Artem Ushkov

Featured in:

Articles

Kaspersky Security Bulletin 2024. Statistics

Dec 4, 2024 | securelist.com | Artem Ushkov |Anna Larkina |Vladislav Tushkanov |Roman Dedenok

All statistics in this report come from Kaspersky Security Network (KSN), a global cloud service that receives information from components in our security solutions voluntarily provided by Kaspersky users. Millions of Kaspersky users around the globe assist us in collecting information about malicious activity. The statistics in this report cover the period from November 2023 through October 2024. The report doesn’t cover mobile statistics, which we will share in our annual mobile malware report.
NetSupport RAT and RMS in malicious emails

Dec 2, 2024 | securelist.com | Artem Ushkov |Anna Larkina |Vladislav Tushkanov |Roman Dedenok

Recent months have seen a surge in mailings with lookalike email attachments in the form of a ZIP archive containing JScript scripts. The script files – disguised as requests and bids from potential customers or partners – bear names such as “Запрос цены и предложения от Индивидуального предпринимателя <ФИО> на август 2024. АРТ-КП0005272381.js” (Request for price and proposal from sole trader <name> for August 2024.
Threat landscape for industrial automation systems, Q2 2024

Sep 26, 2024 | securelist.com | Kaspersky ICS CERT |Artem Ushkov |Anna Pavlovskaya

Statistics across all threatsIn the second quarter of 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 0.9 pp from the previous quarter to 23.5%. The percentage has decreased by 3.3 pp compared to the second quarter of 2023, when the indicator reached its highest level since records began in 2022. Regions rankingIn most regions, the percentage of ICS computers that blocked malicious objects decreased compared to the first quarter of 2024.
Analysis of the BlackJack group: techniques, tools, and similarities with Twelve

Sep 25, 2024 | securelist.com | Artem Ushkov |Sherif Magdy |Anna Pavlovskaya

While analyzing attacks on Russian organizations, our team regularly encounters overlapping tactics, techniques, and procedures (TTPs) among different cybercrime groups, and sometimes even shared tools. We recently discovered one such overlap: similar tools and tactics between two hacktivist groups – BlackJack and Twelve, which likely belong to a single cluster of activity.
A review of prevalent web tracking services in 2023–2024, region by region

Sep 24, 2024 | securelist.com | Anna Larkina |Flavio Negrini |Artem Ushkov |Sherif Magdy

Web tracking has become a pervasive aspect of our online experience. Whether we’re browsing social media, playing video games, shopping for products, or simply reading news articles, trackers are silently monitoring our online behavior, fueling the ceaseless hum of countless data centers worldwide. In this article, we’re going to explore various types of web trackers and present a detailed annual report that dissects their geographical distribution and organizational affiliations.
Necro Trojan infiltrates Google Play and Spotify and WhatsApp mods

Sep 23, 2024 | securelist.com | Dmitry Kalinin |Artem Ushkov |Sherif Magdy |Fedor Sinitsyn

IntroductionWe sometimes come across modified applications when analyzing suspicious files. These are created in response to user requests for more customization options within the app or for new features that the official versions don’t have. Unfortunately, it’s not uncommon for popular mods to contain malware. This often happens because they’re distributed on unofficial websites that don’t have any moderation.
A new version of the Loki backdoor for the Mythic framework attacks Russian companies

Sep 9, 2024 | securelist.com | Artem Ushkov |Anton Kivva |David Emm

In July 2024, we discovered the previously unknown Loki backdoor, which was used in a series of targeted attacks. By analyzing the malicious file and open sources, we determined that Loki is a private version of an agent for the open-source Mythic framework. Our solutions detect this threat as Backdoor.Win64.MLoki to differentiate it from other malware families with the same name, such as Loki Bot, Loki Locker, and others.