41554 blogs · [ { "id": "01a0ca89-2e94-72c2-96bb-0fa70ddc1fb2", "title": "Kaspersky Security Bulletin 2025. Statistics", "url": "https://securelist.com/kaspersky-security-bulletin-2025-statistics/118189/", "published_at": "2025-12-02T10:07:03+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa70e8bee7f", "title": "Tomiris wreaks Havoc: New tools and techniques of the APT group", "url": "https://securelist.com/tomiris-new-tools/118143/", "published_at": "2025-11-28T07:00:06+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa70ef57be4", "title": "Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025", "url": "https://securelist.com/ntlm-abuse-in-2025/118132/", "published_at": "2025-11-26T10:00:02+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa70fcaa79a", "title": "To buy or not to buy: How cybercriminals capitalize on Black Friday", "url": "https://securelist.com/black-friday-threat-report-2025/118083/", "published_at": "2025-11-24T12:30:49+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa71007a474", "title": "ToddyCat: your hidden email assistant. Part 1", "url": "https://securelist.com/toddycat-apt-steals-email-data-from-outlook/118044/", "published_at": "2025-11-21T10:00:33+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa7100f08a5", "title": "Inside the dark web job market", "url": "https://securelist.com/dark-web-job-market-2023-2025/118057/", "published_at": "2025-11-20T11:37:00+00:00" }, { "id": "01a0ca89-2e94-72c2-96bb-0fa7110937f1", "title": "Blockchain and Node.js abused by Tsundere: an emerging botnet", "url": "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/", "published_at": "2025-11-20T10:00:13+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb8cba43da", "title": "IT threat evolution in Q3 2025. Mobile statistics", "url": "https://securelist.com/malware-report-q3-2025-mobile-statistics/118013/", "published_at": "2025-11-19T10:00:34+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb8dad13e2", "title": "IT threat evolution in Q3 2025. Non-mobile statistics", "url": "https://securelist.com/malware-report-q3-2025-pc-iot-statistics/118020/", "published_at": "2025-11-19T10:00:02+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb8e1a93cc", "title": "Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs", "url": "https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/", "published_at": "2025-10-28T03:00:11+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb8e4ddba3", "title": "Mem3nt0 mori – The Hacking Team is back!", "url": "https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/", "published_at": "2025-10-27T03:00:20+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb8f0abc16", "title": "Deep analysis of the flaw in BetterBank reward logic", "url": "https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/", "published_at": "2025-10-22T10:00:14+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb9004ef69", "title": "The evolving landscape of email phishing attacks: how threat actors are reusing and refining established techniques", "url": "https://securelist.com/email-phishing-techniques-2025/117801/", "published_at": "2025-10-21T10:00:06+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb90814be0", "title": "PassiveNeuron: a sophisticated campaign targeting servers of high-profile organizations", "url": "https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/", "published_at": "2025-10-21T08:00:52+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb90ba408c", "title": "Post-exploitation framework now also delivered via npm", "url": "https://securelist.com/adaptixc2-agent-found-in-an-npm-package/117784/", "published_at": "2025-10-17T10:00:33+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb91819cea", "title": "SEO spam and hidden links: how to protect your website and your reputation", "url": "https://securelist.com/seo-spam-hidden-links/117782/", "published_at": "2025-10-17T07:00:55+00:00" }, { "id": "01a0ca89-67d9-7284-a964-76fb92366140", "title": "Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution", "url": "https://securelist.com/maverick-banker-distributing-via-whatsapp/117715/", "published_at": "2025-10-15T13:00:43+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d97c31b8d", "title": "Mysterious Elephant: a growing threat", "url": "https://securelist.com/mysterious-elephant-apt-ttps-and-tools/117596/", "published_at": "2025-10-15T10:00:11+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d97dedeb2", "title": "Signal in the noise: what hashtags reveal about hacktivism in 2025", "url": "https://securelist.com/dfi-meta-hacktivist-report/117708/", "published_at": "2025-10-14T10:00:09+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d97ec294a", "title": "The king is dead, long live the king! Windows 10 EOL and Windows 11 forensic artifacts", "url": "https://securelist.com/forensic-artifacts-in-windows-11/117680/", "published_at": "2025-10-14T08:00:57+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d98149bc6", "title": "How we trained an ML model to detect DLL hijacking", "url": "https://securelist.com/building-ml-model-to-detect-dll-hijacking/117565/", "published_at": "2025-10-06T08:00:21+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d98a44f0a", "title": "Detecting DLL hijacking with machine learning: real-world cases", "url": "https://securelist.com/detecting-dll-hijacking-with-machine-learning-in-kaspersky-siem/117567/", "published_at": "2025-10-06T08:00:08+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d98b8a93f", "title": "Forensic journey: hunting evil within AmCache", "url": "https://securelist.com/amcache-forensic-artifact/117622/", "published_at": "2025-10-01T10:00:20+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d996e21be", "title": "Massive npm infection: the Shai-Hulud worm and patient zero", "url": "https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/", "published_at": "2025-09-25T10:00:12+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d9a68b3a6", "title": "Threat landscape for industrial automation systems in Q2 2025", "url": "https://securelist.com/industrial-threat-report-q2-2025/117532/", "published_at": "2025-09-19T10:00:56+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d9ac2a978", "title": "RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT", "url": "https://securelist.com/revengehotels-attacks-with-ai-and-venomrat-across-latin-america/117493/", "published_at": "2025-09-16T10:00:41+00:00" }, { "id": "01a0ca89-a042-7049-984e-246d9b59578a", "title": "Shiny tools, shallow checks: how the AI hype opens the door to malicious MCP servers", "url": "https://securelist.com/model-context-protocol-for-ai-integration-abused-in-supply-chain-attacks/117473/", "published_at": "2025-09-15T10:00:51+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4f7ff4430", "title": "Notes of cyber inspector: three clusters of threat in cyberspace", "url": "https://securelist.com/three-hacktivist-apt-clusters-tools-and-ttps/117324/", "published_at": "2025-09-10T14:00:59+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4f8c76842", "title": "IT threat evolution in Q2 2025. Mobile statistics", "url": "https://securelist.com/malware-report-q2-2025-mobile-statistics/117349/", "published_at": "2025-09-05T09:00:26+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4f908d905", "title": "IT threat evolution in Q2 2025. Non-mobile statistics", "url": "https://securelist.com/malware-report-q2-2025-pc-iot-statistics/117421/", "published_at": "2025-09-05T09:00:23+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4f95d5547", "title": "Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it", "url": "https://securelist.com/cookies-and-session-hijacking/117390/", "published_at": "2025-09-02T10:00:35+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4f9ca616e", "title": "How attackers adapt to built-in macOS protection", "url": "https://securelist.com/macos-security-and-typical-attacks/117367/", "published_at": "2025-08-29T10:00:35+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4fa1727b7", "title": "Exploits and vulnerabilities in Q2 2025", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q2-2025/117333/", "published_at": "2025-08-27T10:00:32+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4fa76552e", "title": "Modern vehicle cybersecurity trends", "url": "https://securelist.com/automotive-security-trends-2025/117326/", "published_at": "2025-08-22T09:00:26+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4fa8f7308", "title": "GodRAT – New RAT targeting financial institutions", "url": "https://securelist.com/godrat/117119/", "published_at": "2025-08-19T10:00:05+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4fb7869ba", "title": "Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824", "url": "https://securelist.com/pipemagic/117270/", "published_at": "2025-08-18T09:00:10+00:00" }, { "id": "01a0ca89-cfe8-7203-8870-ccd4fbe5054c", "title": "New trends in phishing and scams: how AI and social media are changing the game", "url": "https://securelist.com/new-phishing-and-scam-trends-in-2025/117217/", "published_at": "2025-08-13T08:00:06+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b16c7ff8", "title": "Scammers mass-mailing the Efimer Trojan to steal crypto", "url": "https://securelist.com/efimer-trojan/117148/", "published_at": "2025-08-08T09:00:01+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b2244b56", "title": "Driver of destruction: How a legitimate driver is being used to take down AV processes", "url": "https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/", "published_at": "2025-08-06T10:00:45+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b31532eb", "title": "Cobalt Strike Beacon delivered via GitHub and social media", "url": "https://securelist.com/cobalt-strike-attacks-using-quora-github-social-media/117085/", "published_at": "2025-07-30T09:00:54+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b392a216", "title": "ToolShell: a story of five vulnerabilities in Microsoft SharePoint", "url": "https://securelist.com/toolshell-explained/117045/", "published_at": "2025-07-25T07:00:05+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b45f9839", "title": "The SOC files: Rumble in the jungle or APT41’s new target in Africa", "url": "https://securelist.com/apt41-in-africa/116986/", "published_at": "2025-07-21T08:00:00+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b4cf340a", "title": "GhostContainer backdoor: malware compromising Exchange servers of high-value organizations in Asia", "url": "https://securelist.com/ghostcontainer/116953/", "published_at": "2025-07-17T08:00:53+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b58052e7", "title": "Forensic journey: Breaking down the UserAssist artifact structure", "url": "https://securelist.com/userassist-artifact-forensic-value-for-incident-response/116911/", "published_at": "2025-07-14T10:00:06+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b5ca99b1", "title": "Code highlighting with Cursor AI for $500,000", "url": "https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/", "published_at": "2025-07-10T11:00:41+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b64e3d35", "title": "Approach to mainframe penetration testing on z/OS. Deep dive into RACF", "url": "https://securelist.com/zos-mainframe-pentesting-resource-access-control-facility/116873/", "published_at": "2025-07-08T10:00:16+00:00" }, { "id": "01a0ca8a-1191-72c2-893c-3a12b704efe5", "title": "Batavia spyware steals data from Russian organizations", "url": "https://securelist.com/batavia-spyware-steals-data-from-russian-organizations/116866/", "published_at": "2025-07-07T10:00:26+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a3d4032ac", "title": "AI and collaboration tools: how cyberattackers are targeting SMBs in 2025", "url": "https://securelist.com/smb-threat-report-2025/116830/", "published_at": "2025-06-25T10:00:12+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a3d9a3cc8", "title": "SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play", "url": "https://securelist.com/sparkkitty-ios-android-malware/116793/", "published_at": "2025-06-23T08:00:37+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a3db9f236", "title": "Toxic trend: Another malware threat targets DeepSeek", "url": "https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728/", "published_at": "2025-06-11T10:00:50+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a3e286f63", "title": "Sleep with one eye open: how Librarian Ghouls steal data by night", "url": "https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/", "published_at": "2025-06-09T10:00:09+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a3ef7e129", "title": "Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721", "url": "https://securelist.com/mirai-botnet-variant-targets-dvr-devices-with-cve-2024-3721/116742/", "published_at": "2025-06-06T10:00:38+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a3f55ca54", "title": "IT threat evolution in Q1 2025. Non-mobile statistics", "url": "https://securelist.com/malware-report-q1-2025-pc-iot-statistics/116686/", "published_at": "2025-06-05T10:00:25+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a400f0047", "title": "IT threat evolution in Q1 2025. Mobile statistics", "url": "https://securelist.com/malware-report-q1-2025-mobile-statistics/116676/", "published_at": "2025-06-05T10:00:04+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a404d1a46", "title": "Host-based logs, container-based threats: How to tell where an attack began", "url": "https://securelist.com/host-based-logs-container-based-threats/116643/", "published_at": "2025-06-03T10:00:14+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a40b0df59", "title": "Exploits and vulnerabilities in Q1 2025", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q1-2025/116624/", "published_at": "2025-05-30T12:00:16+00:00" }, { "id": "01a0ca8a-5333-7209-877a-828a410a5d73", "title": "Zanubis in motion: Tracing the active evolution of the Android banking malware", "url": "https://securelist.com/evolution-of-zanubis-banking-trojan-for-android/116588/", "published_at": "2025-05-28T10:00:38+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917dc5337a7", "title": "Dero miner zombies biting through Docker APIs to build a cryptojacking horde", "url": "https://securelist.com/dero-miner-infects-containers-through-docker-api/116546/", "published_at": "2025-05-21T10:00:47+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917dcce0b6b", "title": "Threat landscape for industrial automation systems in Q1 2025", "url": "https://securelist.com/industrial-threat-report-q1-2025/116505/", "published_at": "2025-05-15T13:07:40+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917dd2d542e", "title": "Using a Mythic agent to optimize penetration testing", "url": "https://securelist.com/agent-for-mythic-c2-with-beacon-object-files/115259/", "published_at": "2025-05-13T10:00:41+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917ddc8b74a", "title": "State of ransomware in 2025", "url": "https://securelist.com/state-of-ransomware-in-2025/116475/", "published_at": "2025-05-07T10:00:39+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917de1cb550", "title": "Outlaw cybergang attacking targets worldwide", "url": "https://securelist.com/outlaw-botnet/116444/", "published_at": "2025-04-29T10:00:29+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917de4dcd43", "title": "Triada strikes back", "url": "https://securelist.com/triada-trojan-modules-analysis/116380/", "published_at": "2025-04-25T10:00:14+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917dee7d9fb", "title": "Operation SyncHole: Lazarus APT goes back to the well", "url": "https://securelist.com/operation-synchole-watering-hole-attacks-by-lazarus/116326/", "published_at": "2025-04-24T05:00:04+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917dfa29465", "title": "Russian organizations targeted by backdoor masquerading as secure networking software updates", "url": "https://securelist.com/new-backdoor-mimics-security-software-update/116246/", "published_at": "2025-04-22T13:00:08+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917e09f2e42", "title": "Lumma Stealer – Tracking distribution channels", "url": "https://securelist.com/lumma-fake-captcha-attacks-analysis/116274/", "published_at": "2025-04-21T12:00:51+00:00" }, { "id": "01a0ca8a-8b13-7215-9ff6-6917e0cf9070", "title": "Phishing attacks leveraging HTML code inside SVG files", "url": "https://securelist.com/svg-phishing/116256/", "published_at": "2025-04-21T08:00:49+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec6704fbdff0", "title": "IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia", "url": "https://securelist.com/mysterysnail-new-version/116226/", "published_at": "2025-04-17T08:00:27+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec67050d0305", "title": "Streamlining detection engineering in security operation centers", "url": "https://securelist.com/streamlining-detection-engineering/116186/", "published_at": "2025-04-16T10:00:15+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec670581abdd", "title": "GOFFEE continues to attack organizations in Russia", "url": "https://securelist.com/goffee-apt-new-attacks/116139/", "published_at": "2025-04-10T10:00:12+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec670631f32d", "title": "Attackers distributing a miner and the ClipBanker Trojan via SourceForge", "url": "https://securelist.com/miner-clipbanker-sourceforge-campaign/116088/", "published_at": "2025-04-08T10:00:25+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec6706752268", "title": "How ToddyCat tried to hide behind AV software", "url": "https://securelist.com/toddycat-apt-exploits-vulnerability-in-eset-software-for-dll-proxying/116086/", "published_at": "2025-04-07T10:00:44+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec6706de4c9e", "title": "A journey into forgotten Null Session and MS-RPC interfaces, part 2", "url": "https://securelist.com/ms-rpc-security-mechanism-step-by-step/116036/", "published_at": "2025-04-04T10:00:38+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec67075f010e", "title": "TookPS: DeepSeek isn’t the only game in town", "url": "https://securelist.com/tookps/116019/", "published_at": "2025-04-02T10:00:05+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec67077c3926", "title": "Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain", "url": "https://securelist.com/operation-forumtroll/115989/", "published_at": "2025-03-25T21:30:22+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec6707972102", "title": "Financial cyberthreats in 2024", "url": "https://securelist.com/financial-threat-report-2024/115966/", "published_at": "2025-03-25T08:00:33+00:00" }, { "id": "01a0ca8a-cc63-70f6-9e27-ec6708779f7f", "title": "Threat landscape for industrial automation systems in Q4 2024", "url": "https://securelist.com/ics-cert-q4-2024-report/115944/", "published_at": "2025-03-21T10:00:29+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b6762d48", "title": "Arcane stealer: We want all your data", "url": "https://securelist.com/arcane-stealer/115919/", "published_at": "2025-03-19T10:00:42+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b6f41c7f", "title": "Head Mare and Twelve join forces to attack Russian entities", "url": "https://securelist.com/head-mare-twelve-collaboration/115887/", "published_at": "2025-03-13T10:00:33+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b79e61d4", "title": "Incident response analyst report 2024", "url": "https://securelist.com/kaspersky-incident-response-report-2024/115873/", "published_at": "2025-03-12T08:00:21+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b7c771d6", "title": "DCRat backdoor returns", "url": "https://securelist.com/new-wave-of-attacks-with-dcrat-backdoor-distributed-by-maas/115850/", "published_at": "2025-03-11T10:00:13+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b840504d", "title": "SideWinder targets the maritime and nuclear sectors with an updated toolset", "url": "https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/", "published_at": "2025-03-10T10:00:36+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b90c287a", "title": "Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity", "url": "https://securelist.com/backdoors-and-stealers-prey-on-deepseek-and-grok/115801/", "published_at": "2025-03-06T10:00:04+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4b9b0daff", "title": "Undercover miner: how YouTubers get pressed into distributing SilentCryptoMiner as a restriction bypass tool", "url": "https://securelist.com/silentcryptominer-spreads-through-blackmail-on-youtube/115788/", "published_at": "2025-03-05T10:00:38+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4ba9e32e0", "title": "Mobile malware evolution in 2024", "url": "https://securelist.com/mobile-threat-report-2024/115494/", "published_at": "2025-03-03T10:00:49+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4bb2d822a", "title": "The SOC files: Chasing the web shell", "url": "https://securelist.com/soc-files-web-shell-chase/115714/", "published_at": "2025-02-28T04:00:11+00:00" }, { "id": "01a0ca8b-0039-71af-83cc-e1e4bba04068", "title": "Exploits and vulnerabilities in Q4 2024", "url": "https://securelist.com/vulnerabilities-and-exploits-in-q4-2024/115761/", "published_at": "2025-02-26T10:00:08+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e0407d71069a", "title": "The GitVenom campaign: cryptocurrency theft using GitHub", "url": "https://securelist.com/gitvenom-campaign/115694/", "published_at": "2025-02-24T09:26:58+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e0407e41e275", "title": "Angry Likho: Old beasts in a new forest", "url": "https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/", "published_at": "2025-02-21T10:00:21+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e0407ee2d95c", "title": "Managed detection and response in 2024", "url": "https://securelist.com/kaspersky-managed-detection-and-response-report-2024/115635/", "published_at": "2025-02-20T08:00:24+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e0407fc9a030", "title": "Spam and phishing in 2024", "url": "https://securelist.com/spam-and-phishing-report-2024/115536/", "published_at": "2025-02-19T10:00:31+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e04080bb9863", "title": "StaryDobry ruins New Year’s Eve, delivering miner instead of presents", "url": "https://securelist.com/starydobry-campaign-spreads-xmrig-miner-via-torrents/115509/", "published_at": "2025-02-18T10:00:49+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e04080feb179", "title": "Investors, Trump and the Illuminati: What the “Nigerian prince” scams became in 2024", "url": "https://securelist.com/nigerian-scams-2024/115388/", "published_at": "2025-02-05T12:00:05+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e04081340833", "title": "Take my money: OCR crypto stealers in Google Play and App Store", "url": "https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/", "published_at": "2025-02-05T08:00:16+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e0408151d31f", "title": "One policy to rule them all", "url": "https://securelist.com/group-policies-in-cyberattacks/115331/", "published_at": "2025-01-31T10:00:02+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e040822f71a5", "title": "No need to RSVP: a closer look at the Tria stealer campaign", "url": "https://securelist.com/tria-stealer-collects-sms-data-from-android-devices/115295/", "published_at": "2025-01-30T08:00:12+00:00" }, { "id": "01a0ca8b-268e-70c9-b721-e040828a055b", "title": "Threat predictions for industrial enterprises 2025", "url": "https://securelist.com/industrial-threat-predictions-2025/115327/", "published_at": "2025-01-29T10:00:37+00:00" }, { "id": "01a0ca8b-4baa-717b-85c5-e853830cd504", "title": "Mercedes-Benz Head Unit security research report", "url": "https://securelist.com/mercedes-benz-head-unit-security-research/115218/", "published_at": "2025-01-17T10:00:33+00:00" }, { "id": "01a0ca8b-4baa-717b-85c5-e8538377df6e", "title": "EAGERBEE, with updated and novel components, targets the Middle East", "url": "https://securelist.com/eagerbee-backdoor/115175/", "published_at": "2025-01-06T08:00:07+00:00" }, { "id": "01a0ca8b-4baa-717b-85c5-e85384130731", "title": "Threat landscape for industrial automation systems in Q3 2024", "url": "https://securelist.com/ics-cert-q3-2024-report/115182/", "published_at": "2024-12-27T10:00:46+00:00" } ] posts Claim your blog

Back to Kaspersky Securelist

Blog · corpus.blog/blogs/securelist.com/posts

Kaspersky Securelist

securelist.com

2025

Kaspersky Security Bulletin 2025. Statistics original ↗

2 Dec 2025

Tomiris wreaks Havoc: New tools and techniques of the APT group original ↗

28 Nov 2025

Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025 original ↗

26 Nov 2025

To buy or not to buy: How cybercriminals capitalize on Black Friday original ↗

24 Nov 2025

ToddyCat: your hidden email assistant. Part 1 original ↗

21 Nov 2025

Inside the dark web job market original ↗

20 Nov 2025

Blockchain and Node.js abused by Tsundere: an emerging botnet original ↗

20 Nov 2025

IT threat evolution in Q3 2025. Mobile statistics original ↗

19 Nov 2025

IT threat evolution in Q3 2025. Non-mobile statistics original ↗

19 Nov 2025

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs original ↗

28 Oct 2025

Mem3nt0 mori – The Hacking Team is back!original ↗

27 Oct 2025

Deep analysis of the flaw in BetterBank reward logic original ↗

22 Oct 2025

The evolving landscape of email phishing attacks: how threat actors are reusing and refining established techniques original ↗

21 Oct 2025

PassiveNeuron: a sophisticated campaign targeting servers of high-profile organizations original ↗

21 Oct 2025

Post-exploitation framework now also delivered via npm original ↗

17 Oct 2025

SEO spam and hidden links: how to protect your website and your reputation original ↗

17 Oct 2025

Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution original ↗

15 Oct 2025

Mysterious Elephant: a growing threat original ↗

15 Oct 2025

Signal in the noise: what hashtags reveal about hacktivism in 2025 original ↗

14 Oct 2025

The king is dead, long live the king! Windows 10 EOL and Windows 11 forensic artifacts original ↗

14 Oct 2025

How we trained an ML model to detect DLL hijacking original ↗

6 Oct 2025

Detecting DLL hijacking with machine learning: real-world cases original ↗

6 Oct 2025

Forensic journey: hunting evil within AmCache original ↗

1 Oct 2025

Massive npm infection: the Shai-Hulud worm and patient zero original ↗

25 Sept 2025

Threat landscape for industrial automation systems in Q2 2025 original ↗

19 Sept 2025

RevengeHotels: a new wave of attacks leveraging LLMs and VenomRAT original ↗

16 Sept 2025

Shiny tools, shallow checks: how the AI hype opens the door to malicious MCP servers original ↗

15 Sept 2025

Notes of cyber inspector: three clusters of threat in cyberspace original ↗

10 Sept 2025

IT threat evolution in Q2 2025. Mobile statistics original ↗

5 Sept 2025

IT threat evolution in Q2 2025. Non-mobile statistics original ↗

5 Sept 2025

Cookies and how to bake them: what they are for, associated risks, and what session hijacking has to do with it original ↗

2 Sept 2025

How attackers adapt to built-in macOS protection original ↗

29 Aug 2025

Exploits and vulnerabilities in Q2 2025 original ↗

27 Aug 2025

Modern vehicle cybersecurity trends original ↗

22 Aug 2025

GodRAT – New RAT targeting financial institutions original ↗

19 Aug 2025

Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824 original ↗

18 Aug 2025

New trends in phishing and scams: how AI and social media are changing the game original ↗

13 Aug 2025

Scammers mass-mailing the Efimer Trojan to steal crypto original ↗

8 Aug 2025

Driver of destruction: How a legitimate driver is being used to take down AV processes original ↗

6 Aug 2025

Cobalt Strike Beacon delivered via GitHub and social media original ↗

30 Jul 2025

ToolShell: a story of five vulnerabilities in Microsoft SharePoint original ↗

25 Jul 2025

The SOC files: Rumble in the jungle or APT41’s new target in Africa original ↗

21 Jul 2025

GhostContainer backdoor: malware compromising Exchange servers of high-value organizations in Asia original ↗

17 Jul 2025

Forensic journey: Breaking down the UserAssist artifact structure original ↗

14 Jul 2025

Code highlighting with Cursor AI for $500,000 original ↗

10 Jul 2025

Approach to mainframe penetration testing on z/OS. Deep dive into RACF original ↗

8 Jul 2025

Batavia spyware steals data from Russian organizations original ↗

7 Jul 2025

AI and collaboration tools: how cyberattackers are targeting SMBs in 2025 original ↗

25 Jun 2025

SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play original ↗

23 Jun 2025

Toxic trend: Another malware threat targets DeepSeek original ↗

11 Jun 2025

Sleep with one eye open: how Librarian Ghouls steal data by night original ↗

9 Jun 2025

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721 original ↗

6 Jun 2025

IT threat evolution in Q1 2025. Non-mobile statistics original ↗

5 Jun 2025

IT threat evolution in Q1 2025. Mobile statistics original ↗

5 Jun 2025

Host-based logs, container-based threats: How to tell where an attack began original ↗

3 Jun 2025

Exploits and vulnerabilities in Q1 2025 original ↗

30 May 2025

Zanubis in motion: Tracing the active evolution of the Android banking malware original ↗

28 May 2025

Dero miner zombies biting through Docker APIs to build a cryptojacking horde original ↗

21 May 2025

Threat landscape for industrial automation systems in Q1 2025 original ↗

15 May 2025

Using a Mythic agent to optimize penetration testing original ↗

13 May 2025

State of ransomware in 2025 original ↗

7 May 2025

Outlaw cybergang attacking targets worldwide original ↗

29 Apr 2025

Triada strikes back original ↗

25 Apr 2025

Operation SyncHole: Lazarus APT goes back to the well original ↗

24 Apr 2025

Russian organizations targeted by backdoor masquerading as secure networking software updates original ↗

22 Apr 2025

Lumma Stealer – Tracking distribution channels original ↗

21 Apr 2025

Phishing attacks leveraging HTML code inside SVG files original ↗

21 Apr 2025

IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia original ↗

17 Apr 2025

Streamlining detection engineering in security operation centers original ↗

16 Apr 2025

GOFFEE continues to attack organizations in Russia original ↗

10 Apr 2025

Attackers distributing a miner and the ClipBanker Trojan via SourceForge original ↗

8 Apr 2025

How ToddyCat tried to hide behind AV software original ↗

7 Apr 2025

A journey into forgotten Null Session and MS-RPC interfaces, part 2 original ↗

4 Apr 2025

TookPS: DeepSeek isn’t the only game in town original ↗

2 Apr 2025

Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain original ↗

25 Mar 2025

Financial cyberthreats in 2024 original ↗

25 Mar 2025

Threat landscape for industrial automation systems in Q4 2024 original ↗

21 Mar 2025

Arcane stealer: We want all your data original ↗

19 Mar 2025

Head Mare and Twelve join forces to attack Russian entities original ↗

13 Mar 2025

Incident response analyst report 2024 original ↗

12 Mar 2025

DCRat backdoor returns original ↗

11 Mar 2025

SideWinder targets the maritime and nuclear sectors with an updated toolset original ↗

10 Mar 2025

Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity original ↗

6 Mar 2025

Undercover miner: how YouTubers get pressed into distributing SilentCryptoMiner as a restriction bypass tool original ↗

5 Mar 2025

Mobile malware evolution in 2024 original ↗

3 Mar 2025

The SOC files: Chasing the web shell original ↗

28 Feb 2025

Exploits and vulnerabilities in Q4 2024 original ↗

26 Feb 2025

The GitVenom campaign: cryptocurrency theft using GitHub original ↗

24 Feb 2025

Angry Likho: Old beasts in a new forest original ↗

21 Feb 2025

Managed detection and response in 2024 original ↗

20 Feb 2025

Spam and phishing in 2024 original ↗

19 Feb 2025

StaryDobry ruins New Year’s Eve, delivering miner instead of presents original ↗

18 Feb 2025

Investors, Trump and the Illuminati: What the “Nigerian prince” scams became in 2024 original ↗

5 Feb 2025

Take my money: OCR crypto stealers in Google Play and App Store original ↗

5 Feb 2025

One policy to rule them all original ↗

31 Jan 2025

No need to RSVP: a closer look at the Tria stealer campaign original ↗

30 Jan 2025

Threat predictions for industrial enterprises 2025 original ↗

29 Jan 2025

Mercedes-Benz Head Unit security research report original ↗

17 Jan 2025

EAGERBEE, with updated and novel components, targets the Middle East original ↗

6 Jan 2025

2024

Threat landscape for industrial automation systems in Q3 2024 original ↗

27 Dec 2024