Cristian Souza
Incident Response Specialist, GERT
Cristian Souza is an Incident Response Specialist at Kaspersky’s Global Emergency Response Team (GERT). He holds a degree in Computer Networks and is currently pursuing a Ph.D. in Computer Science at the University of São Paulo (USP). Cristian’s primary responsibilities include conducting forensic analysis of critical incidents, identifying their root causes, and performing malware reverse engineering. An active contributor to the cyber security community, Cristian has published several research papers and holds certifications including CISSP, GCFA, GREM, and GXPN.Publications
Reports
ToddyCat: your hidden email assistant. Part 2
An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services.
Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
Cloud Atlas attacks the public sector and diplomatic structures of Russia and Belarus, using ReverseSocks, SSH, and Tor for persistence in infected systems and its new tool, PowerCloud.
Kimsuky targets organizations with PebbleDash-based tools
Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.
OceanLotus suspected of using PyPI to deliver ZiChatBot malware
Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT.
