Publications

10 June 2024

This summary provides an overview of the reports of APT and financial attacks on industrial enterprises, as well as the related activities of groups that have been observed attacking industrial organizations and critical infrastructure facilities.

• 0-day,
• adversary-in-the-middle,
• APT,
• Cloud Atlas/Inception,
• living-off-the-land,
• Sofacy,
• Volt Typhoon,
• vulnerabilities

02 April 2024

An overview of reports of APT and financial attacks on industrial enterprises, as well as related activities of groups that have been observed attacking industrial organizations and critical infrastructure facilities

• APT,
• CISA

18 October 2023

Kaspersky experts discovered several detections of malware from the MATA cluster, previously attributed to the Lazarus group, compromising defense contractor companies in Eastern Europe.

• APT,
• Lazarus,
• malware,
• MATA,
• military-defense,
• phishing

25 September 2023

An overview of reports of APT and financial attacks on industrial enterprises, as well as related activities of groups that have been observed attacking industrial organizations and critical infrastructure facilities

• Andariel,
• APT,
• APT29,
• APT41,
• APT43,
• CloudWizard,
• CommonMagic,
• Earth Longzhi,
• Kryptik,
• Lancefly,
• Lazarus,
• malware,
• MATA,
• Mint Sandstorm,
• PlugX,
• RA,
• ransomware,
• RomCom,
• Royal,
• Snake,
• Sofacy,
• Tortoiseshell,
• Vice Society,
• Volt Typhoon,
• YoroTrooper

10 August 2023

In this part we present information on the four types of implants and two tools used during the last (third) stage of the attacks discovered.

• APT,
• cloud services,
• DLL hijacking,
• FourteenHi

31 July 2023

This part of the research is devoted to second stage malware used to gather data on infected systems of industrial organizations.

• Air-gapped networks,
• APT,
• DLL hijacking,
• FourteenHi,
• Stolen data exfiltration,
• USB removable media

20 July 2023

In this article (which is the first part of the report) we analyze common TTPs of implants used by threat actors to establish a persistent remote access channel into the infrastructure of industrial organizations.

• APT,
• APT31,
• cloud services,
• DLL hijacking,
• FourteenHi,
• MeatBall

22 November 2022

Cybersecurity incidents were plentiful in 2022, causing many problems for industrial infrastructure owners and operators. Below we share some of our thoughts on potential developments of 2023, though we cannot claim to be providing either a complete picture or a high degree of precision.

• APT,
• ICS security,
• industrial cybersecurity,
• phishing,
• vulnerabilities

08 September 2022

Events in the cybersecurity world, including ICS, were intense in H1 2022.

• APT,
• automotive,
• electronics industry,
• energy sector,
• hacktivists,
• oil & gas,
• ransomware

08 August 2022

The attackers were able to penetrate dozens of enterprises and even hijack the IT infrastructure of some, taking control of systems used to manage security solutions. The goal of this series of attacks was cyberespionage.

• APT,
• cyberespionage,
• government,
• manufacturing,
• phishing,
• TA428