Search: “Still Toolkit”

1,807 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 1022 Vulnerability 330 Ransomware 144 Exploit / PoC 77 Threat actor 67 Phishing & fraud 62 Data breach 43 Advisory 20 Policy & legal 17 Industry 10 Research 5 AI safety & security 4 Tools 3 AI research 1

SeverityAll critical 317 high 1370 medium 88 low 24 info 8

Armored Likho expands its cyber-espionage toolkit

Kaspersky reports the Armored Likho espionage group now delivers its new Still Toolkit via fundraising-themed lures to steal Telegram data and eavesdrop on victims.

Kaspersky researchers describe a new campaign by the Armored Likho espionage actor. The campaign masquerades as fundraising efforts and delivers a newly developed Still Toolkit designed to steal Telegram data and eavesdrop on victims. The update expands the group's toolkit and continues its espionage-focused targeting.

Kaspersky SecurelistAug 13, 08:00 UTC · Aug 13, 2026Threat actor in the wild

KoffeyMaker: notebook vs. ATM

Kaspersky SecurelistDec 4, 12:00 UTC · Dec 4, 2018Vulnerability

Fiesta parties on

Kaspersky SecurelistNov 5, 17:56 UTC · Nov 5, 2008Vulnerability

The best a man can get

Kaspersky SecurelistFeb 22, 16:07 UTC · Feb 22, 2007Malware in the wild

“NetTraveler is Running!” – Red Star APT Attacks Compromise High

Kaspersky SecurelistJun 4, 18:01 UTC · Jun 4, 2013Vulnerability CVE-2010-3333 CVE-2012-0158

Crimeware and financial cyberthreats in 2023

Kaspersky SecurelistNov 22, 08:00 UTC · Nov 22, 2022Ransomware

December 2012 Microsoft Security Bulletins

Kaspersky SecurelistDec 11, 22:22 UTC · Dec 11, 2012Advisory CVE-2012-0158 CVE-2010-3333 CVE-2012-2539+3 CVEs

December 2012 Microsoft Security Bulletins

Kaspersky SecurelistDec 11, 20:48 UTC · Dec 11, 2012Advisory CVE-2012-0158 CVE-2010-3333 CVE-2012-2539+3 CVEs

Kaspersky Security Bulletin: Review of the Year 2017

Kaspersky SecurelistDec 5, 10:00 UTC · Dec 5, 2017Advisory

Cybersecurity Research During the Coronavirus Outbreak and After

Kaspersky SecurelistFeb 20, 11:03 UTC · Feb 20, 2020Vulnerability

Operation Triangulation: iOS devices targeted with previously unknown malware

Kaspersky SecurelistJun 1, 12:36 UTC · Jun 1, 2023Malware

Threats to ICS and industrial enterprises in 2022

Kaspersky SecurelistNov 23, 08:11 UTC · Nov 23, 2021Ransomware

Kaspersky Security Bulletin: Threat Predictions for 2018

Kaspersky SecurelistNov 15, 10:01 UTC · Nov 15, 2017Advisory

Angry Birds: Toy Ghouls’ new toys

Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.

Kaspersky reports that Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf), a financially motivated group targeting Russian organizations since 2025, shifted from leaked Babuk and LockBit builders and public GitHub tools to its custom GenieLocker ransomware. In early July 2026 the group deployed two custom backdoors: mqtt-bird-agent 0.1.0 using the public HiveMQ MQTT broker as C2, and matrix-bird-agent 0.1.0 using the Element messenger. The backdoors are delivered via WinRM using Evil-WinRM and WinRM-fs, persist as Windows services, and encrypt their configuration with ChaCha20-Poly1305 keyed to the machine's MachineGuid registry value.

Kaspersky SecurelistSep 4, 10:00 UTC · 11d agoThreat actor