Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Ivan Kwiatkowski
A practical way to bring more women to cybersecurity
The cybersecurity world is working hard to attract a larger diversity of profiles into the domain. There are scholarships, mentorship opportunities, networking events, awareness programs, trainings, NGOs, and more. Still, there is a lot more work to be done as the proportion of women in the field, while slightly growing every year, is estimated between the range of 20 to 25%.
An introduction to reverse engineering .NET AOT applications
CYBER THREAT INTELLIGENCE 14 min About a month ago, we started seeing reports on activities from DuckTail , a cybercrime outfit reportedly based in Vietnam. Detonating one of the samples, we observed that a new account was being created on the analysis machine, followed by an RDP connection from an operator who downloaded additional tools, stole cookies, etc. The attack itself had little unique qualities, save for the use of a little-known feature of the .NET language: AOT compilation.
Virtual Reality Archives
By Tom Eston,Ivan Kwiatkowski,Matt Davidson,Brittany Jedrzejewski Over $600 million stolen in the largest DeFi cryptocurrency hack in history, attackers are getting around $10k for stolen network access credentials, and why your identity is trapped inside a social network ...
Subscription Trojans on Google Play
Every once in a while, someone will come across malicious apps on Google Play that seem harmless at first. Some of the trickiest of these are subscription Trojans, which often go unnoticed until the user finds they have been charged for services they never intended to buy. This kind of malware often finds its way into the official marketplace for Android apps. The Jocker family and the recently discovered Harly family are just two examples of this.
Kaspersky Managed Detection and Response 2022 report
Kaspersky Managed Detection and Response (MDR) is a service for 24/7 monitoring and response to detected incidents based on technologies and expertise of Kaspersky Security Operations Center (SOC) team. MDR allows detecting threats at any stage of the attack – both before anything is compromised and after the attackers have penetrated the company’s infrastructure. This is achieved through preventive security systems and active threat hunting – the essential MDR components.
Tomiris called, they want their Turla malware back
Introduction We introduced Tomiris to the world in September 2021, following our investigation of a DNS-hijack against a government organization in the Commonwealth of Independent States (CIS). Our initial report described links between a Tomiris Golang implant and SUNSHUTTLE (which has been associated to NOBELIUM/APT29/TheDukes) as well as Kazuar (which has been associated to Turla); however, interpreting these connections proved difficult.
Transatlantic Cable podcast, episode 288
The latest episode of the Transatlantic Cable sees the team starting out with news around Signal and their refusal to weaken encryption for the U.K government. Following that, the team move onto discussions around Meta and National Center for Missing and Exploited Children’s (NCMEC) campaign to help people with the spread of minors’ intimate images online. To wrap up, the team discuss SnapChat A.I chat bots and LockBit’s attack against the U.K’s Royal Mail service.
Transatlantic Cable podcast, episode 288
The latest episode of the Transatlantic Cable sees the team starting out with news around Signal and their refusal to weaken encryption for the U.K government. Following that, the team move onto discussions around Meta and National Center for Missing and Exploited Children’s (NCMEC) campaign to help people with the spread of minors’ intimate images online. To wrap up, the team discuss SnapChat A.I chat bots and LockBit’s attack against the U.K’s Royal Mail service.
How AI solutions will change our lives
AI AI is going to have a tremendous impact on our lives. How can we get ready for it? Ivan Kwiatkowski March 2, 2023 Beyond the various geopolitical events that defined 2022, on the technological level, it was the year of AI. I might as well start by coming clean: until very recently, whenever I’d be asked about AI in cybersecurity, I’d dismiss it as vaporware.
How AI solutions will change our lives
AI AI is going to have a tremendous impact on our lives. How can we get ready for it? Ivan Kwiatkowski March 2, 2023 Beyond the various geopolitical events that defined 2022, on the technological level, it was the year of AI. I might as well start by coming clean: until very recently, whenever I’d be asked about AI in cybersecurity, I’d dismiss it as vaporware.
Crypto, really. Part III: cryptocurrency politics, and the future
cryptocurrencies In the final part of the series, we take a look at cryptocurrency politics, the future, and the metaverse. Ivan Kwiatkowski November 25, 2022 The first two parts of this series established that cryptocurrencies and NFTs ended up in a place far from where they claimed they were heading.
Transatlantic Cable podcast, episode 269
podcast Episode 269 looks at dodgy NFTs, Rockstar and Uber hacker arrested, and much more! David Buxton September 30, 2022 Episode 269 of the Transatlantic Cable kicks off with news that Interpol is after the CEO of the failed cryptocurrency firm, Terra. Originally cited as a potential star in the crypto-world, Terra fell in the recent crypto-crash.
Crypto, really. Part II: non-fungible tokens
cryptocurrencies In this second part of the series, we’re going to dive deep into Ethereum and its novelties: smart-contracts, DAOs and NFTs. Ivan Kwiatkowski September 28, 2022 Part I of this series gave you a basic knowledge of cryptocurrencies and… left us with a bitter aftertaste. It made the case that cryptocurrencies aren’t really currencies after all, but instead had only succeeded in creating the world’s biggest and most accessible casino (after Wall Street).
Transatlantic Cable Podcast Episode 263
Welcome to the Transatlantic Cable – a podcast that dives into hot topics in the security news and industry each week. We start off this episode with hacking Starlink! It cost a researcher only $25 worth of parts to create a tool that allows custom code to run on the satellite dishes. Then we move on to 7-Eleven Denmark, where a ransomware attack was behind the closure of 175 stores in the country on Monday! Then, we discuss the spyware scandal spreading through Europe.
Crypto, really. Part I: blockchains and cryptocurrencies
So, you want to buy NFTs. You’ve read the stories about people getting immensely rich with them or cryptocurrency, and think — why not me? Well, “You thought wrong” was a working title for this article, but it’ll be a long while before we reach this conclusion. The NFT ecosystem is fairly complex in itself, and the technologies it involves are built on top of others. And understanding what NFTs are, unfortunately, requires establishing some base knowledge.
Dynamic analysis of firmware components in IoT devices
Among the various offensive security techniques, vulnerability assessment takes priority when it comes to analyzing the security of IoT/IIoT devices. In most cases, such devices are analyzed using the black box testing approach, in which the researcher has virtually no knowledge about the object of research.
‘Unpacking’ technical attribution and challenges for ensuring stability in cyberspace
Introduction When reports of a cyberattack appear in the headlines, questions abound regarding who launched it and why. Even if an attacker has what are to it perfectly rational reasons for conducting such an attack, these reasons are often known only to them. The rest of the world, including the victims of the attack, must often engage in some degree of speculation to explain the events and devise ways to protect themselves accordingly.
PC malware statistics, Q1 2022
IT threat evolution in Q1 2022 IT threat evolution in Q1 2022. Non-mobile statistics IT threat evolution in Q1 2022. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, in Q1 2022: Kaspersky solutions blocked 1,216,350,437 attacks from online resources across the globe.
Finding a way out of the dead-end cyber wars
Hear from CIOs, CTOs, and other C-level and senior execs on data and AI strategies at the Future of Work Summit this January 12, 2022. Learn more Smart people in my industry have noted the growing role of cyberspace in inter-state conflicts and called for the development of cooperative, global regulation and governance. There are a few ethical dilemmas that this raises, including one that not much has been written about: the morality of cyberattacks.
Lyceum group reborn
APT reports APT reports 18 Oct 2021 minute read This year, we had the honor to be selected for the thirty-first edition of the Virus Bulletin conference. During the live program, we presented our research into the Lyceum group (also known as Hexane), which was first exposed by Secureworks in 2019. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.
Tomiris backdoor and its connection to Sunshuttle and Kazuar
Background In December 2020, news of the SolarWinds incident took the world by storm. While supply-chain attacks were already a documented attack vector leveraged by a number of APT actors, this specific campaign stood out due to the extreme carefulness of the attackers and the high-profile nature of their victims. It is believed that when FireEye discovered the first traces of the campaign, the threat actor (DarkHalo aka Nobelium) had already been working on it for over a year.
Transatlantic Cable podcast, episode 216
podcast This week on the Kaspersky podcast, Ahmed, Dave, and Jeff discuss Tesla’s robots, Russian spy ships, PayPal and Bitcoin, and more. Jeffrey Esposito August 26, 2021 This week on the Kaspersky Transatlantic Cable podcast, Ahmed, Dave, and I discuss a number of topics that really run the gamut — from spy ships to the robot apocalypse, Bitcoin, and more.
Transatlantic Cable podcast, episode 214
podcast This week on the Kaspersky podcast, Ahmed, Dave, and Jeff discuss Apple’s policy change, Conti gang’s playbook leak, the market for fake COVID-19 vax cards, and more. Jeffrey Esposito August 12, 2021 This week on the Kaspersky Transatlantic Cable podcast, Ahmed, Dave, and I confirm once more how bad I am at trivia and then also cover a handful of some serious security related stuff.
Hacking a capsule hotel
black hat At this year’s Black Hat, Kyasupā demoed hacking a capsule hotel. Jeffrey Esposito August 11, 2021 Whenever I am at Moscow’s Sheremetyevo airport, I always check out the capsule hotel and debate whether to take a rest in one of those mini pods. To date, I haven’t pulled the trigger, but when I saw a presentation at this year’s Black Hat called , I had to check it out. The speaker, Kyasupā of LEXFO, described how he was looking to save money on a holiday, by staying in a capsule hotel.
Transatlantic Cable podcast, episode 213
podcast In this week’s episode, the team looks at Instagram privacy changes, influencers charged with BEC, and much more. David Buxton August 5, 2021 In this week’s episode of the Transatlantic Cable podcast Jeff, Ahmed, and I look at some of the more interesting stories to come out of the cybersecurity space this week. We start on a somber note, with a story of a woman who found a video of herself on Pornhub.
Transatlantic Cable podcast, episode 212
podcast This week on the Kaspersky podcast, Ahmed, Dave, and Jeff discuss the latest with Kaseya, making Bitcoin more trackable, and more. Jeffrey Esposito July 29, 2021 On this week’s edition of the Kaspersky Transatlantic Cable podcast, Ahmed, Dave, and I discuss a variety of topics. We kick off the program with a story from the EU and a new look at making Bitcoin and other cryptocurrencies more trackable.
Transatlantic Cable podcast, episode 211
podcast Dave and Jeff discuss the latest with REvil and its victims, LuminousMoth, and buying a Cold War bunker. Jeffrey Esposito July 22, 2021 With Ahmed on vacation, the Kaspersky Transatlantic Cable podcast returns this week to its original lineup. Dave and I kick off this week’s episode with a look at the latest from REvil and its victims.
Community Conversations: Geneva Dialogue
podcast The Geneva Dialogue discusses the program, where it stands, and what the future holds. Jeffrey Esposito July 24, 2021 Earlier in the week, we teased a miniseries called the Community Podcasts, which you’ll find right alongside the Transatlantic Cable podcast. I will remain your faithful host, and Anastasiya Kazakova of our Government Affairs office will join me.
How to Build a Cybersecurity Culture
How to Build a Cybersecurity Culture Are you tired of seeing your papier-mâché network defenses torn to shreds? Do you wish you could fake your way through yet another audit, but fear being exposed by a data leak? Are hoodlums in Adidas clothing using your IT infrastructure as their own personal cloud? Well, tough. Cybercriminals are here to stay and your security budget isn't getting any bigger.
How to set up security in the Signal messaging app
The Signal messaging app leapt in popularity in January 2021, when WhatsApp changed its privacy policy. Following Elon Musk’s laconic call to use Signal, millions of users downloaded the app, resulting in temporary technical issues with the service. However, cybersecurity experts have known about Signal for a long time, and that’s no wonder; developers have spent years polishing the app’s privacy and security. Here’s what they have achieved and how to make Signal even more secure.
PuzzleMaker attacks with Chrome zero-day exploit chain
On April 14-15, 2021, Kaspersky technologies detected a wave of highly targeted attacks against multiple companies. Closer analysis revealed that all these attacks exploited a chain of Google Chrome and Microsoft Windows zero-day exploits. While we were not able to retrieve the exploit used for remote code execution (RCE) in the Chrome web browser, we were able to find and analyze an elevation of privilege (EoP) exploit that was used to escape the sandbox and obtain system privileges.
Lazarus covets COVID-19-related intelligence
As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that actors, such as the Lazarus group, are going after intelligence that could help these efforts by attacking entities related to COVID-19 research. While tracking the Lazarus group’s continuous campaigns targeting various industries, we discovered that they recently went after COVID-19-related entities.
The future of cyberconflicts
Opinion Opinion minute read The ever-increasing role of technology in every aspect of our society has turned cybersecurity into a major sovereignty issue for all states. Due to their asymmetrical nature, offensive cyber-capabilities have been embraced by many countries that wouldn’t otherwise have the resources to compete on a military or economic level with the most powerful nations of the world.
IAmTheKing and the SlothfulMedia malware family
On October 1, 2020, the DHS CISA agency released information about a malware family called SlothfulMedia, which they attribute to a sophisticated threat actor. We have been tracking this set of activity through our private reporting service, and we would like to provide the community with additional context. In June 2018, we published the first report on a new cluster of activities that we named IAmTheKing, based on malware strings discovered in a malware sample from an unknown family.
DeathStalker targeting law firms and financial services -
Kaspersky has lifted the veil on APT group DeathStalker. DeathStalker is a mercenary group that targets small and medium-sized law and financial services firms. Kaspersky believes that it is a hacking-for-hire service and information broker. It has now been linked with attacks in several countries and three scripting language-based toolchains. The detailed overview of DeathStalker has been written by Kaspersky researchers Ivan Kwiatkowski, Pierre Delcher, Maher Yamout.
Les ransomwares doivent faire prendre conscience aux entreprises qu’elles sont largement exposées au risque Cyber
Les ransomwares doivent faire prendre conscience aux entreprises qu’elles sont largement exposées au risque Cyber Ces dernières semaines ont mis en lumière de nombreuses attaques de ransomwares ciblant des entreprises, de tout secteur d’activité, de toute taille, et ce, partout dans le monde.
APT trends report Q2 2020
For more than three years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They are designed to highlight the significant events and findings that we feel people should be aware of.
Lazarus on the hunt for big game
We may only be six months in, but there’s little doubt that 2020 will go down in history as a rather unpleasant year. In the field of cybersecurity, the collective hurt mostly crystallized around the increasing prevalence of targeted ransomware attacks. By investigating a number of these incidents and through discussions with some of our trusted industry partners, we feel that we now have a good grasp on how the ransomware ecosystem is structured.
Holy water: ongoing targeted water-holing attack in Asia
On December 4, 2019, we discovered watering hole websites that were compromised to selectively trigger a drive-by download attack with fake Adobe Flash update warnings. This campaign has been active since at least May 2019, and targets an Asian religious and ethnic group.
Ransomware world in 2021: who, how and why
As the world marks the second Anti-Ransomware Day, there’s no way to deny it: ransomware has become the buzzword in the security community. And not without good reason. The threat may have been around a long time, but it’s changed. Year after year, the attackers have grown bolder, methodologies have been refined and, of course, systems have been breached. Yet, much of the media attention ransomware gets is focused on chronicling which companies fall prey to it.
Lifting the veil on DeathStalker, a mercenary triumvirate
State-sponsored threat actors and sophisticated attacks are often in the spotlight. Indeed, their innovative techniques, advanced malware platforms and 0-day exploit chains capture our collective imagination. Yet these groups still aren’t likely to be a part of the risk model at most companies, nor should they be. Businesses today are faced with an array of much more immediate threats, from ransomware and customer information leaks, to competitors engaging in unethical business practices.
The leap of a Cycldek-related threat actor
Introduction In the nebula of Chinese-speaking threat actors, it is quite common to see tools and methodologies being shared. One such example of this is the infamous “DLL side-loading triad”: a legitimate executable, a malicious DLL to be sideloaded by it, and an encoded payload, generally dropped from a self-extracting archive. Initially considered to be the signature of LuckyMouse, we observed other groups starting to use similar “triads” such as HoneyMyte.
BlackOasis APT and new targeted attacks leveraging zero-day exploit
More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service. Contact: intelreports@kaspersky.com Introduction Kaspersky Lab has always worked closely with vendors to protect users. As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Ivan
Contact Ivan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack