corpus.blog
41554 blogs · [ { "id": "01a07df5-14d1-7102-bcf6-f5c0ae021cc6", "title": "Angry Birds: Toy Ghouls’ new toys", "url": "https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/", "published_at": "2026-09-04T10:00:05+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0aefeed71", "title": "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set", "url": "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/", "published_at": "2026-09-01T07:00:26+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0afe3de34", "title": "ValleyRAT masquerading as adware", "url": "https://securelist.com/valleyrat-backdoor-adware/121175/", "published_at": "2026-08-31T10:00:21+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0afebb21d", "title": "Threat landscape for industrial automation systems. Q2 2026", "url": "https://securelist.com/industrial-threat-report-q2-2026/121159/", "published_at": "2026-08-27T10:05:43+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0b0e79ef7", "title": "Exploits and vulnerabilities in Q2 2026", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/", "published_at": "2026-08-26T10:00:04+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0b1b95747", "title": "The invisible passenger in your car", "url": "https://securelist.com/android-head-unit-malware/121106/", "published_at": "2026-08-21T08:00:29+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0b1e472bb", "title": "APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit", "url": "https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/", "published_at": "2026-08-14T09:00:14+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0b225b36a", "title": "Armored Likho expands its cyber-espionage toolkit", "url": "https://securelist.com/armored-likho-still-toolkit/121033/", "published_at": "2026-08-13T08:00:15+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0b231dcc0", "title": "Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants", "url": "https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/", "published_at": "2026-08-11T12:00:55+00:00" }, { "id": "01a07df5-14d1-7102-bcf6-f5c0b2eaff0e", "title": "Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection", "url": "https://securelist.com/project-cav3rn-continues/120991/", "published_at": "2026-08-11T10:00:19+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0de5ac630", "title": "IT threat evolution in Q2 2026. Non-mobile statistics", "url": "https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/", "published_at": "2026-08-10T10:00:37+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0de78105e", "title": "IT threat evolution in Q2 2026. Mobile statistics", "url": "https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/", "published_at": "2026-08-10T10:00:09+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0de8b3c57", "title": "How legitimate cloud platforms enable phishers to bypass MFA", "url": "https://securelist.com/cloud-platforms-in-phishing/120832/", "published_at": "2026-08-04T12:00:12+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0deb1b041", "title": "An analysis of incidents at Brazilian educational institutions", "url": "https://securelist.com/incidents-at-brazilian-educational-institutions/120803/", "published_at": "2026-08-03T13:00:17+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0df6f0bc3", "title": "Network Anomaly Detection in KATA", "url": "https://securelist.com/tr/network-anomaly-detection-in-kata/120892/", "published_at": "2026-07-31T10:00:25+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0e0210155", "title": "OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia", "url": "https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/", "published_at": "2026-07-30T11:00:12+00:00" }, { "id": "01a0ca86-eadc-73a1-a80d-49e0e0818712", "title": "Toy Ghouls’ new toy: the GenieLocker ransomware", "url": "https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/", "published_at": "2026-07-30T08:00:57+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd3450448086", "title": "Mirage Kitten targets Middle East and Africa region with new malware", "url": "https://securelist.com/mirage-kitten-new-tools/120811/", "published_at": "2026-07-28T08:00:20+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd34511e786d", "title": "A new extortion cocktail: office printers, small ransoms, and BitLocker", "url": "https://securelist.com/new-extortion-scheme-printers-bitlocker/120718/", "published_at": "2026-07-21T13:00:29+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd3452141335", "title": "New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery", "url": "https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/", "published_at": "2026-07-21T08:40:47+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd3452d5694b", "title": "HelloNet campaign: new malicious modules launched through the ViPNet update system", "url": "https://securelist.com/tr/hellonet-vipnet/120700/", "published_at": "2026-07-16T13:05:56+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd3453b1fccc", "title": "GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration", "url": "https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/", "published_at": "2026-07-16T12:00:27+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd34543acb8f", "title": "OkoBot: new sophisticated malware framework targets cryptocurrency users", "url": "https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/", "published_at": "2026-07-15T10:00:26+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd3454dcd7ac", "title": "Threat landscape for industrial automation systems. Q1 2026", "url": "https://securelist.com/industrial-threat-report-q1-2026/120643/", "published_at": "2026-07-07T10:00:11+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd3455708e92", "title": "When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website", "url": "https://securelist.com/microsoft-device-code-phishing-attack/120350/", "published_at": "2026-07-06T09:00:43+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd34558f9d6b", "title": "Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign", "url": "https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/", "published_at": "2026-07-03T10:00:33+00:00" }, { "id": "01a0ca87-3ac8-7118-9051-fd34566f216c", "title": "Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects", "url": "https://securelist.com/compromise-assessment-findings-2025/120542/", "published_at": "2026-07-02T09:00:09+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45b06ae42", "title": "The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign", "url": "https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/", "published_at": "2026-07-01T10:00:51+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45b6361f6", "title": "OpenClaw: risks for the users and how to mitigate them", "url": "https://securelist.com/openclaw-security/120484/", "published_at": "2026-07-01T06:42:48+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45bdee1a3", "title": "ToddyCat: your hidden email assistant. Part 2", "url": "https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/", "published_at": "2026-06-30T10:00:13+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45cb5b074", "title": "The Gentlemen are knocking: сustom backdoors and evolving tactics", "url": "https://securelist.com/the-gentlemen-raas/120447/", "published_at": "2026-06-29T10:00:35+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45d6db0d1", "title": "Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk", "url": "https://securelist.com/tr/schneider-electric-cve-2024-2658-vulnerability/120436/", "published_at": "2026-06-26T13:00:14+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45dcb49c8", "title": "Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools", "url": "https://securelist.com/smb-threat-report-2026/120357/", "published_at": "2026-06-25T10:00:59+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45dccc97b", "title": "StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader", "url": "https://securelist.com/strikeshark-campaign/120326/", "published_at": "2026-06-24T10:00:03+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45e617d9b", "title": "A VBScript campaign distributed through WhatsApp deploying RMM software", "url": "https://securelist.com/whatsapp-vbs-rmm-campaign/120290/", "published_at": "2026-06-22T10:00:38+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45e806f95", "title": "Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk", "url": "https://securelist.com/dozens-of-malicious-wallpapers-found-on-steam-workshop/120186/", "published_at": "2026-06-16T09:00:11+00:00" }, { "id": "01a0ca87-780d-72a4-a401-77c45eb07a6b", "title": "From cause to cash: a cross-border look at hacktivist activity", "url": "https://securelist.com/tr/hacktivists-broaden-attack-geography/120115/", "published_at": "2026-06-08T08:00:36+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e212f05594", "title": "MiniPlasma: detecting exploitation of a critical unpatched Windows vulnerability", "url": "https://securelist.com/tr/mini-plasma-vulner/120099/", "published_at": "2026-06-03T21:38:38+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e2134ff71d", "title": "Argamal: Malware hidden in hentai games", "url": "https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/", "published_at": "2026-06-03T09:00:22+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e213c0dc92", "title": "Wardriving assessment across Mexico: Preparing for the 2026 World Cup", "url": "https://securelist.com/wardriving-assessment-in-mexico-fifa-world-cup-2026/119996/", "published_at": "2026-06-02T12:00:33+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e21431e007", "title": "Containers on fire: from container escapes to supply chain attacks", "url": "https://securelist.com/container-attack-vectors/120010/", "published_at": "2026-06-01T10:00:06+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e21465d34b", "title": "What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant", "url": "https://securelist.com/container-security-typical-issues/119974/", "published_at": "2026-05-29T07:00:51+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e21514bea4", "title": "Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years", "url": "https://securelist.com/video-books-pirates-miners-rat/119943/", "published_at": "2026-05-28T06:55:11+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e215de9b3d", "title": "Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload", "url": "https://securelist.com/cloud-atlas-2026/119895/", "published_at": "2026-05-22T09:12:13+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e216ab0770", "title": "How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)", "url": "https://securelist.com/exiftool-compromise-mac/119866/", "published_at": "2026-05-20T09:02:31+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e216eacc22", "title": "IT threat evolution in Q1 2026. Mobile statistics", "url": "https://securelist.com/malware-report-q1-2026-mobile-statistics/119819/", "published_at": "2026-05-18T12:00:30+00:00" }, { "id": "01a0ca87-b660-72fe-9060-49e2173d67eb", "title": "IT threat evolution in Q1 2026. Non-mobile statistics", "url": "https://securelist.com/malware-report-q1-2026-pc-iot-statistics/119828/", "published_at": "2026-05-18T12:00:22+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e702ea9dcc0", "title": "Kimsuky targets organizations with PebbleDash-based tools", "url": "https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/", "published_at": "2026-05-14T11:00:58+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e702f1aa2e1", "title": "State of ransomware in 2026", "url": "https://securelist.com/state-of-ransomware-in-2026/119761/", "published_at": "2026-05-12T07:00:04+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e702faa068c", "title": "CVE-2025-68670: discovering an RCE vulnerability in xrdp", "url": "https://securelist.com/cve-2025-68670/119742/", "published_at": "2026-05-08T08:00:54+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e702fe77373", "title": "Exploits and vulnerabilities in Q1 2026", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q1-2026/119733/", "published_at": "2026-05-07T10:00:43+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e70304e7879", "title": "OceanLotus suspected of using PyPI to deliver ZiChatBot malware", "url": "https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/", "published_at": "2026-05-06T13:00:34+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e703147ee3d", "title": "Websites with an undefined trust level: avoiding the trap", "url": "https://securelist.com/suspicious-websites-undefined-trust-level/119675/", "published_at": "2026-05-06T09:30:46+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e70316f5c4a", "title": "DAEMON Tools software infected — supply chain attack ongoing since April 8, 2026", "url": "https://securelist.com/tr/daemon-tools-backdoor/119654/", "published_at": "2026-05-05T09:01:51+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e70322a3608", "title": "“Legitimate” phishing: how attackers weaponize Amazon SES to bypass email security", "url": "https://securelist.com/amazon-ses-phishing-and-bec-attacks/119623/", "published_at": "2026-05-04T10:00:23+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e7032b8d1f5", "title": "Information about the Copy Fail vulnerability, which allows attackers to gain root access on virtually any modern Linux distribution", "url": "https://securelist.com/tr/copyfail-root-linux/119634/", "published_at": "2026-04-30T19:22:28+00:00" }, { "id": "01a0ca87-fb83-7073-842e-6e7032e4e50e", "title": "Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India", "url": "https://securelist.com/tr/silver-fox-tax-notification-campaign/120038/", "published_at": "2026-04-30T07:00:04+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c6f227cb5", "title": "PhantomRPC: A new privilege escalation technique in Windows RPC", "url": "https://securelist.com/phantomrpc-rpc-vulnerability/119428/", "published_at": "2026-04-24T08:00:12+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c6f56cd09", "title": "Lotus Wiper: a new threat targeting the energy and utilities sector", "url": "https://securelist.com/tr/lotus-wiper/119472/", "published_at": "2026-04-21T10:00:18+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c6fbc77cd", "title": "FakeWallet crypto stealer spreading through iOS apps in the App Store", "url": "https://securelist.com/fakewallet-cryptostealer-ios-app-store/119474/", "published_at": "2026-04-20T09:22:47+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c700f9e95", "title": "Adapt or pay: an analysis of the AdaptixC2 framework", "url": "https://securelist.com/tr/adaptixc2-network-and-host-detection/119424/", "published_at": "2026-04-17T10:00:09+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c709e2333", "title": "Threat landscape for industrial automation systems in Q4 2025", "url": "https://securelist.com/industrial-threat-report-q4-2025/119392/", "published_at": "2026-04-15T12:30:48+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c717d4d67", "title": "JanelaRAT: a financial threat targeting users in Latin America", "url": "https://securelist.com/janelarat-financial-threat-in-latin-america/119332/", "published_at": "2026-04-13T09:00:23+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c726e27db", "title": "CPU-Z / HWMonitor watering hole infection – a copy-pasted attack", "url": "https://securelist.com/tr/cpu-z/119365/", "published_at": "2026-04-10T16:26:38+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c72f02a90", "title": "The long road to your crypto: ClipBanker and its marathon infection chain", "url": "https://securelist.com/clipbanker-malware-distributed-via-trojanized-proxifier/119341/", "published_at": "2026-04-09T09:30:17+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c73e0fc51", "title": "Financial cyberthreats in 2025 and the outlook for 2026", "url": "https://securelist.com/financial-threat-report-2025/119304/", "published_at": "2026-04-08T09:00:37+00:00" }, { "id": "01a0ca88-4c9d-737f-872f-916c747bd159", "title": "A laughing RAT: CrystalX combines spyware, stealer, and prankware features", "url": "https://securelist.com/crystalx-rat-with-prankware-features/119283/", "published_at": "2026-04-01T06:00:09+00:00" }, { "id": "01a0ca88-8605-700d-965d-b760036c4a57", "title": "An AI gateway designed to steal your data", "url": "https://securelist.com/litellm-supply-chain-attack/119257/", "published_at": "2026-03-26T11:01:38+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76003dad0a2", "title": "Coruna: the framework used in Operation Triangulation", "url": "https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/", "published_at": "2026-03-26T08:00:19+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76004c2d158", "title": "Anatomy of a Cyber World Global Report 2026", "url": "https://securelist.com/global-report-security-services-2026/119233/", "published_at": "2026-03-25T11:00:56+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76005342222", "title": "The SOC Files: Time to “Sapecar”. Unpacking a new Horabot campaign in Mexico", "url": "https://securelist.com/horabot-campaign/119033/", "published_at": "2026-03-18T11:00:14+00:00" }, { "id": "01a0ca88-8605-700d-965d-b760061fd982", "title": "Free real estate: GoPix, the banking Trojan living off your memory", "url": "https://securelist.com/gopix-banking-trojan/119173/", "published_at": "2026-03-16T11:00:25+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76006cd0098", "title": "BeatBanker: A dual‑mode Android Trojan", "url": "https://securelist.com/beatbanker-miner-and-banker/119121/", "published_at": "2026-03-10T10:00:44+00:00" }, { "id": "01a0ca88-8605-700d-965d-b760075417ce", "title": "Exploits and vulnerabilities in Q4 2025", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q4-2025/119105/", "published_at": "2026-03-06T10:00:22+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76007d5e399", "title": "Mobile malware evolution in 2025", "url": "https://securelist.com/mobile-threat-report-2025/119076/", "published_at": "2026-03-04T10:00:46+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76007f511b6", "title": "Arkanix Stealer: a C++ & Python infostealer", "url": "https://securelist.com/arkanix-stealer/119006/", "published_at": "2026-02-19T11:00:49+00:00" }, { "id": "01a0ca88-8605-700d-965d-b76008780c49", "title": "Divide and conquer: how the new Keenadu backdoor exposed links between major Android botnets", "url": "https://securelist.com/keenadu-android-backdoor/118913/", "published_at": "2026-02-17T09:00:35+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d3501bc69", "title": "The game is over: when “free” comes at too high a price. What we know about RenEngine", "url": "https://securelist.com/renengine-campaign-with-hijackloader-lumma-and-acr-stealer/118891/", "published_at": "2026-02-11T14:00:38+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d3581df8c", "title": "Spam and phishing in 2025", "url": "https://securelist.com/spam-and-phishing-report-2025/118785/", "published_at": "2026-02-11T10:00:59+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d35e76e00", "title": "Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAT", "url": "https://securelist.com/stan-ghouls-in-uzbekistan/118738/", "published_at": "2026-02-05T09:00:11+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d3681ec74", "title": "The Notepad++ supply chain attack — unnoticed execution chains and new IoCs", "url": "https://securelist.com/tr/notepad-supply-chain-attack/120106/", "published_at": "2026-02-03T08:10:59+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d377179df", "title": "Supply chain attack on eScan antivirus: detecting and remediating malicious updates", "url": "https://securelist.com/tr/escan-supply-chain-attack/120040/", "published_at": "2026-01-29T15:07:56+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d38491639", "title": "HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns", "url": "https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/", "published_at": "2026-01-27T08:00:42+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d39388f36", "title": "The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor", "url": "https://securelist.com/honeymyte-kernel-mode-rootkit/118590/", "published_at": "2025-12-29T10:00:35+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d394b316f", "title": "Threat landscape for industrial automation systems in Q3 2025", "url": "https://securelist.com/industrial-threat-report-q3-2025/118602/", "published_at": "2025-12-25T10:00:55+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d39b4ec69", "title": "Evasive Panda APT poisons DNS requests to deliver MgBot", "url": "https://securelist.com/evasive-panda-apt/118576/", "published_at": "2025-12-24T07:00:01+00:00" }, { "id": "01a0ca88-c174-706f-a38e-f52d3a24e35e", "title": "Assessing SIEM effectiveness", "url": "https://securelist.com/siem-effectiveness-assessment/118560/", "published_at": "2025-12-23T12:00:01+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743ef867730", "title": "From cheats to exploits: Webrat spreading via GitHub", "url": "https://securelist.com/webrat-distributed-via-github/118555/", "published_at": "2025-12-23T08:00:32+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f039f593", "title": "Cloud Atlas activity in the first half of 2025: what changed", "url": "https://securelist.com/cloud-atlas-h1-2025-campaign/118517/", "published_at": "2025-12-19T10:00:22+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f10e1333", "title": "Yet another DCOM object for lateral movement", "url": "https://securelist.com/lateral-movement-via-dcom-abusing-control-panel/118232/", "published_at": "2025-12-19T08:00:14+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f18d90aa", "title": "Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports", "url": "https://securelist.com/operation-forumtroll-new-targeted-campaign/118492/", "published_at": "2025-12-17T10:00:51+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f1e14ac9", "title": "God Mode On: how we attacked a vehicle’s head unit modem", "url": "https://securelist.com/attacking-car-modem/118463/", "published_at": "2025-12-16T10:00:13+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f237126d", "title": "Frogblight threatens you with a court case: a new Android banker targets Turkish users", "url": "https://securelist.com/frogblight-banker/118440/", "published_at": "2025-12-15T07:00:57+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f2b0bc20", "title": "Following the digital trail: what happens to data stolen in a phishing attack", "url": "https://securelist.com/what-happens-to-stolen-data-after-phishing-attacks/118180/", "published_at": "2025-12-12T10:00:39+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f2cd0ec9", "title": "Turn me on, turn me off: Zigbee assessment in industrial environments", "url": "https://securelist.com/zigbee-protocol-security-assessment/118373/", "published_at": "2025-12-12T08:00:17+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f387f760", "title": "Hunting for Mythic in network traffic", "url": "https://securelist.com/tr/detecting-mythic-in-network-traffic/120035/", "published_at": "2025-12-11T12:00:52+00:00" }, { "id": "01a0ca88-fe0f-726a-96a9-7743f425ab76", "title": "It didn’t take long: CVE-2025-55182 is now under active exploitation", "url": "https://securelist.com/cve-2025-55182-exploitation/118331/", "published_at": "2025-12-11T07:30:41+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa70cd41bb0", "title": "Goodbye, dark Telegram: Blocks are pushing the underground out", "url": "https://securelist.com/goodbye-dark-telegram/118286/", "published_at": "2025-12-09T11:25:55+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa70db6f8cd", "title": "Shai Hulud 2.0, now with a wiper flavor", "url": "https://securelist.com/shai-hulud-2-0/118214/", "published_at": "2025-12-03T20:10:47+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa70dcd709d", "title": "Exploits and vulnerabilities in Q3 2025", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q3-2025/118197/", "published_at": "2025-12-03T10:00:59+00:00" } ] posts Claim your blog
Back to Kaspersky Securelist
Blog · corpus.blog/blogs/securelist.com/posts

Kaspersky Securelist

securelist.com

2026

Angry Birds: Toy Ghouls’ new toysoriginal ↗
4 Sept 2026
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware setoriginal ↗
1 Sept 2026
ValleyRAT masquerading as adwareoriginal ↗
31 Aug 2026
Threat landscape for industrial automation systems. Q2 2026original ↗
27 Aug 2026
Exploits and vulnerabilities in Q2 2026original ↗
26 Aug 2026
The invisible passenger in your caroriginal ↗
21 Aug 2026
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkitoriginal ↗
14 Aug 2026
Armored Likho expands its cyber-espionage toolkitoriginal ↗
13 Aug 2026
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participantsoriginal ↗
11 Aug 2026
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selectionoriginal ↗
11 Aug 2026
IT threat evolution in Q2 2026. Non-mobile statisticsoriginal ↗
10 Aug 2026
IT threat evolution in Q2 2026. Mobile statisticsoriginal ↗
10 Aug 2026
How legitimate cloud platforms enable phishers to bypass MFAoriginal ↗
4 Aug 2026
An analysis of incidents at Brazilian educational institutionsoriginal ↗
3 Aug 2026
Network Anomaly Detection in KATAoriginal ↗
31 Jul 2026
OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asiaoriginal ↗
30 Jul 2026
Toy Ghouls’ new toy: the GenieLocker ransomwareoriginal ↗
30 Jul 2026
Mirage Kitten targets Middle East and Africa region with new malwareoriginal ↗
28 Jul 2026
A new extortion cocktail: office printers, small ransoms, and BitLockeroriginal ↗
21 Jul 2026
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recoveryoriginal ↗
21 Jul 2026
HelloNet campaign: new malicious modules launched through the ViPNet update systemoriginal ↗
16 Jul 2026
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltrationoriginal ↗
16 Jul 2026
OkoBot: new sophisticated malware framework targets cryptocurrency usersoriginal ↗
15 Jul 2026
Threat landscape for industrial automation systems. Q1 2026original ↗
7 Jul 2026
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft websiteoriginal ↗
6 Jul 2026
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaignoriginal ↗
3 Jul 2026
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projectsoriginal ↗
2 Jul 2026
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaignoriginal ↗
1 Jul 2026
OpenClaw: risks for the users and how to mitigate themoriginal ↗
1 Jul 2026
ToddyCat: your hidden email assistant. Part 2original ↗
30 Jun 2026
The Gentlemen are knocking: сustom backdoors and evolving tacticsoriginal ↗
29 Jun 2026
Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at riskoriginal ↗
26 Jun 2026
Inside the 2026 SMB threat landscape: From phishing and scams to fake AI toolsoriginal ↗
25 Jun 2026
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoaderoriginal ↗
24 Jun 2026
A VBScript campaign distributed through WhatsApp deploying RMM softwareoriginal ↗
22 Jun 2026
Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at riskoriginal ↗
16 Jun 2026
From cause to cash: a cross-border look at hacktivist activityoriginal ↗
8 Jun 2026
MiniPlasma: detecting exploitation of a critical unpatched Windows vulnerabilityoriginal ↗
3 Jun 2026
Argamal: Malware hidden in hentai gamesoriginal ↗
3 Jun 2026
Wardriving assessment across Mexico: Preparing for the 2026 World Cuporiginal ↗
2 Jun 2026
Containers on fire: from container escapes to supply chain attacksoriginal ↗
1 Jun 2026
What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistantoriginal ↗
29 May 2026
Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for yearsoriginal ↗
28 May 2026
Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payloadoriginal ↗
22 May 2026
How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)original ↗
20 May 2026
IT threat evolution in Q1 2026. Mobile statisticsoriginal ↗
18 May 2026
IT threat evolution in Q1 2026. Non-mobile statisticsoriginal ↗
18 May 2026
Kimsuky targets organizations with PebbleDash-based toolsoriginal ↗
14 May 2026
State of ransomware in 2026original ↗
12 May 2026
CVE-2025-68670: discovering an RCE vulnerability in xrdporiginal ↗
8 May 2026
Exploits and vulnerabilities in Q1 2026original ↗
7 May 2026
OceanLotus suspected of using PyPI to deliver ZiChatBot malwareoriginal ↗
6 May 2026
Websites with an undefined trust level: avoiding the traporiginal ↗
6 May 2026
DAEMON Tools software infected — supply chain attack ongoing since April 8, 2026original ↗
5 May 2026
“Legitimate” phishing: how attackers weaponize Amazon SES to bypass email securityoriginal ↗
4 May 2026
Information about the Copy Fail vulnerability, which allows attackers to gain root access on virtually any modern Linux distributionoriginal ↗
30 Apr 2026
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and Indiaoriginal ↗
30 Apr 2026
PhantomRPC: A new privilege escalation technique in Windows RPCoriginal ↗
24 Apr 2026
Lotus Wiper: a new threat targeting the energy and utilities sectororiginal ↗
21 Apr 2026
FakeWallet crypto stealer spreading through iOS apps in the App Storeoriginal ↗
20 Apr 2026
Adapt or pay: an analysis of the AdaptixC2 frameworkoriginal ↗
17 Apr 2026
Threat landscape for industrial automation systems in Q4 2025original ↗
15 Apr 2026
JanelaRAT: a financial threat targeting users in Latin Americaoriginal ↗
13 Apr 2026
CPU-Z / HWMonitor watering hole infection – a copy-pasted attackoriginal ↗
10 Apr 2026
The long road to your crypto: ClipBanker and its marathon infection chainoriginal ↗
9 Apr 2026
Financial cyberthreats in 2025 and the outlook for 2026original ↗
8 Apr 2026
A laughing RAT: CrystalX combines spyware, stealer, and prankware featuresoriginal ↗
1 Apr 2026
An AI gateway designed to steal your dataoriginal ↗
26 Mar 2026
Coruna: the framework used in Operation Triangulationoriginal ↗
26 Mar 2026
Anatomy of a Cyber World Global Report 2026original ↗
25 Mar 2026
The SOC Files: Time to “Sapecar”. Unpacking a new Horabot campaign in Mexicooriginal ↗
18 Mar 2026
Free real estate: GoPix, the banking Trojan living off your memoryoriginal ↗
16 Mar 2026
BeatBanker: A dual‑mode Android Trojanoriginal ↗
10 Mar 2026
Exploits and vulnerabilities in Q4 2025original ↗
6 Mar 2026
Mobile malware evolution in 2025original ↗
4 Mar 2026
Arkanix Stealer: a C++ & Python infostealeroriginal ↗
19 Feb 2026
Divide and conquer: how the new Keenadu backdoor exposed links between major Android botnetsoriginal ↗
17 Feb 2026
The game is over: when “free” comes at too high a price. What we know about RenEngineoriginal ↗
11 Feb 2026
Spam and phishing in 2025original ↗
11 Feb 2026
Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAToriginal ↗
5 Feb 2026
The Notepad++ supply chain attack — unnoticed execution chains and new IoCsoriginal ↗
3 Feb 2026
Supply chain attack on eScan antivirus: detecting and remediating malicious updatesoriginal ↗
29 Jan 2026
HoneyMyte updates CoolClient and deploys multiple stealers in recent campaignsoriginal ↗
27 Jan 2026

2025

The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoororiginal ↗
29 Dec 2025
Threat landscape for industrial automation systems in Q3 2025original ↗
25 Dec 2025
Evasive Panda APT poisons DNS requests to deliver MgBotoriginal ↗
24 Dec 2025
Assessing SIEM effectivenessoriginal ↗
23 Dec 2025
From cheats to exploits: Webrat spreading via GitHuboriginal ↗
23 Dec 2025
Cloud Atlas activity in the first half of 2025: what changedoriginal ↗
19 Dec 2025
Yet another DCOM object for lateral movementoriginal ↗
19 Dec 2025
Operation ForumTroll continues: Russian political scientists targeted using plagiarism reportsoriginal ↗
17 Dec 2025
God Mode On: how we attacked a vehicle’s head unit modemoriginal ↗
16 Dec 2025
Frogblight threatens you with a court case: a new Android banker targets Turkish usersoriginal ↗
15 Dec 2025
Following the digital trail: what happens to data stolen in a phishing attackoriginal ↗
12 Dec 2025
Turn me on, turn me off: Zigbee assessment in industrial environmentsoriginal ↗
12 Dec 2025
Hunting for Mythic in network trafficoriginal ↗
11 Dec 2025
It didn’t take long: CVE-2025-55182 is now under active exploitationoriginal ↗
11 Dec 2025
Goodbye, dark Telegram: Blocks are pushing the underground outoriginal ↗
9 Dec 2025
Shai Hulud 2.0, now with a wiper flavororiginal ↗
3 Dec 2025
Exploits and vulnerabilities in Q3 2025original ↗
3 Dec 2025
Next