Anna Pavlovskaya

Featured in:

Articles

How phishing pages admit to being LLM-made

Oct 31, 2024 | securelist.com | Vladislav Tushkanov |Boris Larin |Vasily Berdnikov |Anna Pavlovskaya

One topic being actively researched in connection with the breakout of LLMs is capability uplift – when employees with limited experience or resources in some area become able to perform at a much higher level thanks to LLM technology. This is especially important in information security, where cyberattacks are becoming increasingly cost-effective and larger-scale, causing headaches for security teams. Among other tools, attackers use LLMs to generate content for fake websites.
Analyzing the Awaken Likho APT group implant: new tools and techniques

Oct 7, 2024 | securelist.com | Kaspersky ICS CERT |Anna Larkina |Flavio Negrini |Anna Pavlovskaya

IntroductionIn July 2021, a campaign was launched primarily targeting Russian government agencies and industrial enterprises. Shortly after the campaign started, we began tracking it, and published three reports in August and September 2024 through our threat research subscription on the threat actor we named Awaken Likho (also named by other vendors as Core Werewolf).
Key Group uses leaked builders of ransomware and wipers

Oct 1, 2024 | securelist.com | Anna Larkina |Flavio Negrini |Dmitry Kalinin |Anna Pavlovskaya

Key Group, or keygroup777, is a financially motivated ransomware group primarily targeting Russian users. The group is known for negotiating with victims on Telegram and using the Chaos ransomware builder. The first public report on Key Group’s activity was released in 2023 by BI.ZONE, a cybersecurity solutions vendor: the attackers drew attention when they left an ideological note during an attack on a Russian user, in which they did not demand money.
Threat landscape for industrial automation systems, Q2 2024

Sep 26, 2024 | securelist.com | Kaspersky ICS CERT |Artem Ushkov |Anna Pavlovskaya

Statistics across all threatsIn the second quarter of 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 0.9 pp from the previous quarter to 23.5%. The percentage has decreased by 3.3 pp compared to the second quarter of 2023, when the indicator reached its highest level since records began in 2022. Regions rankingIn most regions, the percentage of ICS computers that blocked malicious objects decreased compared to the first quarter of 2024.
Analysis of the BlackJack group: techniques, tools, and similarities with Twelve

Sep 25, 2024 | securelist.com | Artem Ushkov |Sherif Magdy |Anna Pavlovskaya

While analyzing attacks on Russian organizations, our team regularly encounters overlapping tactics, techniques, and procedures (TTPs) among different cybercrime groups, and sometimes even shared tools. We recently discovered one such overlap: similar tools and tactics between two hacktivist groups – BlackJack and Twelve, which likely belong to a single cluster of activity.
Dark web threats and dark market predictions for 2024

Jan 17, 2024 | securelist.com | Sergey Lozhkin |Anna Pavlovskaya |Kaspersky Security |Boris Larin

An overview of last year’s predictionsA data leakage is a broad term encompassing various types of information that become publicly available, or published for sale on the dark web or other shadow web sites. Leaked information may include internal corporate documents, databases, personal and work login credentials, and other types of data. Last year, we predicted that personal data and corporate email would increasingly be at risk, and the prediction proved largely accurate.
Operation Triangulation: The last (hardware) mystery

Dec 27, 2023 | securelist.com | Boris Larin |Sergey Puzan |Sergey Lozhkin |Anna Pavlovskaya

Today, on December 27, 2023, we (Boris Larin, Leonid Bezvershenko, and Georgy Kucherin) delivered a presentation, titled, “Operation Triangulation: What You Get When Attack iPhones of Researchers”, at the 37th Chaos Communication Congress (37C3), held at Congress Center Hamburg. The presentation summarized the results of our long-term research into Operation Triangulation, conducted with our colleagues, Igor Kuznetsov, Valentin Pashkov, and Mikhail Vinogradov.
Kaspersky crimeware report: FakeSG, Akira and AMOS

Dec 13, 2023 | securelist.com | Sergey Puzan |Anton Kivva |Igor Kuznetsov |Anna Pavlovskaya

IntroductionThe crimeware landscape is diverse. Cybercriminals try to capitalize on their victims in every possible way by distributing various types of malware designed for different platforms. In recent months, we have written private reports on a wide range of topics, such as new cross-platform ransomware, macOS stealers and malware distribution campaigns. In this article, we share excerpts from our reports on the FakeSG campaign, the Akira ransomware and the AMOS stealer.