Kaspersky GReAT experts dive deep into the BlueNoroff APT’s GhostCall and GhostHire campaigns. Extensive research detailing multiple malware chains targeting macOS, including a stealer suite, fake Zoom and Microsoft Teams clients and ChatGPT-enhanced images. This article has been indexed from…
Tag: Securelist
Mem3nt0 mori – The Hacking Team is back!
Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks. This article has been indexed from Securelist Read the original article: Mem3nt0 mori – The Hacking Team…
Deep analysis of the flaw in BetterBank reward logic
Kaspersky experts break down the recent BetterBank incident involving ESTEEM token bonus minting due to the lack of liquidity pool validation. This article has been indexed from Securelist Read the original article: Deep analysis of the flaw in BetterBank reward…
The evolving landscape of email phishing attacks: how threat actors are reusing and refining established techniques
Common email phishing tactics in 2025 include PDF attachments with QR codes, password-protected PDF documents, calendar phishing, and advanced websites that validate email addresses. This article has been indexed from Securelist Read the original article: The evolving landscape of email…
PassiveNeuron: a sophisticated campaign targeting servers of high-profile organizations
Kaspersky GReAT experts break down a recent PassiveNeuron campaign that targets servers worldwide with custom Neursite and NeuralExecutor APT implants and Cobalt Strike. This article has been indexed from Securelist Read the original article: PassiveNeuron: a sophisticated campaign targeting servers…
Post-exploitation framework now also delivered via npm
The npm registry contains a malicious package that downloads the AdaptixC2 agent onto victims’ devices, Kaspersky experts have found. The threat targets Windows, Linux, and macOS. This article has been indexed from Securelist Read the original article: Post-exploitation framework now…
SEO spam and hidden links: how to protect your website and your reputation
Are you seeing your website traffic drop, and security systems blocking it for pornographic content that is not there? Hidden links, a type of SEO spam, could be the cause. This article has been indexed from Securelist Read the original…
Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution
A malware campaign was recently detected in Brazil, distributing a malicious LNK file using WhatsApp. It delivered a new Maverick banker, which features code overlaps with Coyote malware. This article has been indexed from Securelist Read the original article: Maverick:…
Mysterious Elephant: a growing threat
Kaspersky GReAT experts describe the latest Mysterious Elephant APT activity. The threat actor exfiltrates data related to WhatsApp and employs tools such as BabShell and MemLoader HidenDesk. This article has been indexed from Securelist Read the original article: Mysterious Elephant:…
Signal in the noise: what hashtags reveal about hacktivism in 2025
Kaspersky researchers identified over 2000 unique hashtags across 11,000 hacktivist posts on the surface web and the dark web to find out how hacktivist campaigns function and whom they target. This article has been indexed from Securelist Read the original…
The king is dead, long live the king! Windows 10 EOL and Windows 11 forensic artifacts
With the end of Windows 10 support approaching, we discuss which forensic artifacts in Windows 11 may be of interest. This article has been indexed from Securelist Read the original article: The king is dead, long live the king! Windows…
How we trained an ML model to detect DLL hijacking
An expert at the Kaspersky AI expertise center explains how the team developed a machine-learning model to identify DLL hijacking attacks. This article has been indexed from Securelist Read the original article: How we trained an ML model to detect…
Detecting DLL hijacking with machine learning: real-world cases
We will tell you how we integrated a DLL Hijacking detection model into the Kaspersky SIEM platform and how it helped us uncover several incidents in their early stages. This article has been indexed from Securelist Read the original article:…
Forensic journey: hunting evil within AmCache
Kaspersky experts share insights into how AmCache may prove useful during incident investigation, and provide a command line tool to extract data from this artifact. This article has been indexed from Securelist Read the original article: Forensic journey: hunting evil…
Massive npm infection: the Shai-Hulud worm and patient zero
We dissect a recent incident where npm packages with millions of downloads were infected by the Shai-Hulud worm. Kaspersky experts describe the starting point for the source of the infection. This article has been indexed from Securelist Read the original…
Threat landscape for industrial automation systems in Q2 2025
Kaspersky industrial threat report contains statistics on various malicious objects detected and blocked on ICS computers by Kaspersky solutions in Q2 2025. This article has been indexed from Securelist Read the original article: Threat landscape for industrial automation systems in…
RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT
Kaspersky GReAT expert takes a closer look at the RevengeHotels threat actor’s new campaign, including AI-generated scripts, targeted phishing, and VenomRAT. This article has been indexed from Securelist Read the original article: RevengeHotels: a new wave of attacks leveraging LLMs…
RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT
Kaspersky GReAT expert takes a closer look at the RevengeHotels threat actor’s new campaign, including AI-generated scripts, targeted phishing, and VenomRAT. This article has been indexed from Securelist Read the original article: RevengeHotels: a new wave of attacks leveraging LLMs…
Shiny tools, shallow checks: how the AI hype opens the door to malicious MCP servers
Kaspersky experts discuss the Model Context Protocol used for AI integration. We describe the MCP’s architecture, attack vectors and follow a proof of concept to see how it can be abused. This article has been indexed from Securelist Read the…
Notes of cyber inspector: three clusters of threat in cyberspace
This report on cybercrime, hacktivist and APT groups targeting primarily Russian organizations provides an analysis and comparison of their TTPs and divides them into three clusters. This article has been indexed from Securelist Read the original article: Notes of cyber…