HelloNet campaign — new malicious modules launched through the ViPNet update system
posted
We identified targeted infection attempts against large Russian organizations using the ViPNet update system (a software suite for creating secure networks).
Kaspersky Next EDR Expert
Powerful EDR solution that identifies and prevents advanced threats. It automatically detects suspicious activity, enables incident investigation, and equips security teams with the tools to respond quickly and effectively.
Use cases in real-world incidents:
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
posted
An inside look at the active Armored Likho APT campaign. The attackers are using spear-phishing, AI-generated loaders, and a new Python-based tool, BusySnake Stealer, to target organizations in Russia, Kazakhstan, and Brazil.
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign
posted
updated UPD
Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection chain and analyze the C2 infrastructure.
From cause to cash: a cross-border look at hacktivist activity
posted
Hacktivist outfits, namely 4BID, Hakerskii Kit, and C.A.S., are now targeting organizations across Kazakhstan, the UAE, Egypt, and Syria.
MiniPlasma: detecting exploitation of a critical unpatched Windows vulnerability
posted
Over the past two months, the anonymous researcher Nightmare Eclipse has publicly released six Windows vulnerabilities complete with ready-to-use exploits, without prior coordination with Microsoft. The most critical of these is MiniPlasma.
DAEMON Tools software infected — supply chain attack ongoing since April 8, 2026
posted
updated UPD
Targeted by threat actors: individuals and organizations across 100+ countries and territories, with the majority of victims located in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.
Information about the Copy Fail vulnerability, which allows attackers to gain root access on virtually any modern Linux distribution
posted
updated UPD
The vulnerability affects kernels released between 2017 and 2026. Both outdated server configurations and modern distributions are at risk: Ubuntu, RHEL etc.
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India
posted
The Silver Fox group is targeting companies in Russia and India by impersonating tax authorities to distribute ValleyRAT and the new ABCDoor backdoor.
Lotus Wiper: a new threat targeting the energy and utilities sector
posted
Kaspersky researchers analyze the attack chain of a highly destructive Lotus Wiper that can be linked to a targeted attack on the energy and utilities sector.
Adapt or pay: an analysis of the AdaptixC2 framework
posted
We examine how Kaspersky Anti Targeted Attack detects the network activity of AdaptixC2 agents across HTTP/S, TCP, SMB, and other protocols, and how EDR solutions identify post-exploitation activities on a host.
![On April 9, 2026, the website cpuid[.]com, hosting installers for popular system administration software CPU-Z, HWMonitor (HWMonitor Pro) and Perfmonitor 2, was compromised. We observed that starting from approximately April 9, 15:00 UTC, until about April 10, 10:00 UTC, the legitimate download URLs for installers of that software have been replaced with URLS to the following malicious websites:](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/04/10145014/pingpongsuperman_CPU_is_burning_ultra_detailed_sharp_focus_8k_495f9cb6-fa56-4ea8-ad14-88d8c7c8805a_3-gigapixel-redefine-creative-2x-800x450.jpeg){kind=tracking}
CPU-Z / HWMonitor watering hole infection – a copy-pasted attack
posted
updated UPD
In April 2026, cpuid.com delivered trojanized CPU-Z and HWMonitor installers with STX RAT. 150+ victims in Brazil, Russia, China.
The Notepad++ supply chain attack — unnoticed execution chains and new IoCs
posted
updated UPD
Kaspersky GReAT experts discovered previously undocumented infection chains used in the Notepad++ supply chain attacks. The article provides new IoCs related to those incidents which employ DLL sideloading and Cobalt Strike Beacon delivery.
Supply chain attack on eScan antivirus: detecting and remediating malicious updates
posted
updated UPD
On January 20, Kaspersky solutions detected malware used in eScan antivirus supply chain attack. In this article we provide available information on the threat: indicators of compromise, threat hunting and mitigating tips, etc.
Reports
Mirage Kitten targets Middle East and Africa region with new malware
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
ToddyCat: your hidden email assistant. Part 2
An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services.
Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
Cloud Atlas attacks the public sector and diplomatic structures of Russia and Belarus, using ReverseSocks, SSH, and Tor for persistence in infected systems and its new tool, PowerCloud.
Kimsuky targets organizations with PebbleDash-based tools
Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.
