CyberWatch Newsroom Live Intel

Important CVE-2023-32629 Kaspersky Securelist

2026-10-27 Kaspersky Securelist

An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure

This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure policy, and all security issues we found were fixed in full. The inf…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-10-26 Kaspersky Securelist

Deploying AI agents securely: how Kaspersky products mitigate AI threats

Introduction AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Critical CVE-2022-21894 Kaspersky Securelist

2026-10-22 Kaspersky Securelist

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Introduction Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of sa…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Critical CVE-2026-109618 Kaspersky Securelist

2026-10-21 Kaspersky Securelist

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

UPD 23.10.2026 : added Kaspersky SIEM rules and events for developing custom detection rules or conducting threat hunting. UPD 22.10.2026 : added a description of how the Kaspersky Managed Detection and Response service detects the described malicious activity. UPD 22.10.2026 : added a description of how Kaspersky Vulnerability Management detects vulnerable …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Critical Kaspersky Securelist

2026-10-21 Kaspersky Securelist

Operation FlashHole: Lazarus breaks security, defies control

In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole . In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of i…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Critical CVE-2026-4272 Kaspersky Securelist

2026-10-20 Kaspersky Securelist

The journey of a paper unicorn: adventures inside a modern warehouse

Introduction Imagine you’ve ordered a small paper unicorn from an online marketplace. You clicked “Buy”, received a cheerful notification, and expect a courier to bring the box tomorrow. If the unicorn is delayed by a day, it will be annoying but not catastrophic: an apology, a discount promo code — and the incident is forgotten. Now let’s multiply one late …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Critical Kaspersky Securelist

2026-09-24 Kaspersky Securelist

MacSync under the microscope: new delivery methods and a new payload

MacSync is a relatively young, rapidly evolving family of crypto/info stealers. First advertised on the dark web in 2025 as Mac.c, the stealer was later renamed to MacSync by its creators. The initial versions were implemented as AppleScripts and closely resembled the AMOS stealer family, but over time, MacSync developed distinctive features of its own, incl…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Critical Kaspersky Securelist

2026-09-21 Kaspersky Securelist

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Important Kaspersky Securelist

2026-09-17 Kaspersky Securelist

The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

Introduction Torrent trackers have long been abused for distributing malicious software, disguised as popular films, games, and other content. Our previous research has shown that cybercriminals repeatedly turn to torrents as an initial infection vector, using trojanized cracks and installers to reach a large number of users. Installation guides for pirated …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate CVE-2020-0688 Kaspersky Securelist

2026-09-16 Kaspersky Securelist

NightEagle targets Russian companies

Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (also tracked as APT-Q-95) . This group has been active since at least 2023 and originally focused on organizations in Asia. We have now identified attacks by the group targeting businesses in Russia. This post examines both known a…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-09-04 Kaspersky Securelist

Angry Birds: Toy Ghouls’ new toys

Introduction We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shif…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Important Kaspersky Securelist

2026-09-01 Kaspersky Securelist

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia. NodeRabbit is a cross-platform remote access…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-08-31 Kaspersky Securelist

ValleyRAT masquerading as adware

Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-08-27 Kaspersky Securelist

Threat landscape for industrial automation systems. Q2 2026

All threats In Q2 2026, the percentage of ICS computers on which malicious objects were blocked continued to decrease, falling to 19.15%, its lowest level since 2022. Percentage of ICS computers on which malicious objects were blocked, Q3 2023–Q2 2026 Regionally, the percentages ranged from 8.1% in Northern Europe to 27.9% in Africa. Regions ranked by percen…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Important CVE-2018-0802 Kaspersky Securelist

2026-08-26 Kaspersky Securelist

Exploits and vulnerabilities in Q2 2026

The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subs…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-08-21 Kaspersky Securelist

The invisible passenger in your car

While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Important Kaspersky Securelist

2026-08-14 Kaspersky Securelist

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based ext…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-08-13 Kaspersky Securelist

Armored Likho expands its cyber-espionage toolkit

In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Important Kaspersky Securelist

2026-08-11 Kaspersky Securelist

Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Overview of the attack In July 2026, Kaspersky experts detected a new attack by the Head Mare group. Previously, we classified them as hacktivists, but now we define them as an APT group due to the sophistication of their TTPs and the absence of destructive activity (encryption, wiping) in the targeted infrastructures. In this latest campaign, the attackers …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate Kaspersky Securelist

2026-08-11 Kaspersky Securelist

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service , and the second was published on Securelist the following month, further documenting the framework’s evolving architecture and C2 …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory