Kaspersky GReAT expert takes a closer look at the RevengeHotels threat actor’s new campaign, including AI-generated scripts, targeted phishing, and VenomRAT. This article has been indexed from Securelist Read the original article: RevengeHotels: a new wave of attacks leveraging LLMs…
Category: Securelist
RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT
Kaspersky GReAT expert takes a closer look at the RevengeHotels threat actor’s new campaign, including AI-generated scripts, targeted phishing, and VenomRAT. This article has been indexed from Securelist Read the original article: RevengeHotels: a new wave of attacks leveraging LLMs…
Shiny tools, shallow checks: how the AI hype opens the door to malicious MCP servers
Kaspersky experts discuss the Model Context Protocol used for AI integration. We describe the MCP’s architecture, attack vectors and follow a proof of concept to see how it can be abused. This article has been indexed from Securelist Read the…
Notes of cyber inspector: three clusters of threat in cyberspace
This report on cybercrime, hacktivist and APT groups targeting primarily Russian organizations provides an analysis and comparison of their TTPs and divides them into three clusters. This article has been indexed from Securelist Read the original article: Notes of cyber…
IT threat evolution in Q2 2025. Non-mobile statistics
The report presents statistics for Windows, macOS, IoT, and other threats, including ransomware, miners, local and web-based threats, for Q2 2025. This article has been indexed from Securelist Read the original article: IT threat evolution in Q2 2025. Non-mobile statistics
IT threat evolution in Q2 2025. Mobile statistics
The report contains statistics on mobile threats (malware, adware, and unwanted software for Android) for Q2 2025, as well as a description of the most notable malware types identified during the reporting period. This article has been indexed from Securelist…
Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it
Kaspersky experts explain the different types of cookies, how to configure them correctly, and how to protect yourself from session hijacking attacks. This article has been indexed from Securelist Read the original article: Cookies and how to bake them: what…
Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it
Kaspersky experts explain the different types of cookies, how to configure them correctly, and how to protect yourself from session hijacking attacks. This article has been indexed from Securelist Read the original article: Cookies and how to bake them: what…
How attackers adapt to built-in macOS protection
We analyze the built-in protection mechanisms in macOS: how they work, how threat actors can attack them or deceive users, and how to detect such attacks. This article has been indexed from Securelist Read the original article: How attackers adapt…
Exploits and vulnerabilities in Q2 2025
This report provides statistical data on published vulnerabilities and exploits we researched in Q2 2025. It also includes summary data on the use of C2 frameworks. This article has been indexed from Securelist Read the original article: Exploits and vulnerabilities…
Modern vehicle cybersecurity trends
Modern vehicles, their current and future threats, and approaches to automotive cybersecurity. This article has been indexed from Securelist Read the original article: Modern vehicle cybersecurity trends
GodRAT – New RAT targeting financial institutions
Kaspersky experts analyze GodRAT, a new Gh0st RAT-based tool attacking financial firms. It is likely a successor of the AwesomePuppet RAT connected to the Winnti group. This article has been indexed from Securelist Read the original article: GodRAT – New…
GodRAT – New RAT targeting financial institutions
Kaspersky experts analyze GodRAT, a new Gh0st RAT-based tool attacking financial firms. It is likely a successor of the AwesomePuppet RAT connected to the Winnti group. This article has been indexed from Securelist Read the original article: GodRAT – New…
Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824
We examine the evolution of the PipeMagic backdoor and the TTPs of its operators – from the RansomExx incident in 2022 to attacks in Brazil and Saudi Arabia, and the exploitation of CVE-2025-29824 in 2025. This article has been indexed…
New trends in phishing and scams: how AI and social media are changing the game
Common tactics in phishing and scams in 2025: learn about the use of AI and deepfakes, phishing via Telegram, Google Translate and Blob URLs, biometric data theft, and more. This article has been indexed from Securelist Read the original article:…
Scammers mass-mailing the Efimer Trojan to steal crypto
The Efimer Trojan spreads through email and hacked WordPress websites, steals cryptocurrency, and substitutes wallets in the clipboard. This article has been indexed from Securelist Read the original article: Scammers mass-mailing the Efimer Trojan to steal crypto
Driver of destruction: How a legitimate driver is being used to take down AV processes
In an incident response case, Kaspersky experts discovered new malware that terminates AV processes by abusing the legitimate ThrottleStop driver. Kaspersky solutions successfully counter and detect this threat. This article has been indexed from Securelist Read the original article: Driver…
Cobalt Strike Beacon delivered via GitHub and social media
A campaign targeting Russian entities leveraged social media, Microsoft Learn Challenge, Quora, and GitHub as intermediate C2 servers to deliver Cobalt Strike Beacon. This article has been indexed from Securelist Read the original article: Cobalt Strike Beacon delivered via GitHub…
Cobalt Strike Beacon delivered via GitHub and social media
A campaign targeting Russian entities leveraged social media, Microsoft Learn Challenge, Quora, and GitHub as intermediate C2 servers to deliver Cobalt Strike Beacon. This article has been indexed from Securelist Read the original article: Cobalt Strike Beacon delivered via GitHub…
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Explaining the ToolShell vulnerabilities in SharePoint: how the POST request exploit works, why initial patches can be easily bypassed, and how to stay protected. This article has been indexed from Securelist Read the original article: ToolShell: a story of five…