Publications

25 December 2024

The percentage of ICS computers on which malicious objects were blocked decreased from the second quarter to 22%. But the figure increased in Africa, South Asia, South-East Asia, the Middle East, Latin America, and East Asia. Regionally, the percentage ranged from 9.7% in Northern Europe to 31.5% in Africa.

• APT,
• biometrics,
• buildings automation,
• construction,
• malware,
• manufacturing,
• miners,
• phishing,
• ransomware,
• spyware,
• statistics

25 December 2024

The percentage of ICS computers on which malicious objects were blocked decreased by 1.5 pp from the second quarter to 22%. The biometrics sector led the surveyed industries in terms of this parameter.

• APT,
• biometrics,
• buildings automation,
• construction,
• malware,
• manufacturing,
• miners,
• phishing,
• ransomware,
• spyware,
• statistics

10 June 2024

This summary provides an overview of the reports of APT and financial attacks on industrial enterprises, as well as the related activities of groups that have been observed attacking industrial organizations and critical infrastructure facilities.

• 0-day,
• adversary-in-the-middle,
• APT,
• APT overview,
• Cloud Atlas/Inception,
• living-off-the-land,
• Sofacy,
• Volt Typhoon,
• vulnerabilities

02 April 2024

An overview of reports of APT and financial attacks on industrial enterprises, as well as related activities of groups that have been observed attacking industrial organizations and critical infrastructure facilities

• APT,
• APT overview,
• CISA

18 October 2023

Kaspersky experts discovered several detections of malware from the MATA cluster, previously attributed to the Lazarus group, compromising defense contractor companies in Eastern Europe.

• APT,
• Lazarus,
• malware,
• MATA,
• military-defense,
• phishing

25 September 2023

An overview of reports of APT and financial attacks on industrial enterprises, as well as related activities of groups that have been observed attacking industrial organizations and critical infrastructure facilities

• Andariel,
• APT,
• APT29,
• APT41,
• APT43,
• APT overview,
• CloudWizard,
• CommonMagic,
• Earth Longzhi,
• Kryptik,
• Lancefly,
• Lazarus,
• malware,
• MATA,
• Mint Sandstorm,
• PlugX,
• RA,
• ransomware,
• RomCom,
• Royal,
• Snake,
• Sofacy,
• Tortoiseshell,
• Vice Society,
• Volt Typhoon,
• YoroTrooper

10 August 2023

In this part we present information on the four types of implants and two tools used during the last (third) stage of the attacks discovered.

• APT,
• cloud services,
• DLL hijacking,
• FourteenHi

31 July 2023

This part of the research is devoted to second stage malware used to gather data on infected systems of industrial organizations.

• Air-gapped networks,
• APT,
• DLL hijacking,
• FourteenHi,
• Stolen data exfiltration,
• USB removable media

20 July 2023

In this article (which is the first part of the report) we analyze common TTPs of implants used by threat actors to establish a persistent remote access channel into the infrastructure of industrial organizations.

• APT,
• APT31,
• cloud services,
• DLL hijacking,
• FourteenHi,
• MeatBall

22 November 2022

Cybersecurity incidents were plentiful in 2022, causing many problems for industrial infrastructure owners and operators. Below we share some of our thoughts on potential developments of 2023, though we cannot claim to be providing either a complete picture or a high degree of precision.

• APT,
• ICS security,
• industrial cybersecurity,
• phishing,
• vulnerabilities