VIRUS-NEWS
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations i...
by Georgy Kucherin, Vladimir Nestor, Vasily Berdnikov22 Oct 2026 at 6:00am
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
by Kaspersky21 Oct 2026 at 3:18pm
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we?ll walk you through examples using KEDR, KATA, and KES.
Operation FlashHole: Lazarus breaks security, defies control
by Sojun Ryu21 Oct 2026 at 2:07am
Kaspersky researchers analyze Operation FlashHole ? a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
The journey of a paper unicorn: adventures inside a modern warehouse
by Sergey Sidorov, Haidar Kabibo, Victor Zvarykin, Kaspersky Security Services20 Oct 2026 at 7:00am
Kaspersky experts explain the security issues affecting warehouse environments. We break down initial access vectors specific to warehouses, and discuss the impact of a compromise.
MacSync under the microscope: new delivery methods and a new payload
by Sergey Puzan24 Sep 2026 at 10:00am
We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
by Ahmad Zaidi Said, Elsayed Elrefaei, Kaspersky Security Services21 Sep 2026 at 10:00am
Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.
The Odyssey and Trojans again: MovieReaper attacks users in multiple countrie...
by Konstantin Isakov, Pavel Cheremushkin17 Sep 2026 at 1:00pm
Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as The Odyssey, and uses the Solana blockchain to hide its C2 infrastructure.
NightEagle targets Russian companies
by Stanislav Larinsky, Kaspersky Security Services16 Sep 2026 at 10:00am
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP.
Angry Birds: Toy Ghouls? new toys
by Kaspersky GERT, Kaspersky Security Services4 Sep 2026 at 10:00am
Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.
Mirage Kitten targeting aviation and FinTech sectors across the Middle East a...
by Omar Amin1 Sep 2026 at 7:00am
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
