Kaspersky ICS CERT

Oct 15, 2024 | securelist.com | Alexander Kryazhev |Denis Sitchikhin |Mohamad Amin Hasbini |Kaspersky ICS CERT

SideWinder, aka T-APT-04 or RattleSnake, is one of the most prolific APT groups that began its activities in 2012 and was first publicly mentioned by us in 2018. Over the years, the group has launched attacks against high-profile entities in South and Southeast Asia. Its primary targets have been military and government entities in Pakistan, Sri Lanka, China and Nepal.

Oct 7, 2024 | securelist.com | Kaspersky ICS CERT |Anna Larkina |Flavio Negrini |Anna Pavlovskaya

IntroductionIn July 2021, a campaign was launched primarily targeting Russian government agencies and industrial enterprises. Shortly after the campaign started, we began tracking it, and published three reports in August and September 2024 through our threat research subscription on the threat actor we named Awaken Likho (also named by other vendors as Core Werewolf).

Sep 26, 2024 | securelist.com | Kaspersky ICS CERT |Artem Ushkov |Anna Pavlovskaya

Statistics across all threatsIn the second quarter of 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 0.9 pp from the previous quarter to 23.5%. The percentage has decreased by 3.3 pp compared to the second quarter of 2023, when the indicator reached its highest level since records began in 2022. Regions rankingIn most regions, the percentage of ICS computers that blocked malicious objects decreased compared to the first quarter of 2024.

Jul 8, 2024 | securelist.com | Sergey Lozhkin |Alexey Antonov |Kaspersky ICS CERT |Georgy Kiguradze

In May 2024, we discovered a new advanced persistent threat (APT) targeting Russian government entities that we dubbed CloudSorcerer. It’s a sophisticated cyberespionage tool used for stealth monitoring, data collection, and exfiltration via Microsoft Graph, Yandex Cloud, and Dropbox cloud infrastructure. The malware leverages cloud resources as its command and control (C2) servers, accessing them through APIs using authentication tokens.

Jun 25, 2024 | securelist.com | Kaspersky ICS CERT |Georgy Kiguradze |Olga Svistunova |Anton Kivva

Small and medium-sized businesses (SMBs) are increasingly targeted by cybercriminals. Despite adopting digital technology for remote work, production, and sales, SMBs often lack robust cybersecurity measures. SMBs face significant cybersecurity challenges . The cost of data breaches can cripple operations, making preventive measures essential. This is a growing tendency that continues to pose a challenge for businesses.