Threat Category: Windows malware | Page 5

The TookPS malicious downloader is distributed under the guise of DeepSeek, and further mimics UltraViewer, AutoCAD, SketchUp, Ableton, and other popular tools.

Kaspersky experts describe a new wave of attacks distributing the DCRat backdoor through YouTube under the guise of game cheats.

In this article, we discuss the tools and TTPs used in the SideWinder APT’s attacks in H2 2024, as well as shifts in its targets, such as an increase in attacks against the maritime and logistics sectors.

Kaspersky experts have discovered campaigns distributing stealers, malicious PowerShell scripts, and backdoors through web pages mimicking the DeepSeek and Grok websites.

Attackers blackmail YouTubers with complaints and account blocking threats, forcing them to distribute a miner disguised as a bypass tool.

Kaspersky SOC analysts discuss a recent incident where the well-known Behinder web shell was used as a post-exploitation backdoor, showing how web shells have evolved.

Kaspersky experts analyze the Angry Likho APT group’s attacks, which use obfuscated AutoIt scripts and the Lumma stealer for data theft.

Kaspersky GReAT experts have discovered a new campaign distributing the XMRig cryptominer through popular games such as BeamNG.drive and Dyson Sphere Program on torrent trackers.

How cyberattackers exploit group policies, what risks attacks like these pose, and what measures can be taken to protect against such threats.

We analyze the latest activity by the Cloud Atlas gang. The attacks employ the PowerShower, VBShower and VBCloud modules to download victims’ data with various PowerShell scripts.

Kaspersky experts analyze attacks by C.A.S, a cybergang that uses uncommon remote access Trojans and posts data about victims in public Telegram channels.

Kaspersky experts review dark market trends in 2024, such as popularity of cryptors, loaders and crypto drainers on the dark web, and discuss what to expect in 2025.

While the CrowdStrike incident is still fresh in our minds, Kaspersky experts look back on similar IT outages that happened in 2024 and predict potential threats for 2025.

Kaspersky researchers demonstrate capabilities of hrtng plugin for IDA Pro, share tips on working with IDA and reverse engineer FinSpy malware with these tools.

The “Kaspersky Security Bulletin 2024. Statistics” report contains statistics on cyberthreats for the period from November 2023 through October 2024. It covers such threats as financial malware, ransomware, miners, malware for IoT and macOS, vulnerabilities and others.

Reports

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.

Windows malware

TookPS: DeepSeek isn’t the only game in town

DCRat backdoor returns

SideWinder targets the maritime and nuclear sectors with an updated toolset

Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity

Undercover miner: how YouTubers get pressed into distributing SilentCryptoMiner as a restriction bypass tool

The SOC files: Chasing the web shell

Angry Likho: Old beasts in a new forest

StaryDobry ruins New Year’s Eve, delivering miner instead of presents

One policy to rule them all

Cloud Atlas seen using a new tool in its attacks

Analysis of Cyber Anarchy Squad attacks targeting Russian and Belarusian organizations

Dark web threats and dark market predictions for 2025

Story of the Year: global IT outages and supply chain attacks

Our secret ingredient for reverse engineering

Kaspersky Security Bulletin 2024. Statistics

Reports

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Armored Likho expands its cyber-espionage toolkit

Mirage Kitten targets Middle East and Africa region with new malware