Securelist by Kapersky

• Threat landscape for industrial automation systems. Q1 2026

  This report contains industrial threat statistics for Q1 2026, including industrial threat distribution by type, source, region and industry.

• When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website

  The OAuth 2.0 Device Authorization Grant specification was designed to streamline authentication for Smart TVs, IoT devices, and printers. Today, threat actors are weaponizing it.

• Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign

  An inside look at the active Armored Likho APT campaign. The attackers are using spear-phishing, AI-generated loaders, and a new Python-based tool, BusySnake Stealer, to target organizations in Russia, Kazakhstan, and Brazil.

• Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects

  Kaspersky Compromise Assessment specialists analyze trends from the service's 2025 projects and provide tips on how to enhance your organization's security.

• The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

  Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection chain and analyze the C2 infrastructure.

• OpenClaw: risks for the users and how to mitigate them

  Researching OpenClaw vulnerabilities, malicious skills, and other security issues with the popular agent, and providing tips on how to mitigate them.

• ToddyCat: your hidden email assistant. Part 2

  An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services.

• The Gentlemen are knocking: сustom backdoors and evolving tactics

  Kaspersky researchers analyze incidents related to The Gentlemen RaaS group, disclose their tools and TTPs, and find a new ransomware variant.

• Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk

  Analysis of CVE-2024-2658 as found in Schneider Electric's Floating License Manager. Discover how this FlexNet Publisher vulnerability potentially allows attackers to escalate to NT AUTHORITY\SYSTEM privileges and expand their foothold; learn how to mitigate the risk.

• Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools

  Kaspersky researchers analyze the threat landscape for SMBs in 2026: the rise of attacks involving fake AI tools, phishing schemes, and data sold on the dark web.