555 reports, $106 000 and Malaysia — that’s Standoff Hacks 🔥 Standoff Hacks is our series of private events where the platform’s top researchers put companies’ services to the test. Limited time, an exclusive scope, and a race for first place. This time, bug hunters searched for vulnerabilities in Wildberries and Ozon services, submitting 555 reports and earning $106 100 in bounties. After the online stage, we met up in Malaysia to catch up, celebrate the winners, and hang out with the local community 🇲🇾 Watch the highlights! @HusseiN98D @GodfatherOrwa @XHackerx007 @4non_Hunter

Standoff Hacks Final: Time to Reveal the Winners 😎 Two weeks of bug hunting are officially over. During that time, the platform’s top researchers submitted 555 reports and earned more than 9 million rubles. Now it’s time to reveal the winners. 🏆 Top 3 of Standoff Hacks: 🥇 noname1337 — Best Hacker 🥈 brain 🥉 hussein98d And a few special shout-outs: 🔥 brain — Wildberries MVP 🔥 noname1337 — OZON MVP 💸 Bearsec — biggest bounty of the event 🎯 OrwaGodFather — submitted the 500th report of the event That’s Standoff Hacks: top hackers, the biggest companies, and an intense hunt for vulnerabilities. Congrats to all the winners, and a huge thank you to everyone who jumped into the race and made this event so epic. Stay tuned, and see you at Standoff Hacks! 🕺

The Tochka Bank bug bounty program is officially open to all researchers! 🔍 In scope: Main website: tochka.com Help center: allo.tochka.com Store: shop.tochka.com Technical services: tochka-tech.com 💸 Total bounty pool: $5,870. Bank on your skills: find vulnerabilities and cash in your bounty bugbounty.standoff365.com/en… ⬅️

Getting Started in Bug Bounty: Turning Bugs into Criticals 🔥 How can you chain several vulnerabilities together to achieve a critical impact? In the new episode of “Getting Started in Bug Bounty”, we explore bug chaining — an approach that helps you find connections between individual vulnerabilities and turn seemingly minor bugs into Critical findings. Using real-world examples from 10 years of bug hunting, we’ll discuss how to think in chains, identify opportunities to develop an attack, and take vulnerabilities to the next level of impact. The episode is hosted by Oleg Ulanov aka brain, Standoff Bug Bounty ambassador and one of the platform’s top researchers. Our guest is Mohamed Daher aka @m0m0x01d , a bug hunter and one of the top researchers on Standoff Bug Bounty. Watch the episode → youtube.com/watch?v=NSKVtbeV…

Getting Started with Bug Bounty: Recon 🔎 How do you find what others miss? It starts with recon. In the new episode, we break down one of the key stages of bug hunting: how to explore infrastructure and discover potential entry points. Hosted by Oleg Ulanov aka brain, Standoff Bug Bounty Ambassador and one of the platform’s top security researchers. Our guest is Hussein Daher aka @HusseiN98D, one of the top researchers on Standoff Bug Bounty. Inside the episode: subdomain and host discovery, network and ASN analysis, wordlist building, dorking, hidden parameter discovery, favicon recon, Reverse DNS, and real-world bug hunting cases. Watch the episode → youtu.be/oz572T1WWBM

Cloudy, with a chance of vulnerability showers 💭 K2 Cloud just opened its bug bounty program to every researcher. You'll be hunting the critical high-impact bugs that put client infrastructure and data at risk 🗂 In scope: 🔗 RCE 🔗 Injections (SQL, XML, SSTI, and others) 🔗 LFI and RFI 🔗 SSRF with confirmed impact 🔗 IDOR and privilege escalation 🔗 Authentication and authorization flaws 🔗 Business logic and payment bypasses 🔗 Confidential data leaks 🔗 Anything else that breaks platform security Top reward, $6,520 💵 Think you can breach the cloud? Get started: bugbounty.standoff365.com/en…

New bounties are now available on Standoff Bug Bounty 🆕 Positive Technologies refreshed its whole lineup of bug hunting programs. Here's what's live 👇 What changed: • Positive Dream Hunting has a new unacceptable event • Positive Bug Hunting has new terms • PT Cloud AF is unchanged Here are the programs: • MaxPatrol EDR • MaxPatrol O2 • MaxPatrol SIEM • MaxPatrol VM • MaxPatrol 360 • PT Application Firewall • PT Application Inspector • PT Container Security • PT Data Security • PT Dephaze • PT ISIM • PT NAD • PT NGFW • PT Sandbox Email bugbounty@standoff365.com and we'll get you into the test environment. Go find the juiciest vulnerabilities on Standoff Bug Bounty: bugbounty.standoff365.com/en…

T-Bank сyber evaluation program: a $655,738 reward pool 🤑 This is your chance to take on one of Russia's largest banks and test whether its infrastructure can withstand a real-world attack. Trigger a single non-tolerable event and earn up to $153,906. Here's how to participate: 🟡 Apply for the program: cyber.tbank.ru/ 🟡 Receive an invite and gain access to the cyber evaluation environment. 🟡 Trigger a non-tolerable event. The T-Bank сyber evaluation program takes place at Standoff Bug Bounty. Participate to earn exclusive achievements that will be added to your profile. A cyber evaluation is a red team–style bug bounty program. Instead of looking for isolated vulnerabilities, researchers focus on building a complete attack chain (kill chain) aligned with the program's objectives, such as obtaining administrative access to a system or demonstrating the ability to steal funds. Apply now before the window closes ⏳

BCS Bank is back on Standoff Bug Bounty 🔥 The program is open to all bug hunters. If you've been eyeing a bank scope, now's a good time to jump in. Current payouts: Critical, up to $3,350 High, up to $1,610 Medium, up to $670 Low, up to $135 Info, no reward Scope: bcs-bank.ru/ lk.bcs-bank.ru/ *.bcs-bank.ru Android and iOS apps (latest versions from bcs.ru) BCS Bank's attack surface is open for testing. Get hunting and get paid (bugbounty.standoff365.com/pr…) 💰

That's us at Hacks. Back home now 👍 The event's over, but the energy's sticking with us. Here's a little video from day two so you can get a taste of it—the buzz, the drive, and the community. See you at the next Hacks. New location, same electric vibe 🔛

Standoff Hacks Finals. Shanghai, Day 2 🇨🇳 Top 3: 🥇 r0hack — MVP of Standoff Hacks 🥈 freeman 🥉 BlackFan MVPs by program: 🏆 BlackFan — T-Bank 🏆 brain — VK 🏆 hussein98d — Jet Infosystems 🏆 Antart — Bitrix24 30 top bug hunters 350+ reports $300K+ in bounties Two weeks of high-intensity work: hundreds of submissions, rigorous triage, and real-world impact. Huge thanks to every researcher who kept the pace all the way to the finals. The next Standoff Hacks… coming soon 👀

Standoff Hacks | Shanghai | Day 1 🇨🇳 Sharing the vibe. Everyone’s here. Before the finals — warming up at Shanghai Disneyland, then a cozy hot pot dinner 🎢

Standoff Bug Bounty 2025 wrapped. Here's what the numbers say 🧐 We packed every payout, every vulnerability class, and every trend from the past year into a single report. The team combed through the platform and highlighted standout items, extending from researcher earnings, most common vulnerability types, all the way to where bug bounty is headed the rest of this year. We included tables and charts for clarity. What's inside: 📎 Who earned what and for which vulnerabilities 📎 The most critical flaws uncovered 📎 What's shifting in the bug bounty world in 2026 If you want to stay in the loop about how bug bounty is doing and what to pay attention to, check out the research in the link global.ptsecurity.com/en/res…

Kontur double payouts are live 🤑 From March 2 through March 31, qualifying bugs come with double payouts. This round targets the authentication system and account portal. Rewards for eligible vulnerabilities can reach $25,285. In scope: auth.kontur.ru identity.kontur.ru cabinet.kontur.ru api.kontur.ru/cabinet-api/* api.kontur.ru/auth/* Good to know: 〰️ Higher payouts apply only to the listed scope 〰️ Limit automated scanning to 5 RPS 〰️ Be sure to add the X-BugBounty: {standoff_username} header to all requests Snag vulnerabilities (bugbounty.standoff365.com/en…) while double rates are active 😼

✉️ New message for you: hh.ru goes public on Standoff Bug Bounty Your dream job just landed — bugs and bounties are already waiting for you on the career platform. The program was previously open to a select group of researchers, but now hh.ru is opening its doors to every bug hunter out there. Earn up to $6,414 for discovered vulnerabilities 💰 What's in scope: • hh.ru • api.hh.ru • dev.hh.ru • talantix.ru • setka.ru • api.setka.ru Everything's set for the hunt. The only thing missing? Your report. Jump into Standoff Bug Bounty (bugbounty.standoff365.com/en…) and make the internet safer 🔥

What is Standoff Hacks and how do you get in? 🤔 We sat down with one of our researchers, Hackerx007 @XHackerx007, to find out what participating in Standoff Hacks means to him. Dive into the amazing world of Standoff Hacks and explore it with us!  Read the interview, then join the contest for a chance to win an invite to a party abroad 😎 1⃣ What does participating in Standoff Hacks mean to you? A lot! It allows me to challenge myself and push my hacking mentality to the maximum level. It was my first LHE, so I didn't think I would win, but while hacking, I discovered a new part of my skills! Under pressure, you discover new skills that you didn't think you were capable of. So what does Standoff Hacks mean to me? It means confidence and challenge! Winning an LHE against 32 elite hackers showed me that under pressure we can do things we didn't think we could do. 2⃣ You have participated in Standoff Hacks before. What are the most vivid impressions you remember? The spirit, the community, and the management! When I met the other hackers, it felt like we'd known each other for a long time. Even though we were against each other, everyone was hoping the other would win! We had such a beautiful time together. And the program managers were with us — Elizaveta from T-Bank and Alexander from WB — giving their support. And you know what? We didn't even feel like they were the program owners. We were joking, having fun! And the support we got from the Positive Technologies team — Alex, Max, Masha — was amazing. Those moments and the time we spent, the laughs... it's unforgettable. 3⃣ What is most important to you at such events: victory, experience, money, or the community? Experience and community. As I said, I discovered things I didn't think I was able to do. I learned critical skills — working under pressure allows you to learn new things! Also the community — making new friends who think just like you. You know, all hackers around the world share the same way of thinking, and that makes the connection much easier. As I said, we felt like we'd known each other forever. We had a lot of fun! So making new friends and learning new things —that's what I'm looking forward to. 4⃣ How do you usually prepare for Standoff Hacks — or do you deliberately not prepare? I would love to take a break for a few days before the event, so I can recharge my energy and be ready to hack day and night! 5⃣ What is the most challenging part of Standoff Hacks: the lack of time or the competitive pressure? Neither! The most challenging thing is proving to yourself that you can do it. Anyone can win. I was challenging myself, because when I started, I didn't think I could win, but I was trying to prove to myself that I could do it! The time was enough for me, and working under pressure is beneficial — so the real challenge was proving to myself that I can and I will! 6⃣ What are you most looking forward to at Standoff Hacks in China: complex bugs, networking, or the atmosphere? I'm not greedy — all three of them! Finding critical bugs gives me confidence, making new friends and connections, and enjoying the time with other hackers! See you in China!

Standoff Hacks is almost here! 🔛 Want in? Standoff Hacks is our private two-week live hacking event — top researchers, closed corporate targets, serious rewards, and a final party somewhere in the world (TBA!). How to get an invite: ➡️ Hunt bugs in the OZON program: bugbounty.standoff365.com/en… ➡️ Submit valid reports ➡️ Earn points ➡️ Increase your chances of getting one of the invitations That’s it 🎉 Dates Feb 20, 10:00 AM – Mar 6, 11:59 PM (Moscow Time) Go hunt! 🐞

New cyber testing program from Jet Infosystems 😎 You can now test one of the most complex enterprise infrastructures out there, and see how it holds up under pressure Key scenarios include: 🔵 Infrastructure control Domain administrator rights Virtualization access Server and backup management control 🔵 Protected privileged access perimeter access Isolation bypass Perimeter movement Protected perimeter network control What you need to know is: ➖OSINT and social engineering are allowed. ➖Phishing emails to @ jet[.]su are permitted. ➖ Only non-destructive methods are allowed. ➖ Clients and partners are out of scope. Do not target their systems. 💰 Earn as much as $19,588 in rewards Reward opportunities are available now, so jump in while the testing scope is still open: bugbounty.standoff365.com/en… If you find a vulnerability, submit the report through the main bug bounty program: bugbounty.standoff365.com/en…