es
Feedback
APT

APT

Ir al canal en Telegram

This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat

Mostrar más
Rusia45 152Tecnologías y Aplicaciones8 793

📈 Análisis del canal de Telegram APT

El canal APT (@apt_notes) en el segmento lingüístico de Inglés es un actor destacado. Actualmente la comunidad reúne a 14 795 suscriptores, ocupando la posición 8 793 en la categoría Tecnologías y Aplicaciones y el puesto 45 152 en la región Rusia.

📊 Métricas de audiencia y dinámica

Desde su creación el невідомо, el proyecto ha mostrado un crecimiento acelerado, reuniendo a 14 795 suscriptores.

Según los últimos datos del 19 junio, 2026, el canal mantiene una actividad estable. En los últimos 30 días la variación de miembros fue de 459, y en las últimas 24 horas de 22, conservando un alto alcance.

  • Estado de verificación: No verificado
  • Tasa de interacción (ER): El promedio de interacción de la audiencia es 55.97%. Durante las primeras 24 horas tras publicar, el contenido suele obtener N/A% de reacciones respecto al total de suscriptores.
  • Alcance de las publicaciones: Cada publicación recibe en promedio 8 276 visualizaciones. En el primer día suele acumular 0 visualizaciones.
  • Reacciones e interacción: La audiencia responde de forma activa: el promedio de reacciones por publicación es 20.

📝 Descripción y política de contenido

El autor describe el recurso como un espacio para expresar opiniones subjetivas:
“This channel discusses: — Offensive Security — RedTeam — Malware Research — OSINT — etc Disclaimer: t.me/APT_Notes/6 Chat Link: t.me/APT_Notes_PublicChat”

Gracias a la alta frecuencia de actualizaciones (últimos datos recibidos el 20 junio, 2026), el canal mantiene la vigencia y un amplio alcance. La analítica demuestra que la audiencia interactúa activamente con el contenido, lo que lo convierte en un punto de referencia dentro de la categoría Tecnologías y Aplicaciones.

14 795
Suscriptores
+2224 horas
+1297 días
+45930 días
Archivo de publicaciones
APT
APT
14 795
💻 BIOS bootloader from scratch in ASM Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode.
💻 BIOS bootloader from scratch in ASM Dive into building a BIOS bootloader from scratch to boot an x86 CPU into 64-bit mode. From ASM basics to integrating with C, unravel the complexities step-by-step. 🔗 Research: https://thasso.xyz/2024/07/13/setting-up-an-x86-cpu.html 🔗 Code: https://github.com/thass0/blog-code/tree/main/2024-07-13-setting-up-an-x86-cpu #bios #loader #asm #clang

APT
APT
14 795
Repost from RedTeam brazzers
Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection! Дав
Кросс-сессионная активация или захватываем сессию пользователя без RemotePotato0, TGSThief, mimikatz и Process Injection! Давным-давно я писал о способе злоупотребления интерфейсом IHxHelpPaneServer. Однако вы когда в последний раз использовали моникеры? И я давным-давно... Поэтому нужно было найти альтернативный способ исполнения кода в сессии другого пользователя, забыв про все техники внедрения. Если посмотреть на код RemotePotato0 или RemoteKrbRelay , то можно заметить использование недокументированных интерфейсов ISpecialSystemProperties и IStandartActivator. Причем не сказать, что их использование довольно редкое. Их можно встретить в любой программе, которая позволяет стащить учётные данные (имеет переключатель -session). Сами по себе, они позволяют контролировать сессию, в которой создавать COM-объект. Ранее мы ловили от них только аутентификацию, но что мешает соединить использование этих интерфейсов с описанным в SeMishaPrivilege COM-классом IHxHelpPaneServer? Конечно же ничего! И я написал небольшой POC, который выложил на GitHub . Если вам интересно подробно окунуться в принцип работы инструмента, то советую обратить внимание на нашу статью на medium :)

APT
APT
14 795
⚙️ Remote Session Enumeration The blog post explores how to enumerate remote user sessions on Windows using undocumented Wind
⚙️ Remote Session Enumeration The blog post explores how to enumerate remote user sessions on Windows using undocumented Windows APIs, specifically focusing on the implementation and usage of the WinStation API. 🔗 Research: https://0xv1n.github.io/posts/sessionenumeration/ 🔗 Source: https://github.com/0xv1n/RemoteSessionEnum/blob/main/main.cpp #windows #qwinsta #session #winapi #cpp

APT
APT
14 795
😈 dirDevil: Hiding Code and Content Within Folder Structures This article describes a method for hiding data within directory structures by using GUIDs in folder names to encode information. This approach bypasses antivirus and DLP systems since the data is stored in folder names rather than files, making it difficult to detect and analyze. 🔗 Research: https://trustedsec.com/blog/dirdevil-hiding-code-and-content-within-folder-structures 🔗 Source: https://github.com/nyxgeek/dirdevil #hide #code #folder #evasion

APT
APT
14 795
🖥 Windows KASLR bypass using prefetch side-channel A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11.
🖥 Windows KASLR bypass using prefetch side-channel A proof-of-concept tool for bypassing KASLR (kernel ASLR) on Windows 11. Inspired by EntryBleed for Linux. This tool was developed as part of an exploit targetting Windows 11 24H2. CPU Support: — Intel: Reliable ✅ — AMD: Flaky ⚠️ 🔗 Research: https://exploits.forsale/24h2-nt-exploit/ 🔗 Source: https://github.com/exploits-forsale/prefetch-tool #windows11 #aslr #kaslr #research

APT
APT
14 795
🕷 ADSpider Tool for monitor Active Directory changes in real time without getting all objects. Instead of this it use replication metadata and Update Sequence Number (USN) to filter current properties of objects. 🔗 Research: https://habr.com/ru/companies/angarasecurity/articles/697938/ 🔗 Source: https://github.com/DrunkF0x/ADSpider ——— Наконец-то появилась на свет, а точнее в паблике, утилита ADSpider от моего горячо любимого @DrunkF0x. Ура-ура! 💃 #ad #windows #monitoring #tools

APT
APT
14 795
🖼️ Microsoft SharePoint Server 20219 — RCE PoC for: — CVE-2024-38094 — CVE-2024-38024 — CVE-2024-38023 🔗 Source: https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC #sharepoint #poc #rce #cve

APT
APT
14 795
Repost from SecuriXy.kz
+1
🆕Все читали в новостях шумную новость про новый rockyou 2024🆕 https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/ Мы его скачали, немного отфильтровали, а теперь делимся с Вами результатами 😎 ZIP-архив в 45 гигов в распакованном виде выдаёт текстовый файл размером 155 ГБ. При открытии с помощью less будет уведомление, что он выглядит как бинарный файл. В нём по какой-то причине добавлено приличное количество мусора... Вычистив его, получаем на выходе файл размером в 144 ГБ. Но даже в нём, достаточно бесполезных строк (Хотя если кому надо, можем выложить и его). Отфильтровали ещё немного, оставив только строки без пробелов длиной от 8 до 40 символов и вуаля - 25 гигабайт приемлемого вордлиста). Пользуйтесь 🔥

APT
APT
14 795
🔑 Dumping LSA: a story about task decorrelation Discover the art of bypassing EDRs by decorrelating attack tool behavior. Th
🔑 Dumping LSA: a story about task decorrelation Discover the art of bypassing EDRs by decorrelating attack tool behavior. This post explains the process of remote LSA secrets dumping and reveals techniques to retrieve a Windows computer's BOOTKEY without EDR detection. 🔗 Source: https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ #lsa #sam #dump #edr #bypass

APT
APT
14 795
💻 VMware vCenter Server — Remote Code Execution (CVE-2024-22274) The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system as the "root" user. 🔗 Source: https://github.com/mbadanoiu/CVE-2024-22275 #vmware #vcenter #rce #cve

APT
APT
14 795
💻 VMware vCenter Server — Multiple LPE (CVE-2024-37081) The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. 🔗 Source: https://github.com/mbadanoiu/CVE-2024-37081 #vmware #vcenter #lpe #cve

APT
APT
14 795
Repost from Похек
RockYou2024 Архив весит 45 гб Распакованный 156 гб Загрузил на свой S3. Скорость не лучшая, но точно не отвалиться загрузка https://s3.timeweb.cloud/fd51ce25-6f95e3f8-263a-4b13-92af-12bc265adb44/rockyou2024.zip В процессе Google Drive и Яндекс Диск

APT
APT
14 795
🔑 RockYou2024: 10 billion passwords leaked in the largest compilation of all time Researchers discovered what appears to be
🔑 RockYou2024: 10 billion passwords leaked in the largest compilation of all time Researchers discovered what appears to be the largest password compilation with a staggering 9,948,575,739 unique plaintext password 🔗 Source: https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/ 🔗 Source archive: https://fastupload.io/1824d409732f30be #wordlist #rockyou #passwords

APT
APT
14 795
📄 Evading ETW Based Detections In this post, Event Tracing for Windows (ETW) will be explored along with various evasion techniques used to evade detections based on this Windows event tracking and collection mechanism. 🔗 https://s4dbrd.com/evading-etw-based-detections/ #etw #bypass #windows

APT
APT
14 795
🤖 DojoLoader — Generic PE Loader for Prototyping Evasion Techniques This is a versatile PE loader designed for prototyping evasion techniques. It supports downloading and executing encrypted shellcode, dynamic IAT hooking, and three Sleep obfuscation methods. Ideal for use with UDRL-less Beacon payloads from Cobalt Strike. 🔗 Blog Post: https://www.naksyn.com/cobalt%20strike/2024/07/02/raising-beacons-without-UDRLs-teaching-how-to-sleep.html 🔗 Source: https://github.com/naksyn/DojoLoader #cobaltstrike #udrl #memory #evasion

APT
APT
14 795
🖼️ RegreSSHion — OpenSSH Unauthenticated RCE The Qualys Threat Research Unit has discovered a Remote Unauthenticated Code Ex
🖼️ RegreSSHion — OpenSSH Unauthenticated RCE The Qualys Threat Research Unit has discovered a Remote Unauthenticated Code Execution vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387. The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems. 🔗 Research: https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server 🔗 PoC: https://github.com/7etsuo/cve-2024-6387-poc #openssh #glibc #rce #cve

APT
APT
14 795
🪞 Smoke and Mirrors — Driver Signatures Are Optional ItsNotASecurityBoundary is an exploit that leverages False File Immutab
🪞 Smoke and Mirrors — Driver Signatures Are Optional ItsNotASecurityBoundary is an exploit that leverages False File Immutability assumptions in Windows Code Integrity (ci.dll) to trick it into accepting an improperly-signed security catalog containing fraudulent authentihashes. With attacker-controlled authentihashes loaded and trusted by CI, the kernel will load any driver of the attacker's choosing, even unsigned ones. 🔗 https://github.com/gabriellandau/ItsNotASecurityBoundary #driver #signature #bypass #ffi #windows

APT
APT
14 795
Repost from PT SWARM
🔥 Our researcher Arseniy Sharoglazov has discovered two unauthenticated RCE vulnerabilities in Xerox WorkCentre! Read more: https://swarm.ptsecurity.com/inside-xerox-workcentre-two-unauthenticated-rces/

APT
APT
14 795
Repost from Ralf Hacker Channel
CVE-2024-30088: Windows LPE PATCHED: June 11, 2024 https://github.com/tykawaii98/CVE-2024-30088 P.S. Протестил на Win11, рабо
CVE-2024-30088: Windows LPE PATCHED: June 11, 2024 https://github.com/tykawaii98/CVE-2024-30088 P.S. Протестил на Win11, работает #git #exploit #lpe #pentest #redteam

APT
APT
14 795
💻 TREVORproxy This is a simple SOCKS proxy that helps avoid Smart Lockout by load-balancing your requests between multiple IP addresses. It accomplishes this with built-in Linux features -- no complex OpenVPN setups or strange firewall configurations. There are two techniques that TREVORproxy can use to spread your requests across multiple IP addresses: an SSH Proxy and a Subnet Proxy. — SSH Proxy You give TREVORproxy some hosts that support SSH, and it sends your traffic through them, making sure to balance equally between all the hosts. — Subnet Proxy If you have access to a /64 IPv6 subnet (Linode is perfect for this), TREVORproxy will load-balance your requests across eighteen quintillion (18,446,744,073,709,551,616) unique source addresses. 🔗 Source: https://github.com/blacklanternsecurity/TREVORproxy #ip #rotation #waf #bypass