Kaspersky researchers demonstrate capabilities of hrtng plugin for IDA Pro, share tips on working with IDA and reverse engineer FinSpy malware with these tools. This article has been indexed from Securelist Read the original article: Our secret ingredient for reverse…
Category: Securelist
Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT
Attackers are sending malicious scripts that download the Remote Manipulator System (RMS) build, known as BurnsRAT, and NetSupport RAT This article has been indexed from Securelist Read the original article: Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT
Kaspersky Security Bulletin 2024. Statistics
The “Kaspersky Security Bulletin 2024. Statistics” report contains statistics on cyberthreats for the period from November 2023 through October 2024. It covers such threats as financial malware, ransomware, miners, malware for IoT and macOS, vulnerabilities and others. This article has…
Сrimeware and financial cyberthreats in 2025
Kaspersky’s GReAT looks back on the 2024 predictions about financial and crimeware threats, and explores potential cybercrime trends for 2025. This article has been indexed from Securelist Read the original article: Сrimeware and financial cyberthreats in 2025
Threats in space (or rather, on Earth): internet-exposed GNSS receivers
Internet-exposed GNSS receivers pose a significant threat to sensitive operations. Kaspersky shares statistics on internet-exposed receivers for July 2024 and advice on how to protect against GNSS attacks. This article has been indexed from Securelist Read the original article: Threats…
Ymir: new stealthy ransomware in the wild
Kaspersky GERT experts have discovered in Colombia new Ymir ransomware, which uses RustyStealer for initial access and the qTox client for communication with its victims. This article has been indexed from Securelist Read the original article: Ymir: new stealthy ransomware…
QSC: A multi-plugin framework used by CloudComputating group in cyberespionage campaigns
Kaspersky shares details on QSC modular cyberespionage framework, which appears to be linked to CloudComputating group campaigns. This article has been indexed from Securelist Read the original article: QSC: A multi-plugin framework used by CloudComputating group in cyberespionage campaigns
New SteelFox Trojan mimics software activators, stealing sensitive data and mining cryptocurrency
Kaspersky experts have discovered a new SteelFox Trojan that mimics popular software like Foxit PDF Editor and JetBrains to spread a stealer-and-miner bundle. This article has been indexed from Securelist Read the original article: New SteelFox Trojan mimics software activators,…
Loose-lipped neural networks and lazy scammers
Scammers use large language models (LLMs) to create phishing pages and leave artifacts in texts and tags, like the phrase “As an AI language model…”. This article has been indexed from Securelist Read the original article: Loose-lipped neural networks and…
Risk reduction redefined: How compromise assessment helps strengthen cyberdefenses
Kaspersky experts analyze cyberdefense weak points, including patch management, policy violations and MSSP issues, and real-world cases where compromise assessment helped detect and mitigate incidents. This article has been indexed from Securelist Read the original article: Risk reduction redefined: How…
Lumma/Amadey: fake CAPTCHAs want to know if you’re human
Malicious CAPTCHA distributed through ad networks delivers the Amadey Trojan or the Lumma stealer, which pilfers data from browsers, password managers, and crypto wallets. This article has been indexed from Securelist Read the original article: Lumma/Amadey: fake CAPTCHAs want to…
The Crypto Game of Lazarus APT: Investors vs. Zero-days
Kaspersky GReAT experts break down the new campaign of Lazarus APT which uses social engineering and exploits a zero-day vulnerability in Google Chrome for financial gain. This article has been indexed from Securelist Read the original article: The Crypto Game…
Grandoreiro, the global trojan with grandiose goals
In this report, Kaspersky experts analyze recent Grandoreiro campaigns, new targets, tricks, and banking trojan versions. This article has been indexed from Securelist Read the original article: Grandoreiro, the global trojan with grandiose goals
Grandoreiro, the global trojan with grandiose ambitions
In this report, Kaspersky experts analyze recent Grandoreiro campaigns, new targets, tricks, and banking trojan versions. This article has been indexed from Securelist Read the original article: Grandoreiro, the global trojan with grandiose ambitions
Stealer here, stealer there, stealers everywhere!
Kaspersky researchers investigated a number of stealer attacks over the past year, and they are now sharing some details on the new Kral stealer, recent AMOS version and Vidar delivering ACR stealer. This article has been indexed from Securelist Read…
Analysis of the Crypt Ghouls group: continuing the investigation into a series of attacks on Russia
A close look at the utilities, techniques, and infrastructure used by the hacktivist group Crypt Ghouls has revealed links to groups such as Twelve, BlackJack, etc. This article has been indexed from Securelist Read the original article: Analysis of the…
SAS CTF and the many ways to persist a kernel shellcode on Windows 7
In this article we solve the most difficult SAS CTF challenge based on the APT technique to introduce and persist a kernel shellcode on Windows 7. This article has been indexed from Securelist Read the original article: SAS CTF and…
Beyond the Surface: the evolution and expansion of the SideWinder APT group
Kaspersky analyzes SideWinder APT’s recent activity: new targets in the MiddleEast and Africa, post-exploitation tools and techniques. This article has been indexed from Securelist Read the original article: Beyond the Surface: the evolution and expansion of the SideWinder APT group
Whispers from the Dark Web Cave. Cyberthreats in the Middle East
The Kaspersky Digital Footprint Intelligence team shares insights into the H1 2024 Middle Eastern cyberthreat landscape: hacktivism, initial access brokers, ransomware, stealers, and so on. This article has been indexed from Securelist Read the original article: Whispers from the Dark…
Awaken Likho is awake: new techniques of an APT group
Kaspersky experts have discovered a new version of the APT Awaken Likho RAT Trojan, which uses AutoIt scripts and the MeshCentral system to target Russian organizations. This article has been indexed from Securelist Read the original article: Awaken Likho is…