kaspersky Archives • Daily CyberSecurity

Toy Ghouls Backdoor Uses HiveMQ and Element for C2 Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Toy Ghouls Backdoor Uses HiveMQ and Element for C2

Do Son September 4, 2026

At a glance Actor or group Toy Ghouls (aka Bearlyfy, Labubu, Laboo.boo, Feral Wolf) Activity type Custom...

HardBreacher Exploit Targets Kaspersky Hacker coding the HardBreacher exploit aiming at a Kaspersky Endpoint Security interface process

HardBreacher Exploit Targets Kaspersky

Do Son August 31, 2026

A protective security product can inadvertently transform into a highly vulnerable intrusion point. An independent security researcher...

Armored Likho Still Toolkit Deploys Covert Spying Implants Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit Deploys Covert Spying Implants

Do Son August 19, 2026

At a glance Actor or group: Armored Likho (also known as Eagle Werewolf) Activity type: Cyber espionage...

Project CAV3RN Framework Adds DNS and Google Relays Project CAV3RN framework architecture and Project CAV3RN framework analysis diagram

Project CAV3RN Framework Adds DNS and Google Relays

Do Son August 17, 2026

At a glance Malware family: Project CAV3RN Threat actor: Unattributed cyber espionage cluster Target or victims: Targeted...

GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi GenieLocker ransomware by Toy Ghouls targeting Russian manufacturing on Windows Linux ESXi

GenieLocker ransomware by Toy Ghouls targeting Russian manufacturing on Windows Linux ESXi

GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi

Do Son August 5, 2026

At a glance Field Detail Malware family GenieLocker (PE builds for Windows; ELF builds for Linux and...

Mirage Kitten Deploys New Malware Against Middle East and Africa Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten Deploys New Malware Against Middle East and Africa

Do Son August 1, 2026

At a glance Actor Mirage Kitten (also UNC1549, Smoke Sandstorm, Nimbus Manticore) Activity State-aligned cyber espionage and...

GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments

Do Son July 24, 2026

At a glance Malware family GoSerpent backdoor, plus McMx, Stowaway, ThumbcacheService, and TmcLoader/TmcPayload Threat actor Unconfirmed. Kaspersky...

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms

Do Son July 23, 2026

At a glance Actor / group Suspected Chinese-speaking APT group (low confidence) Activity type Cyberespionage using malicious...

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases

Do Son July 22, 2026

At a Glance Malware family OkoBot framework (TookPS lineage; 20+ payloads and implants) Threat actor Unattributed; suspected...

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel

Do Son July 21, 2026

At a glance Threat actor Project CAV3RN cluster; linked to OilRig (APT34) with low confidence Activity type...

ScreenConnect AsyncRAT Campaign infrastructure and remote monitoring tools

ScreenConnect AsyncRAT Campaign Hides Inside Fake Freeware

Do Son July 13, 2026

At a Glance Malware Family: AsyncRAT Threat Actor: Unknown cybercriminals Target or Victims: Individual consumers and corporate...

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools

Do Son July 2, 2026

At a glance Group The Gentlemen (ransomware-as-a-service) Activity Ransomware, data-leak extortion, custom tool development Targets Large firms...

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign

Do Son June 29, 2026

At a glance Field Detail Malware family SharkLoader (loader) delivering Cobalt Strike Beacon Threat actor StrikeShark; unattributed,...

WhatsApp Malware Campaign Spreads RMM Software

Diagram showing the WhatsApp malware campaign and VBScript infection chain

WhatsApp Malware Campaign Spreads RMM Software

Do Son June 26, 2026

At a glance Actor: Suspected Chinese-speaking threat actor (low confidence) Activity Type: Malware distribution and silent RMM...

Argamal Trojan Campaign Targets Adult Gamers with COM Hijacking Argamal Trojan campaign Kaspersky malware analysis

Argamal Trojan Campaign Targets Adult Gamers with COM Hijacking

Do Son June 9, 2026

A dangerous new electronic threat is currently targeting individuals who download adult video games online. Security researchers...

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

The Q1 2026 Exploit Surge: AI Discovers the Flaws, APTs Reap the Rewards

Do Son May 11, 2026

The first quarter of 2026 has set a blistering and volatile pace for the cybersecurity industry, marked...

OceanLotus Hijacks PyPI to Deploy “ZiChatBot” via Enterprise Chat APIs Acreed Infostealer, BNB Smart Chain CVE-2023-20269 exploit

OceanLotus Hijacks PyPI to Deploy “ZiChatBot” via Enterprise Chat APIs

Do Son May 7, 2026

In a calculated move that signals the expansion of state-sponsored threats into open-source repositories, researchers at Kaspersky...

DAEMON Tools Supply Chain Attack QUIC RAT Malware

Trojanized Tools: DAEMON Tools Supply Chain Attack Compromises Global Systems

Do Son May 6, 2026

Kaspersky has uncovered a sophisticated supply chain attack targeting DAEMON Tools, the widely used disk imaging software....

Scammers Weaponize Amazon SES to Bypass Security Amazon SES Phishing AWS IAM Credential Leak

Scammers Weaponize Amazon SES to Bypass Security

Do Son May 5, 2026

A recent report from Kaspersky Labs reveals a disturbing surge in phishing campaigns leveraging Amazon Simple Email...

Tax Audit Trap: Silver Fox Unleashes “ABCDoor” via Modified Rust Loaders ABCDoor Malware Silver Fox Phishing

Tax Audit Trap: Silver Fox Unleashes “ABCDoor” via Modified Rust Loaders

Do Son May 4, 2026

Security researchers at Kaspersky Labs have uncovered a sophisticated, multi-stage phishing campaign orchestrated by the Silver Fox...

The Unpatched Pivot: New RPC Flaw Opens Doors for Windows Privilege Escalation PhantomRPC Windows Privilege Escalation

The Unpatched Pivot: New RPC Flaw Opens Doors for Windows Privilege Escalation

Do Son April 27, 2026

A new research report from Kaspersky Security Services has pulled back the curtain on a fundamental architectural...

“FakeWallet” Trojan Masquerades as Crypto Wallets to Drain Assets

Do Son April 22, 2026

A sophisticated new mobile threat is stalking the Apple App Store, preying on cryptocurrency users through a...

Critical Alert 1 Active Exploit Detected Today