Analysis of new Crypt Ghouls threat group 👻 Last December, we discovered a new group targeting Russian businesses and government agencies with #ransomware. Investigation into this group’s activity suggests a connection between it and other groups which are actively targeting Russian entities. The group are deploying toolkits including Mimikatz, XenAllPasswordPro, PingCastle, Localtonet, resocks, AnyDesk, PsExec, and as the final payload, they deploy LockBit 3.0 and Babuk for final infection. Additionally, as previously noted, we've noticed a fair bit of overlap in the TTPs between this group and other well known groups such as MorLock, BlackJack and Shedding Zmiy. Read the full report ⇒ kas.pr/osu8

We've recently discovered a new Trojan, dubbed Awaken Likho which is targeting Russian government agencies and industrial enterprises Active since 2021, it has recently updated its toolkit and has replaced UltraVNC with MeshAgent, an open-source remote management tool. Additionally, the group is using AutoIt in the attack chain. The tactic for infiltrating target companies remains targeted phishing, with significant effort put into reconnaissance to produce convincing bait. Read our full report ⇒ kas.pr/1jp2

Although not exactly new, criminals are spreading malware through fake websites with popular software such as #uTorrent, Microsoft Office, and Minecraf. They're also looking to spread their malware through #Telegram and #YouTube channels, installing Wazuh SIEM agents on victims’ devices. Full story: kas.pr/f4en

For close to 20 years, we've used machine learning to help us automate threat detection, anomaly recognition, as well as enhance the accuracy of malware identification. In our latest article, we look at how we managed to achieve a 25% increase in APT detection via ML. Learn more: kas.pr/821t

Regular readers may recall when we wrote about 'Necro', which we first talked about it way back in 2019. Back then, we discovered a Trojan in CamScanner which had managed to clock up over 100 million downloads on Google Play. Fast-forward to today and the trojan has found its way inside Spotify mods, camera apps and even mods for Minecraft and WhatsApp. Full story: kas.pr/yo8a

-=TWELVE=- is a threat group which is primarily targeting Russian government organizations. They specialize in encrypting and then deleting victims’ data, which suggests that their main goal is to inflict as much damage as possible on endpoints. We look at the evolution of the group and how they're targeting victims. Full report: kas.pr/z98r

We have discovered a new web shell infection which is targeting a government entity in the Middle East. This is a new variant of a known China Chopper malware & has been attributed to Tropic Trooper group which has been active for over a decade. More ⇒ kas.pr/2aex

Our Q2 Threat Evolution report is live. In the report we take a look at the XZ backdoor, the DuneQuixote targeting the Middle East, ToddyCat's focus on APAC as well as how threat actors are using LockBit to generate targeted ransomware. Full report: kas.pr/u8ac

Recently we have discovered a well-known #Necro downloader hiding inside a modified #Spotify app: opentip.kaspersky.com/acb7a0…. It’s similar to the Triada trojan and is capable of downloading and launching arbitrary DEX files. It’s distributed through websites offering Spotify modifications. More details coming soon

We’ve uncovered "#Tusk" - an online fraud campaign stealing #cryptocurrency & sensitive info by exploiting trends such as web3, #AI, & #gaming. The attack deploys info-stealing & clipper #malware in order to target individuals worldwide. Full report: kas.pr/qd1p