We know it’s been a while since our last post. But we’re back, with great news! We’re launching our blog, “Purpleshift,” featuring interesting articles, talks, and research for both blue and red teams. Yeah that’s why it’s purple :) purpleshift.io/

When Neo-reGeorg and suo5 fall short during pivoting (no UDP proxying, broken tunnels on large files), our team built a better tunnel. Meet Roger: full SOCKS5 (RFC 1928), traffic compression, a connection manager, and more purpleshift.io/purple/2026-1…

No malware needed: in a real 2026 incident, our experts found that attackers with domain admin rights created a single malicious GPO named PAYLOAD to drop ransom notes, hijack wallpapers and disable local admin accounts across an entire domain. More: purpleshift.io/purple/2026-0…

New in Labooboo’s toolkit: a custom backdoor. The group behind GenieLocker ransomware now has its own backdoor, with at least two variants using MQTT and Matrix for C2 communication. Details 👇 purpleshift.io/purple/2026-0…

Attackers abuse NTFS streams to hide code. Linux has a similar trick: extended attributes (xattr) can stash a payload in a legit file like .bash_history, read back by a small C loader and most Linux EDRs never look there. More about how to detect it: purpleshift.io/purple/2026-0…

Everyone's seen AI finding 1,000+ critical vulns/month. Rarer angle: how LLMs speed up building offensive security tools. We had Opus 4.6 automate integrating techniques into Mythic and built a factory for disposable C2 agents in under 3 hours. More: purpleshift.io/articles/2026…

Cypher injection against Neo4j works like SQL injection: an app drops user input into a query, letting an attacker rewrite its logic. On a recent assessment, verbose errors leaked passwords and LOAD CSV let us read local files and reach internal services. purpleshift.io/purple/2026-0…

Remember the early-2000s joke? "Hello! I'm an Albanian virus. I have no high technology, so please delete an important file yourself and forward me to your friends." the joke has become a reality due to massive attacks using the ClickFix technique. More: purpleshift.io/articles/2026…

Certighost (CVE-2026-54121) is a critical ADCS vulnerability that can let low-privileged users take control of the domain. The best protection is to update all ADCS servers. But how can you find out if your servers were attacked before updating? Read more purpleshift.io/articles/2026…

Attackers don't need fancy tricks to breach schools: stolen accounts, Potato privesc, then PsExec to move around. Outdated unpatched systems make it easy and DragonForce/LockBit 3 hunt the private schools that can pay. Full breakdown by [@cristianzsh]: purpleshift.io/purple/2026-0…

Your TURN server exists so employees can join video calls. Attackers can turn it into an egress proxy that relays traffic anywhere, including their C2. Here's how the attack works and how to catch it: purpleshift.io/purple/2026-0…

Heading to DEFCON 34? Catch our IR team: 🗓️ Fri 2pm – Ransomware internals (Ashley Muñoz @3NTR0_py , LVCC) 🗓️ Sat 11am – XEntry Team investigation (Eduardo Chavarro 🇪🇸) 🗓️ Sat 2pm – Breaking into IR (Ashley Muñoz 🇪🇸) See you there! 👋 More info: purpleshift.io/purple/2026-0…

AD trust relationships can quietly hand over your whole forest, no Domain Admin in the target domain needed. Misconfigured SID filtering lets attackers escalate across trusts straight to Enterprise Admin. Full breakdown with @irabva: purpleshift.io/articles/2026…

If an attacker gets access to your Octopus Deploy server, they don't need the web UI to steal your secrets. The master key + direct DB access is enough to decrypt everything Full breakdown + how to protect your setup 👇: purpleshift.io/purple/2026-0…

90+ fake sites, 10 languages, one goal: trick you into installing "OBS Studio" or "Process Hacker" and drop ScreenConnect + AsyncRAT. Downloaded DNS Jumper, DS4Windows, Bandicam, Glary Utilities, or Crosshair X lately? Check twice. Breakdown + IOCs: purpleshift.io/purple/2026-0…

What if a payload never touches disk, no dropped file, no signature to scan? Turns out memfd_create() + fexecve() can load and execute a binary entirely from RAM, bypassing AV and even noexec protections. Full breakdown + detection tips 👇by @amgdgocha: purpleshift.io/purple/2026-0…

One of the most common incident response mistakes is rushing backup recovery. Hidden web shells can survive in backups and reappear after restoration. Read more and join our upcoming webinar on missed incidents in compromise assessments. purpleshift.io/purple/2026-0…

What if a host is vulnerable to NTLM Reflection but NOT domain-joined? Spoiler: you can still get SYSTEM under the right conditions. Read @irabva full breakdown: purpleshift.io/purple/2026-0…

VasyGrek continues to expand its arsenal. Recent attacks show the use of a Rust-based .com dropper to deploy the PureRAT backdoor, alongside obfuscated VBS droppers. Our experts analyzed these techniques and compiled the relevant IOCs: purpleshift.io/purple/2026-0…

A malicious Network Provider DLL technique has been used by attackers for many years. However, Microsoft recently published an incident investigation describing how attackers leveraged this technique to steal credentials. Learn how to detect such attack: purpleshift.io/purple/2026-0…

Recent TOCTOU vulnerability in PackageKit allows attackers to escalate privileges to root. The vulnerability, Pack2TheRoot (CVE-2026-41651), is analyzed by our colleague Vadim, who also explains how to protect yourself. Read more: purpleshift.io/purple/2026-0…