Threat Response

The vulnerability affects kernels released between 2017 and 2026. Both outdated server configurations and modern distributions are at risk: Ubuntu, RHEL etc.

Targeted by threat actors: individuals and organizations across 100+ countries and territories, with the majority of victims located in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.

Kaspersky researchers analyze the attack chain of a highly destructive Lotus Wiper that can be linked to a targeted attack on the energy and utilities sector.

We examine how Kaspersky Anti Targeted Attack detects the network activity of AdaptixC2 agents across HTTP/S, TCP, SMB, and other protocols, and how EDR solutions identify post-exploitation activities on a host.

On April 9, 2026, the website cpuid[.]com, hosting installers for popular system administration software CPU-Z, HWMonitor (HWMonitor Pro) and Perfmonitor 2, was compromised. We observed that starting from approximately April 9, 15:00 UTC, until about April 10, 10:00 UTC, the legitimate download URLs for installers of that software have been replaced with URLS to the following malicious websites:

In April 2026, cpuid.com delivered trojanized CPU-Z and HWMonitor installers with STX RAT. 150+ victims in Brazil, Russia, China.

Reports

The Silver Fox group is targeting companies in Russia and India by impersonating tax authorities to distribute ValleyRAT and the new ABCDoor backdoor.

Kaspersky researchers analyze updated CoolClient backdoor and new tools and scripts used in HoneyMyte (aka Mustang Panda or Bronze President) APT campaigns, including three variants of a browser data stealer.

Kaspersky discloses a 2025 HoneyMyte (aka Mustang Panda or Bronze President) APT campaign, which uses a kernel-mode rootkit to deliver and protect a ToneShell backdoor.

Kaspersky GReAT experts analyze the Evasive Panda APT’s infection chain, including shellcode encrypted with DPAPI and RC5, as well as the MgBot implant.

Threat Response

Information about the Copy Fail vulnerability, which allows attackers to gain root access on virtually any modern Linux distribution

DAEMON Tools software infected – supply chain attack ongoing since April 8, 2026

Lotus Wiper: a new threat targeting the energy and utilities sector

Adapt or pay: an analysis of the AdaptixC2 framework

CPU-Z / HWMonitor watering hole infection – a copy-pasted attack

Reports

Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor

Evasive Panda APT poisons DNS requests to deliver MgBot

Subscribe to our weekly e-mails