Deputy Director, Global Research & Analysis Team
Sergey joined Kaspersky in 2002 and was appointed Deputy Director for the company’s Global Research & Analysis Team in March 2013. Prior to becoming Deputy Director, Sergey was the Head of the company’s Global Research & Analysis Team in the EEMEA region. Sergey is responsible managing the department’s operational activities in addition organizing Kaspersky’s annual Security Analyst Summit. Each year the summit brings the world’s best IT security experts together to collaborate and exchange research alongside international organizations, law enforcement agencies and technology companies. Sergey has a degree in Applied Mathematics from the Moscow State University of Railway Engineering and holds a postgraduate degree in IT Security. He is based in Moscow.This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.
We recently discovered a Trojanized DeFi application that was compiled in November 2021. This application contains a legitimate program called DeFi Wallet that saves and manages a cryptocurrency wallet, but also implants a full-featured backdoor.
At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41.
It appears that BlueNoroff shifted focus from hitting banks and SWIFT-connected servers to solely cryptocurrency businesses as the main source of the group’s illegal income.