VulnHub

Engineers at an Israeli food company faced a major setback when an intruder tampered with their refrigeration system. The attacker switched the gas cooler and receiver valves to manual and left them open, causing liquid carbon dioxide to flood the compressors and ultimately destroying them. The repair process took a week, as the new compressors were incompatible with the existing system, requiring a complete rework and gas recharge. This incident is part of a larger trend, with Kaspersky ICS CERT reporting around forty similar attacks recently. Such breaches highlight the vulnerabilities in industrial control systems and the potential for significant operational disruptions.

This article examines how Kaspersky Anti Targeted Attack uses Network Anomaly Detection (NAD) to identify unusual network behavior, specifically through the lens of Kerberoasting and DNS tunneling attacks. Kerberoasting involves attackers obtaining service account credentials from Active Directory, while DNS tunneling allows data exfiltration through DNS queries. By analyzing these attack vectors, the article highlights the importance of NAD in detecting and mitigating such threats. Understanding these methods is crucial for organizations looking to strengthen their cybersecurity measures and protect sensitive information from targeted attacks. The insights provided could help security teams better prepare for and respond to similar incidents in the future.

Kaspersky researchers have identified a new strain of ransomware called GenieLocker, which targets Windows, Linux, and ESXi systems. This ransomware is associated with a group known as Toy Ghouls, which is primarily focused on financial extortion. The emergence of GenieLocker is concerning because it indicates a growing trend of customized ransomware that can impact multiple operating systems, making it a versatile threat for various organizations. Companies using affected systems should be vigilant and implement strong security measures to protect their data. With ransomware incidents on the rise, understanding the capabilities of threats like GenieLocker is crucial for effective defense strategies.

Kaspersky researchers have identified a new malware campaign attributed to a group known as Mirage Kitten, which primarily targets the Middle East and Africa. This campaign involves several previously undocumented tools, including the NightLedger backdoor and tunneling tools called ArcBridge and BridgeHead. These malicious tools can facilitate unauthorized access and data exfiltration from compromised systems. The emergence of this malware is concerning as it highlights the ongoing cyber threats facing organizations in these regions, emphasizing the need for heightened security measures. Companies should remain vigilant and implement robust defenses to protect against potential breaches.

Researchers have identified a new malware strain named GoSerpent, which has been targeting government and diplomatic entities in Southeast Asia since late 2025. Discovered by Kaspersky in February 2026, GoSerpent is designed for long-term access and intelligence gathering, indicating a sophisticated level of espionage. The malware's specific targets include various Southeast Asian governments and their associated diplomatic missions, raising concerns about national security and the potential for sensitive information to be compromised. The emergence of GoSerpent highlights the ongoing cyber threats faced by government institutions in the region, emphasizing the need for enhanced cybersecurity measures. As attacks like these become more common, governments must prioritize their defenses against such persistent threats.

Kaspersky has reported a new malware called OkoBot that specifically targets cryptocurrency users. The malware masquerades as fake software, tricking users into downloading it. Once installed, OkoBot steals sensitive information such as wallet files, seed phrases, and passwords, while also recording user activity within wallet applications. This poses a significant risk to cryptocurrency holders, as their assets could be compromised. Users need to be cautious about the software they install and ensure they are using legitimate applications to protect their digital currencies.

Kaspersky's GReAT team has identified a new malware framework called OkoBot that specifically targets cryptocurrency users. This sophisticated malware utilizes a component known as TookPS to steal sensitive information, such as seed phrases, and monitor activities on Chromium-based browsers. Additionally, OkoBot can install various types of malware, including the Rilide stealer, which further compromises users' security. This threat is particularly concerning for those involved in cryptocurrency transactions, as it can lead to significant financial losses and privacy violations. Users need to be vigilant and consider enhancing their security measures to protect against these evolving threats.

Kaspersky has reported that the Armored Likho group, a previously identified advanced persistent threat (APT), is actively targeting government and energy sectors using a combination of techniques. They employ BusySnake Stealer, a type of malware designed to extract sensitive information, alongside AI-generated loaders and phishing methods to infiltrate systems. This campaign poses significant risks to organizations in these critical sectors, as the stolen data could lead to further exploitation or security breaches. The use of sophisticated tools and tactics highlights the evolving nature of cyber threats and the need for enhanced security measures within these industries. Organizations should remain vigilant and strengthen their defenses against such targeted attacks.

A new cyber threat group called Armored Likho has been linked to attacks against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. Researchers from Kaspersky report that this group combines financially motivated schemes targeting individuals with cyber espionage aimed at organizations. The BusySnake Stealer malware is being used in these operations, which raises concerns about the potential for sensitive data breaches. The targeting of critical infrastructure like power sectors is particularly alarming, as it can have severe implications for national security and public safety. Organizations in affected regions should bolster their cybersecurity measures to defend against these types of attacks.

A new malware called Umbrij, linked to the cyber group ToddyCat, is targeting corporate Gmail accounts by exploiting the Google API. According to Kaspersky's recent report, the malware allows attackers to gain stealthy access to email communications, raising significant concerns for businesses that rely on Gmail for their operations. This tactic of compromising access through APIs highlights potential vulnerabilities in how companies manage their email systems. As email remains a primary communication tool for organizations, the implications of such breaches could be severe, resulting in sensitive information leaks and potential financial losses. Companies using Gmail should enhance their security measures to safeguard against this type of attack.

Kaspersky researchers have identified a large-scale campaign that uses compromised ScreenConnect software to deliver AsyncRAT, a type of remote access Trojan. Attackers are exploiting vulnerabilities in the legitimate ScreenConnect application to drop the malicious payload onto targeted systems. This incident raises concerns for users and organizations that rely on ScreenConnect for remote access, as they may unknowingly become victims of this malware. The report details the infection chain and the command and control (C2) infrastructure used in the attack, emphasizing the need for vigilance in software downloads and updates. Users should ensure they are downloading software from official sources and remain cautious of unsolicited software offers.

Kaspersky researchers have investigated the activities of The Gentlemen Ransomware-as-a-Service (RaaS) group, revealing their customized backdoors and evolving tactics. This group has introduced a new variant of ransomware that poses a significant threat to various organizations. The research outlines the tools and techniques used by the group, which are designed to infiltrate systems and encrypt sensitive data for ransom. Companies that rely on digital systems for operations are particularly vulnerable to these types of attacks, highlighting the need for enhanced security measures. Organizations are urged to stay informed about these developments and take proactive steps to defend against such threats.