APT
Open in Telegram
This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat
Show more📈 Analytical overview of Telegram channel APT
Channel APT (@apt_notes) in the English language segment is an active participant. Currently, the community unites 17 206 subscribers, ranking 7 555 in the Technologies & Applications category and 38 225 in the Russia region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 17 206 subscribers.
According to the latest data from 29 October, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by 483 over the last 30 days and by 23 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 44.31%. Within the first 24 hours after publication, content typically collects N/A% reactions from the total number of subscribers.
- Post reach: On average, each post receives 0 views. Within the first day, a publication typically gains 0 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 0.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“This channel discusses:
— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc
Disclaimer:
t.me/APT_Notes/6
Chat Link:
t.me/APT_Notes_PublicChat”
Thanks to the high frequency of updates (latest data received on 30 October, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
17 206
Subscribers
+2324 hours
+1367 days
+48330 days
Posts Archive
17 214
Repost from Ralf Hacker Channel
Ой, красота))) Получить данные из LSA без дампа LSASS.
Historically was able to (and may presently still) bypass: * Windows Defender * Malwarebytes Anti-Malware * CrowdStrike Falcon EDR (Falcon Complete + OverWatch)Tool: https://github.com/Meowmycks/LetMeowIn?tab=readme-ov-file Blog: https://posts.specterops.io/lsa-whisperer-20874277ea3b #redteam #pentest #creds #dump
17 214
Repost from 1N73LL1G3NC3
CVE-2024-21338
LPE from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.
Blog: https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/
17 214
Evilginx ❤️ Gophish
The highly anticipated official integration between Evilginx and Gophish has been unveiled in the latest Evilginx 3.3 update. Alongside this major feature, the update brings numerous quality-of-life enhancements.
🔗 https://breakdev.org/evilginx-3-3-go-phish/
#evilginx #gophish #phishing
17 214
Repost from 1N73LL1G3NC3
CVE-2024-1086 Linux kernel LPE
Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.
A full write-up of the exploit - including background information and loads of useful diagrams - can be found in the Flipping Pages blogpost.
17 214
Repost from PT SWARM
🎁 Source Code Disclosure in IIS 10.0! Almost.
There is a method to reveal the source code of some .NET apps. Here's how it works.
👉 https://swarm.ptsecurity.com/source-code-disclosure-in-asp-net-apps/
17 214
Repost from 1N73LL1G3NC3
CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC
📜 Description
This script presents a proof of concept (PoC) for CVE-2024-21413, a significant security vulnerability discovered in Microsoft Outlook with a CVSS of 9.8. Termed the #MonikerLink bug, this vulnerability has far-reaching implications, including the potential leakage of local NTLM information and the possibility of remote code execution. Moreover, it highlights an attack vector that could bypass Office Protected View, thereby extending its threat to other Office applications.
17 214
Repost from Ralf Hacker Channel
CVE-2024-21413: Microsoft Outlook Leak Hash
https://github.com/duy-31/CVE-2024-21413
#exploit #pentest #redteam #ad
17 214
Repost from SecuriXy.kz
Теперь можно извлекать учетные данные без обращения к диску (Dumping credentials without touching disk) с помощью утилиты #go-secdump которая поддерживает и SOCKS Proxy решая проблему #Impacket
https://github.com/jfjallid/go-secdump
скоро и в Impacket запилят и будет красота
https://github.com/fortra/impacket/pull/1698
17 214
🔑 I Know What Your Password Was Last Summer...
This is a blog post about password analysis and some research regarding frequently hacked NTLM passwords.
🔗 https://labs.lares.com/password-analysis/
#bruteforce #hashcat #ntlm
17 214
⚙️ MultiDump
This is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly. MultiDump supports LSASS dump via ProcDump.exe or Comsvc.dll, it offers two modes: a local mode that encrypts and stores the dump file locally, and a remote mode that sends the dump to a handler for decryption and analysis
🔗 https://github.com/Xre0uS/MultiDump
#lsass #remote #cpp #python
17 214
👍 Whitespots: Application Security Platform
It’s a really powerful security automation platform for those of us who are working on defense side.
🚀 The platform solves such problems as:
— Issues deduplication (within incremental scans + between different scanners using rules);
— Automated verification (using rules);
— Automated resolving (if the issue doesn’t exist in a new report);
— Running of custom tools in a sequence (like Subfinder -> Naabu -> Httpx-> Nuclei);
— Sequences scheduling.
🔗 Source:
https://gitlab.com/whitespots-public/appsec-portal
#devsecops #sast #dast #osa #automation
17 214
⚙️ Introduction to Bypassing Hooks EDR
The article explores methods of bypassing EDR hooks in the user mode of the Windows operating system, starting with an explanation of system calls and their role in transitioning between user and kernel modes. Subsequently, various techniques for bypassing hooks are discussed, including direct and indirect syscalls, along with their advantages and potential limitations when used for evading protective mechanisms.
🔗 https://malwaretech.com/2023/12/an-introduction-to-bypassing-user-mode-edr-hooks.html
#maldev #edr #hooks #syscalls
17 214
🖼️ Bypass Medium Paywall
A little lifehack if you, like me, come across paid articles from Medium. These sites allow you to read paid Medium articles for free:
🔗 https://freedium.cfd/<URL>
🔗 https://medium-forall.vercal.app/
#medium #premium #bypass
17 214
Repost from Ralf Hacker Channel
Набор инструментов для удалённого дампа паролей.
https://github.com/Slowerzs/ThievingFox/
Ну и сам блог:
https://blog.slowerzs.net/posts/thievingfox/
#pentest #redteam #creds
17 214
⛓ Trusted Domain, Hidden Danger
In this blog post describes a prevalent tactic used in phishing attacks, which involves exploiting legitimate platforms for redirection through deceptive links.
Source:
🔗 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trusted-domain-hidden-danger-deceptive-url-redirections-in-email-phishing-attacks/
#phishing #url #redirect
17 214
🖼️ Protect Evilginx using Cloudflare
Using a combination of Cloudflare and HTML Obfuscation, it is possible to protect your Evilginx server from being flagged as deceptive and so increase your chances of success on Red Team and Social Engineering engagements.
Source:
🔗 https://www.jackphilipbutton.com/post/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation
#phishing #cloudflare #evilginx #html
17 214
🖼️ BOFHound
This is an offline BloodHound ingestor and LDAP result parser. BOFHound allows operators to utilize BloodHound's beloved interface while maintaining full control over the LDAP queries being run and the spped at which they are executed. This leaves room for operator discretion to account for potential honeypot accounts, expensive LDAP query thresholds and other detection mechanisms designed with the traditional, automated BloodHound collectors in mind.
Tools:
🔗 https://github.com/coffeegist/bofhound
Research:
🔗 https://posts.specterops.io/bofhound-session-integration-7b88b6f18423
#c2 #bof #cobaltstrike #redteam
17 214
👩💻 Azure Outlook Command & Control
Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid/ScarCruft/APT37.
🔗 https://github.com/boku7/azureOutlookC2
#c2 #azure #outlook #graphapi #redteam
17 214
🐶 SOAPHound
This is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.
Tool:
🔗 https://github.com/FalconForceTeam/SOAPHound
Research:
🔗 https://falconforce.nl/soaphound-tool-to-collect-active-directory-data-via-adws/
#ad #windows #bloodhound #soap #adws
