;
;

Securelist

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the Blac...
Posted on 22 October 2026 | 6:00 am

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the...
Posted on 21 October 2026 | 3:18 pm

Operation FlashHole: Lazarus breaks security, defies control

Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole techni...
Posted on 21 October 2026 | 2:07 am

The journey of a paper unicorn: adventures inside a modern warehouse

Kaspersky experts explain the security issues affecting warehouse environments. We break down initial access vectors specific to warehouses, and di...
Posted on 20 October 2026 | 7:00 am

MacSync under the microscope: new delivery methods and a new payload

We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
Posted on 24 September 2026 | 10:00 am

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active...
Posted on 21 September 2026 | 10:00 am

The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as The Odyssey, and uses ...
Posted on 17 September 2026 | 1:00 pm

NightEagle targets Russian companies

Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The g...
Posted on 16 September 2026 | 10:00 am

Angry Birds: Toy Ghouls’ new toys

Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its c...
Posted on 4 September 2026 | 10:00 am

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat i...
Posted on 1 September 2026 | 7:00 am