Kaspersky experts share insights into how AmCache may prove useful during incident investigation, and provide a command line tool to extract data from this artifact. This article has been indexed from Securelist Read the original article: Forensic journey: hunting evil…
Category: Securelist
Massive npm infection: the Shai-Hulud worm and patient zero
We dissect a recent incident where npm packages with millions of downloads were infected by the Shai-Hulud worm. Kaspersky experts describe the starting point for the source of the infection. This article has been indexed from Securelist Read the original…
Threat landscape for industrial automation systems in Q2 2025
Kaspersky industrial threat report contains statistics on various malicious objects detected and blocked on ICS computers by Kaspersky solutions in Q2 2025. This article has been indexed from Securelist Read the original article: Threat landscape for industrial automation systems in…
RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT
Kaspersky GReAT expert takes a closer look at the RevengeHotels threat actor’s new campaign, including AI-generated scripts, targeted phishing, and VenomRAT. This article has been indexed from Securelist Read the original article: RevengeHotels: a new wave of attacks leveraging LLMs…
RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT
Kaspersky GReAT expert takes a closer look at the RevengeHotels threat actor’s new campaign, including AI-generated scripts, targeted phishing, and VenomRAT. This article has been indexed from Securelist Read the original article: RevengeHotels: a new wave of attacks leveraging LLMs…
Shiny tools, shallow checks: how the AI hype opens the door to malicious MCP servers
Kaspersky experts discuss the Model Context Protocol used for AI integration. We describe the MCP’s architecture, attack vectors and follow a proof of concept to see how it can be abused. This article has been indexed from Securelist Read the…
Notes of cyber inspector: three clusters of threat in cyberspace
This report on cybercrime, hacktivist and APT groups targeting primarily Russian organizations provides an analysis and comparison of their TTPs and divides them into three clusters. This article has been indexed from Securelist Read the original article: Notes of cyber…
IT threat evolution in Q2 2025. Non-mobile statistics
The report presents statistics for Windows, macOS, IoT, and other threats, including ransomware, miners, local and web-based threats, for Q2 2025. This article has been indexed from Securelist Read the original article: IT threat evolution in Q2 2025. Non-mobile statistics
IT threat evolution in Q2 2025. Mobile statistics
The report contains statistics on mobile threats (malware, adware, and unwanted software for Android) for Q2 2025, as well as a description of the most notable malware types identified during the reporting period. This article has been indexed from Securelist…
Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it
Kaspersky experts explain the different types of cookies, how to configure them correctly, and how to protect yourself from session hijacking attacks. This article has been indexed from Securelist Read the original article: Cookies and how to bake them: what…
Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it
Kaspersky experts explain the different types of cookies, how to configure them correctly, and how to protect yourself from session hijacking attacks. This article has been indexed from Securelist Read the original article: Cookies and how to bake them: what…
How attackers adapt to built-in macOS protection
We analyze the built-in protection mechanisms in macOS: how they work, how threat actors can attack them or deceive users, and how to detect such attacks. This article has been indexed from Securelist Read the original article: How attackers adapt…
Exploits and vulnerabilities in Q2 2025
This report provides statistical data on published vulnerabilities and exploits we researched in Q2 2025. It also includes summary data on the use of C2 frameworks. This article has been indexed from Securelist Read the original article: Exploits and vulnerabilities…
Modern vehicle cybersecurity trends
Modern vehicles, their current and future threats, and approaches to automotive cybersecurity. This article has been indexed from Securelist Read the original article: Modern vehicle cybersecurity trends
GodRAT – New RAT targeting financial institutions
Kaspersky experts analyze GodRAT, a new Gh0st RAT-based tool attacking financial firms. It is likely a successor of the AwesomePuppet RAT connected to the Winnti group. This article has been indexed from Securelist Read the original article: GodRAT – New…
GodRAT – New RAT targeting financial institutions
Kaspersky experts analyze GodRAT, a new Gh0st RAT-based tool attacking financial firms. It is likely a successor of the AwesomePuppet RAT connected to the Winnti group. This article has been indexed from Securelist Read the original article: GodRAT – New…
Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824
We examine the evolution of the PipeMagic backdoor and the TTPs of its operators – from the RansomExx incident in 2022 to attacks in Brazil and Saudi Arabia, and the exploitation of CVE-2025-29824 in 2025. This article has been indexed…
New trends in phishing and scams: how AI and social media are changing the game
Common tactics in phishing and scams in 2025: learn about the use of AI and deepfakes, phishing via Telegram, Google Translate and Blob URLs, biometric data theft, and more. This article has been indexed from Securelist Read the original article:…
Scammers mass-mailing the Efimer Trojan to steal crypto
The Efimer Trojan spreads through email and hacked WordPress websites, steals cryptocurrency, and substitutes wallets in the clipboard. This article has been indexed from Securelist Read the original article: Scammers mass-mailing the Efimer Trojan to steal crypto
Driver of destruction: How a legitimate driver is being used to take down AV processes
In an incident response case, Kaspersky experts discovered new malware that terminates AV processes by abusing the legitimate ThrottleStop driver. Kaspersky solutions successfully counter and detect this threat. This article has been indexed from Securelist Read the original article: Driver…