Jet Infosystems (NTEs)

Jet Infosystems (Company) is a system integrator and one of the top ten largest tech companies and the top five IT service providers in Russia. We implement unique solutions that we test ourselves. We take on complex projects that others consider impossible: building a data center in permafrost, launching a virtual mobile operator from scratch in six months, or building an IT and clearing infrastructure for a new national payment system in just a few months.

Jet Infosystems is a system integrator and one of the top ten largest tech companies and the top five IT service providers in Russia. The company delivers unique, self-tested solutions and takes on complex projects often considered impossible, such as building a data center in permafrost, launching a virtual mobile operator from scratch in six months, or developing an IT and clearing infrastructure for a new national payment system in just a few months.

Jet Infosystems

Jet Infosystems (NTEs) · Bug Bounty

Продемонстрируйте возможность зашифровать большую часть "продуктивной" серверной инфраструктуры через получение: 
•	прав доменного администратора;
•	административный доступ в систему виртуализации;
•	прочий доступ к любой из централизованных систем, позволяющий осуществить централизованное управление не менее 10 серверами;
и продемонстрируйте возможность доступа к системе резервного копирования с правами, позволяющими удалять резервные копии.
Доступ должен позволить без ограничений осуществить потенциальное шифрование большей части серверной инфраструктуры на уровне операционной системы или среды виртуализации, а также сделать возможным удаление резервных копии информационных систем. 
Внимание! Осуществлять шифрование данных и удалять резервные копии строго запрещено.

Демонстрация возможности захвата управления инфраструктурой с последующей возможностью шифрования

Продемонстрируйте возможность свободно подключаться к контуру «ЗАПАД» и получить в нем:
•	права доменного администратора;
•	административный доступ в систему виртуализации; 
•	массовый доступ к не менее чем 10 виртуальным рабочим местам;
•	прочий доступ к любой из централизованных систем, позволяющий осуществить централизованное управление не менее 10 серверами;
или продемонстрируйте возможность административного доступа к межсетевым экранам контура «ЗАПАД».
Доступ должен позволить без ограничений подключаться к контуру «ЗАПАД» с возможностью горизонтального перемещения или захват управления сетью контура «ЗАПАД».
Внимание! Любые действия и подключения к ИТ-инфраструктуре заказчиков строго запрещены.

Демонстрация возможности нелегитимного доступа к системам заказчиков Компании

## Program 
One of the Company's goals is to provide secure and convenient services for our customers and partners. 

This cyber evaluation program is aimed at enhancing the security of our IT infrastructure through continuous testing and improvement of protection methods. We recognize that no infrastructure is perfect: security risks and threats always exist, and we want to be the first to know about them. 

We invite professionals who are ready to assist in researching the security of our Company. Join our program and help us become even more secure.

The program continues **until December 31, 2026, 23:59 UTC+3 (Moscow time)** or **until the first valid demonstration of the feasibility of a non-tolerable event**. A payment of up to 1,500,000 rubles is provided for demonstrating one non-tolerable event, and up to 3,000,000 rubles for demonstrating both non-tolerable events.

## Scope
We encourage researchers to be inventive and to use OSINT methods to discover the Company's resources.

The program scope includes the following assets (information systems and their components): 
•	Assets located within the Company's internal corporate network, including resources of the **jetinfo.*** and **jet.msk.su** domains. 
•	Assets located in the isolated environment for Secure Privileged Administrative Access, referred to as ZAPAD and identified by the local domain **zapad.iso**. 

Equipment not owned by the Company, including systems and equipment belonging to the Company's clients and partners, is outside the program scope.

Only non-destructive (non-intrusive) research methods are permitted.

Researchers may use vectors involving wired and wireless methods for connecting their equipment to the Company's network via computer outlets and other network access devices in the Company's offices, branches, and data centers.

Researchers are allowed to send phishing emails to mailboxes in the **@jet.su** domain.

## Non-tolerable events eligible for a reward

### Infrastructure control takeover with the possibility of encryption
Demonstrate the ability to encrypt most of the production server infrastructure by obtaining the following: 
•	Domain administrator privileges.
•	Administrative access to the virtualization system.
•	Other access to any of the centralized systems that allows centralized management of at least ten servers.
You must also demonstrate the ability to access the backup system with permissions sufficient to delete backups.
You must gain unrestricted access to encrypt most of the server infrastructure at the operating system or virtualization layer and be able to delete backups of information systems. 

**Attention! Encrypting data and deleting backups is strictly prohibited.**

### Unauthorized access to the Company's customers' systems
Demonstrate the ability to freely connect to the ZAPAD environment and obtain the following in this environment:
•	Domain administrator privileges.
•	Administrative access to the virtualization system. 
•	Bulk access to at least ten virtual workstations.
•	Other access to any of the centralized systems that allows centralized management of at least ten servers.
Alternatively, demonstrate the ability to gain administrative access to firewalls within the ZAPAD environment.
You must gain unrestricted access to connect to the ZAPAD environment with the ability to move laterally or take control of the ZAPAD network.

**Attention! Any attempts to connect to customers' IT infrastructure are strictly prohibited.**

## Program rules

### Participation requirements
Participants must be at least 18 years old. Researchers aged 14–18 are allowed to participate if they can present the written consent of a parent or a legal guardian.

The following individuals **cannot** participate in the program:

•	The Company's employees.
•	The Company's partners and individuals who have been granted access to the Company's IT infrastructure, or who perform tasks related to the security analysis of the Company's IT infrastructure.

## Participant obligations
When participating in the program, you must follow this code of conduct:
•	Familiarize yourself with the program rules before starting work and adhere to them at all stages of research.
•	Follow the report disclosure rules defined by the Company and the rules of the Standoff 365 Bug Bounty platform.
•	Submit an informative report via the Standoff 365 Bug Bounty platform if your actions result in unexpected system behavior that could cause unavailability or degradation of IT infrastructure components.
•	Follow the rules related to the handling of sensitive information. Do not distribute any information you accidentally encounter when researching the infrastructure or attempting to realize a non-tolerable event. When obtaining access to confidential information, do not copy, store, or transmit it.
•	Do not disclose information concerning your research without the Company's explicit agreement. If you have any questions, contact the security team via the Standoff 365 Bug Bounty platform.
•	Maintain communication with the security team, submit reports on your attempts to realize a non-tolerable event in accordance with the program requirements, and provide feedback if requested.

### Obligations of the Company
The Company shall:
•	Take researchers seriously and remove them from the infrastructure as soon as they are detected.
•	Refrain from making baseless accusations against researchers.
•	Treat researchers with respect. If researchers comply with the program requirements and rules, the Company waives any claim against them.

## Disclosure of research
By default, disclosure of any information related to your research is prohibited.

### Prohibited actions
Program participants are not allowed to do the following:
•	Seek employment with the Company to gain legal access to its systems.
•	Bribe or collude with the Company's employees.
•	Get help from the Company's employees (for any kind of cover-up, simplified access and realization of non-tolerable events, or access to and use of the Company's equipment).
•	Influence the Company's employees in any way that may pose a threat to their health or life, or kidnap employees and members of their families. Participants are not allowed to steal any devices, gadgets, or any other property belonging to the Company or its employees.
•	Physically damage the Company's property or use brute force to realize non-tolerable events. Any unauthorized physical intrusion into the Company's offices, branches, or data centers is prohibited.
•	Bribe, collude with or influence the Company's service providers and partners.
•	Exploit any misconfigurations, vulnerabilities, or security issues in the Company's IT infrastructure outside of the cyber evaluation scope or for personal gain.
•	Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion.
•	Conduct attacks that compromise the integrity and availability of services (for example, DoS attacks) or attempt to exploit a vulnerability to cause resource exhaustion.
•	Delete any information belonging to the Company, except where strictly necessary to conceal the traces of one's own presence in the infrastructure. (Researchers can only delete records of their own actions in security logs and artifacts generated during research activities.)
•	Use any social engineering techniques (phishing, vishing, and so on) or spam campaigns targeting the Company's clients or partners.
•	Use any social engineering techniques (phishing, vishing, and so on) or spam campaigns targeting the Company's employees' personal communication channels (personal accounts in messengers and social networks, or personal phone numbers).
•	Perform any actions involving the equipment or systems of the Company's clients or partners.

## Report requirements
As part of the program, we accept reports in Russian or English that include the following information:

•	Proof of the feasibility of a non-tolerable event.
•	Evidence that access to the infrastructure was obtained through the Company's network perimeter or through another method explicitly permitted by the program.
•	Step-by-step technical description of the research process, including the following: 
o	Method you used to penetrate the infrastructure. 
o	Timestamps for each step. 
o	Information about exploits used, including exploit listings.
o	Affected systems.
o	Identifiers of compromised accounts.
o	Detailed steps taken to realize the non-tolerable event.
o	Methods used to conceal your presence in the infrastructure and information about tools used to establish persistence.

•	Recommended remediation measures.
Reports must specify whether any software or files were uploaded to target hosts and subsequently used to attack those hosts during the research.
If parts of a report are unclear, contradictory, or incomplete, the Company may request clarification or additional information. Failure to respond to these requests may result in report rejection.
You can attach videos and screenshots to your report, but they cannot replace the report (it must be filled out).

## Reward for demonstrating non-tolerable events
As part of this cyber evaluation program, **only confirmed and comprehensive demonstrations of non-tolerable events** are eligible for a reward:

•	₽1,500,000 for demonstrating one non-tolerable event
•	₽3,000,000 for demonstrating both non-tolerable events

The reward is granted to the researcher (or research team) that is the **first** to submit a correct, reproducible, and validated report demonstrating the feasibility of a non-tolerable event.

### Rewards for progress (optional)
The Company may award additional incentives to researchers who demonstrate **significant technical progress** toward realizing a non-tolerable event without fully completing all required steps.

These incentives may be awarded **at the Company's discretion and only where the result has an objective value**.

Researchers may be awarded incentives for achieving the following:
•	Breaching the external perimeter and gaining persistent access to the internal environment.
•	Gaining access to virtualization, orchestration, and network segmentation systems or other components providing centralized infrastructure management.
•	Successfully executing technically significant stages of an attack chain, as determined by the security team.

The amounts of incentive payments are **not fixed** and are determined based on the complexity, impact, and practical value of the research results.

No rewards are provided under this program for the following:
•	Reports on vulnerabilities or configuration issues. (We accept reports of this type under our bug bounty (vulnerability) program.)
•	Reports that do not contain information about the feasibility of non-tolerable events.

There can be only one winner. 
Rewards are paid in rubles. If the payment method is changed, the winner is responsible for all associated fees and expenses.