ZCyberNews
中文

#kaspersky

18 articles

Between 2026-04-16 and 2026-09-24, ZCyberNews published 19 articles tagged kaspersky, spanning 14 high-severity items and one critical entry. Coverage names CrystalX, GoSerpent, and HelloNet among the top threat actors observed, alongside the CVEs CVE-2019-0708 and CVE-2020-0688. Reporting touches the technology, finance, government, education, and energy sectors. The affected regions recorded are Global, Russia, Southeast asia, Spain, and Africa. This archive collects that reporting in one place for readers tracking the tag's full output across the period.

Diagram-style illustration of a macOS terminal window with a calendar event and binary file icons representing the MacSync infection chain
Malware

MacSync macOS Stealer Adds Backdoor, Swaps Scripts for Binaries

MacSync's new build drops AppleScript droppers for Objective-C and Swift binaries, delivers payloads via iCloud calendar events, and adds a backdoor module.

7 min readMacSync
Illustration of a torrent file icon morphing into a Windows executable, with a blockchain node graphic representing the Solana-based command-and-control channel.
Malware

MovieReaper Trojan Spreads via Compromised Torrent Archive

Kaspersky found hundreds of MovieReaper victims across 10+ countries after attackers poisoned itorrents.org, serving fake "The Odyssey" torrents that drop a Solana-C2 trojan.

6 min readMovieReaper
Abstract network diagram showing a backdoor deployed on a Microsoft Exchange server with tunneled RDP traffic routing through legitimate cloud services.HIGH
Threat Intel

NightEagle APT Hits Russian Firms With GhostContainer Backdoor

Kaspersky GERT ties NightEagle (APT-Q-95) to attacks on Russian firms, deploying the GhostContainer backdoor on Exchange via CVE-2020-0688 and BlueKeep CVE-2019-0708.

CVE-2020-0688CVE-2019-0708
6 min readNightEagle
Diagram of ValleyRAT infection chain via adware installerHIGH
Malware

ValleyRAT Backdoor Disguised as Adware Hits Windows Users

Kaspersky found ValleyRAT delivered via fake adware installer that disables Defender and sideloads libcef.dll. Targets Chinese-speaking users.

6 min readValleyRAT
Diagram of GenieLocker ransomware infection chain across Windows, Linux, and ESXi systemsHIGH
Malware

GenieLocker Ransomware Targets Windows, Linux, and ESXi Systems

Kaspersky dissects GenieLocker, a custom ransomware from the Toy Ghouls group, targeting Windows, Linux, and ESXi in attacks on Russian manufacturing firms since March 2026.

3 min readToy Ghouls
Diagram of GoSerpent attack chain showing initial deployment, C2 communication, credential dumping, and data exfiltration phasesHIGH
Malware

GoSerpent Backdoor Evolves in Targeted Attacks on Southeast Asian

Kaspersky details the GoSerpent backdoor, active since 2021, targeting government entities in Southeast Asia with a 2026 variant that uses encrypted C2, SOCKS5 proxying, and...

4 min readGoSerpent
Diagram of HelloNet attack chain showing ViPNet update system DLL sideloading leading to HelloInjector, HelloProxy, and HelloBackdoor modulesHIGH
Threat Intel

HelloNet Campaign Hijacks ViPNet Update System to Deploy Malicious

Kaspersky details HelloNet APT campaign targeting Russian government, energy, and transport sectors via ViPNet update system DLL sideloading since May 2026.

4 min readHelloNet
Diagram of OkoBot infection chain showing TookPS initial access, SSH tunnel, and payload delivery stagesHIGH
Malware

OkoBot: New Sophisticated Malware Framework Targets Cryptocurrency

Kaspersky GReAT dissects OkoBot, a multi-stage framework using SSH tunnels and over 20 payloads to steal cryptocurrency wallet seed phrases, browser data, and credentials.

3 min readOkoBot
Bar chart showing percentage of ICS computers blocked by region for Q1 2026, with Northern Europe lowest at 9.1% and Africa highest at 27.4%
Industry News

Industrial ICS Threat Rates Hit Three-Year Low in Q1 2026

Kaspersky ICS CERT reports 19.6% of ICS computers blocked malware in Q1 2026, the lowest rate since Q2 2023.

3 min read
Bar chart showing percentage of incidents missed by automated security tools from Kaspersky 2025 compromise assessment report
Industry News

Kaspersky: 60% of Incidents Missed by Automated Security Tools

Kaspersky Compromise Assessment 2025 findings: 60% of incidents lacked high-confidence alerts; 30.8% of threats persisted over 3 months; 40% of web shells hid in backups.

3 min read
Process tree showing WScript.exe spawned by WhatsApp.Root.exe during VBScript executionHIGH
Malware

WhatsApp VBScript Campaign Delivers RMM Remote Access Malware

Kaspersky details an active global campaign distributing VBS files via WhatsApp that installs UEMS RMM software, enabling persistent remote access across 12 countries including...

3 min read
OceanLotus APT Uses PyPI Packages to Deliver ZiChatBot MalwareHIGH
Malware

OceanLotus APT Uses PyPI Packages to Deliver ZiChatBot Malware

Kaspersky attributes a PyPI supply chain campaign to OceanLotus APT, using fake wheel packages to drop ZiChatBot malware that abuses Zulip chat APIs for C2 on Windows and Linux.

4 min readOceanLotus
ZiChatBot Malware Spreads via PyPI Packages Using Zulip C2HIGH
Malware

ZiChatBot Malware Spreads via PyPI Packages Using Zulip C2

Three PyPI packages deliver ZiChatBot malware on Windows and Linux using Zulip chat APIs for stealthy C2 — Kaspersky identifies 12+ victim organizations globally.

4 min readZiChatBot
CrystalX RAT Combines Spyware, Stealer, and Prankware in MaaS OfferingHIGH
Malware

CrystalX RAT Combines Spyware, Stealer, and Prankware in MaaS Offering

Kaspersky details CrystalX RAT, a MaaS malware with spyware, credential theft, and prankware features targeting Windows users globally since mid-2025.

3 min readCrystalX
Kaspersky: Financial Cyber Threats Surged 15% in 2025HIGH
Threat Intel

Kaspersky: Financial Cyber Threats Surged 15% in 2025

Kaspersky reports a 15% year-over-year increase in financial cyber threats in 2025, with infostealers and phishing dominating. Android banking malware rose 20% in Latin America.

2 min read
26 Fake Crypto Wallet Apps on Apple App Store Steal Seed PhrasesHIGH
Threat Intel

26 Fake Crypto Wallet Apps on Apple App Store Steal Seed Phrases

Kaspersky found 26 malicious apps on the Apple App Store since fall 2025 that impersonate wallets like MetaMask and Coinbase to steal recovery phrases and private keys via…

2 min read
Lotus Wiper Strikes Venezuelan Energy Sector in Destructive CampaignCRITICAL
Malware

Lotus Wiper Strikes Venezuelan Energy Sector in Destructive Campaign

Kaspersky discovered Lotus Wiper, a novel file wiper targeting Venezuela's energy and utilities sector since late 2025.

2 min readLotus Wiper
Industrial Control Systems Face Rising Malware, USB Threats in Q4 2025HIGH
Threat Intel

Industrial Control Systems Face Rising Malware, USB Threats in Q4 2025

Kaspersky data shows malware blocked on 33.3% of industrial control system computers in Q4 2025, with internet threats and removable media as top infection vectors. The share of systems facing USB-borne threats grew to 4.1%.

4 min read

Stay Updated

Get the latest cybersecurity news delivered to your inbox.