analysis/
#bruteforce #hashcat #ntlm
16 236
⚙️ MultiDump
This is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly. MultiDump supports LSASS dump via ProcDump.exe or Comsvc.dll, it offers two modes: a local mode that encrypts and stores the dump file locally, and a remote mode that sends the dump to a handler for decryption and analysis
🔗 https://github.com/Xre0uS/MultiDump
#lsass #remote #cpp #python
16 236
👍 Whitespots: Application Security Platform
It’s a really powerful security automation platform for those of us who are working on defense side.
🚀 The platform solves such problems as:
— Issues deduplication (within incremental scans + between different scanners using rules);
— Automated verification (using rules);
— Automated resolving (if the issue doesn’t exist in a new report);
— Running of custom tools in a sequence (like Subfinder -> Naabu -> Httpx-> Nuclei);
— Sequences scheduling.
🔗 Source:
https://gitlab.com/whitespots-public/appsec-portal
#devsecops #sast #dast #osa #automation
16 236
⚙️ Introduction to Bypassing Hooks EDR
The article explores methods of bypassing EDR hooks in the user mode of the Windows operating system, starting with an explanation of system calls and their role in transitioning between user and kernel modes. Subsequently, various techniques for bypassing hooks are discussed, including direct and indirect syscalls, along with their advantages and potential limitations when used for evading protective mechanisms.
🔗 https://malwaretech.com/2023/12/an-introduction-to-bypassing-user-mode-edr-hooks.html
#maldev #edr #hooks #syscalls
16 236
🖼️ Bypass Medium Paywall
A little lifehack if you, like me, come across paid articles from Medium. These sites allow you to read paid Medium articles for free:
🔗 https://freedium.cfd/<URL>
🔗 https://medium-forall.vercal.app/
#medium #premium #bypass
16 236
Repost from Ralf Hacker Channel
Набор инструментов для удалённого дампа паролей.
https://github.com/Slowerzs/ThievingFox/
Ну и сам блог:
https://blog.slowerzs.net/posts/thievingfox/
#pentest #redteam #creds
16 236
⛓ Trusted Domain, Hidden Danger
In this blog post describes a prevalent tactic used in phishing attacks, which involves exploiting legitimate platforms for redirection through deceptive links.
Source:
🔗 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trusted-domain-hidden-danger-deceptive-url-redirections-in-email-phishing-attacks/
#phishing #url #redirect
16 236
🖼️ Protect Evilginx using Cloudflare
Using a combination of Cloudflare and HTML Obfuscation, it is possible to protect your Evilginx server from being flagged as deceptive and so increase your chances of success on Red Team and Social Engineering engagements.
Source:
🔗 https://www.jackphilipbutton.com/post/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation
#phishing #cloudflare #evilginx #html
16 236
🖼️ BOFHound
This is an offline BloodHound ingestor and LDAP result parser. BOFHound allows operators to utilize BloodHound's beloved interface while maintaining full control over the LDAP queries being run and the spped at which they are executed. This leaves room for operator discretion to account for potential honeypot accounts, expensive LDAP query thresholds and other detection mechanisms designed with the traditional, automated BloodHound collectors in mind.
Tools:
🔗 https://github.com/coffeegist/bofhound
Research:
🔗 https://posts.specterops.io/bofhound-session-integration-7b88b6f18423
#c2 #bof #cobaltstrike #redteam
16 236
👩💻 Azure Outlook Command & Control
Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid/ScarCruft/APT37.
🔗 https://github.com/boku7/azureOutlookC2
#c2 #azure #outlook #graphapi #redteam
16 236
🐶 SOAPHound
This is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.
Tool:
🔗 https://github.com/FalconForceTeam/SOAPHound
Research:
🔗 https://falconforce.nl/soaphound-tool-to-collect-active-directory-data-via-adws/
#ad #windows #bloodhound #soap #adws
16 236
👩💻 Windows CLFS Driver Privilege Escalation
This vulnerability targets the Common Log File System (CLFS) and allows attackers to escalate privileges and potentially fully compromise an organization’s Windows systems. In April 2023, Microsoft released a patch for this vulnerability and the CNA CVE-2023-28252 was assigned.
📊 Affects version:
— Windows 11 21H2 (clfs.sys version 10.0.22000.1574);
— Windows 11 22H2;
— Windows 10 21H2;
— Windows 10 22H2;
— Windows Server 2022.
Research:
🔗 https://www.coresecurity.com/core-labs/articles/analysis-cve-2023-28252-clfs-vulnerability
Exploit:
🔗 https://github.com/duck-sec/CVE-2023-28252-Compiled-exe
#windows #privesc #clfs #driver
