Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Mikhail Sytnik
How to download, install, and update Kaspersky apps for Android
Our security solutions for Android are temporarily unavailable in the official Google Play store. To install Kaspersky apps on Android devices, we recommend using alternative app stores. You can also install our apps manually from the APK files available on our website or in your My Kaspersky account. This post gives in-depth instructions for installing Kaspersky on Android in 2025.
Hype and confusion surrounding quantum computers in cryptography
Quantum computers remain a highly exotic technology, used by a very small number of companies for very specific computational tasks. But if you search for “quantum computer news”, you might get the impression that all the major IT players have already armed themselves with quantum technology, and that any day now hackers will start using it to crack encrypted communications and manipulate digital signatures.
New gadgets unveiled at CES 2025, and their impact on security
One of the world’s premier tech events traditionally takes place every year in Las Vegas in early January. Sure, the Consumer Electronics Show (CES) pays attention to cybersecurity, but by no means is it top of the agenda. Looking for a giant monitor or AI washing machine? You’re in luck! Smart home protection against hackers?
Legitimate Chrome extensions are stealing Facebook passwords
Right after Christmas, news broke of a multi-stage attack targeting developers of popular Chrome extensions. Ironically, the biggest-name target was a cybersecurity extension created by Cyberhaven — compromised just before the holidays (we’d previously warned about such risks). As the incident investigation unfolded, the list grew to include no fewer than 35 popular extensions, with a combined total of 2.5 million installations.
Passwords 101: don’t enter your passwords just anywhere they’re asked for
Whenever you’re asked to log in to an online service, verify your identity, or download a document through a link, you’re usually required to enter your username and password. This is so common that most of us do it automatically without thinking twice. However, scammers can trick you into giving them passwords for your email, government service websites, banking services, or social networks by mimicking the service’s login form on their own (third-party) website.
Trusted-relationship cyberattacks and their prevention
The old saying, “A chain is only as strong as its weakest link”, directly applies to enterprise cybersecurity. Businesses these days often rely on dozens or even hundreds of suppliers and contractors, who, in turn, use the services and products of yet more contractors and suppliers. And when these chains involve not raw materials but complex IT products, ensuring their security becomes significantly more challenging.
BadRAM: attack using malicious RAM module
Researchers from three European universities recently demonstrated the so-called BadRAM attack. This attack is made possible because of a vulnerability in AMD EPYC processors, and primarily threatens cloud-solution providers and virtualization systems. In the worst-case scenario, the vulnerability could be used to compromise data from highly secure virtual machines. However, implementing this scenario in practice would be quite difficult.
How vulnerable Ecovacs robot vacuums are being hacked
Imagine: you get up in the night for a glass of water, walk across the unlit landing, when out of the darkness a voice starts yelling at you. Not nice, you’d surely agree. But that’s the new reality for owners of vulnerable robot vacuums, which can be commanded by hackers to turn from domestic servants into foul-mouthed louts. And that’s not all: hackers can also control the robot remotely and access its live camera feed.
Crypto scam: seed phrases shared publicly
“I have a question. I have USDT stored in my wallet, and I have the seed phrase. How to transfer my funds to another wallet?” — we found a comment like this under a finance-related video on YouTube. And the seed phrase was revealed in full in the comment. This looked suspicious: even a complete cryptocurrency beginner should know better than to share their seed phrase with the entire world. We were wary, and for a good reason — this comment turned out to be a scam.
Kaspersky’s Safe Travel Guide
Holiday season is a wonderful time — one when all the usual worries take a back seat. On vacation we focus on sights and local culture, and try in every possible way to remove ourselves from our usual routines. But being away from home brings with it some travel concerns to keep in mind; for example, how should one properly use transportation in another country so as not to fall for local scammers’ tricks; also: who should one call in an emergency?
Which IT, and IoT devices are most vulnerable
Infosec teams know all about cyberattacks on servers and desktop computers, and the optimal protective practices are both well-known and well-developed. But things get a lot more complicated when it comes to less “visible” devices — such as routers, printers, medical equipment, and video surveillance cameras. Yet they too are often connected to the organization’s general network along with servers and workstations.
Phishing-as-a-Service through Telegram bot
Researchers have discovered a phishing marketplace called ONNX Store, which gives cybercriminals access to tools for hijacking Microsoft 365 accounts, including a means for bypassing two-factor authentication (2FA). This enables threat actors to crank out phishing attacks on both Microsoft 365 and Office 365 email accounts. Corporate information security teams should be aware of this threat and tool up with anti-phishing protection.
How to protect yourself from surveillance that uses AirTag beacons or similar devices (on either Android or iOS)
Small Bluetooth tags for finding lost items are a godsend for frequent travelers and simply forgetful people. The coin-sized devices contain a battery and a Bluetooth Low Energy (BLE) transmitter, and a smartphone app allows you to determine the beacon’s location to within a few centimeters.
New LianSpy spyware targets Android smartphones Original
Spyware is a dangerous tool that can be used to selectively monitor specific victims. Often the victims are employees in a single company, or residents in a single country. The new mobile spyware, which we discovered and dubbed LianSpy, targets — for now — users of Android smartphones in Russia, but the unconventional approaches it employs could potentially be applied in other regions as well. How it works and how to guard against this new threat is the topic of this post. What is LianSpy?
What is an adversary-in-the-middle attack, and how is it used in phishing?
The increasing use of both multi-factor authentication (MFA) and cloud services in organizations has forced cybercriminals to update their tools and tactics. On the one hand, they no longer need to penetrate a company’s internal network or use malware to steal information and conduct fraudulent schemes. It’s enough to gain access to cloud services — such as Microsoft 365 email or MOVEit file storage — through legitimate accounts.
How to guard against fake Wi-Fi hotspots on planes and at airports
Evil twins — malicious Wi-Fi hotspots that intercept user data — are back in vogue. While the threat itself is nothing new (we’ve covered it before), fake Wi-Fi incidents have recently reached new heights — literally. In a particularly interesting case from Australia, a passenger was arrested for setting up evil twins both at the airport and on board the plane during the flight.
Phase-by-phase SIEM implementation
We’ve already written about how, since a medium-sized company is an attractive target for cybercriminals, it can’t be protected with just basic tools; it needs layered defenses. And a security information and event management (SIEM) system is a logical choice for a main center for such a multi-protection-layer system. But how should a full-fledged SIEM in a company with 500 to 3000 employees be implemented?
Fake leaks of passwords and seed phrases are scammers' new weapons Original
We spent several months researching a new and very smart crypto scam, where the victims were slowly, craftily encouraged to install a malicious crypto management app. However, the ones who got scammed were only nominally victims, because the operators, like some digital Robin Hoods, targeted… other pilferers. Take an in-depth look at this scam with us and learn how to protect your cryptocurrency.
What kind of education does a cybersecurity specialist need?
The labor market has long experienced a shortage of cybersecurity experts. Often, companies in need of information-security specialists can’t find any – at least, those with specialized formal education and the necessary experience.
What kind of education does a cybersecurity specialist need?
The labor market has long experienced a shortage of cybersecurity experts. Often, companies in need of information-security specialists can’t find any – at least, those with specialized formal education and the necessary experience.
Crypto wallet drainer: what it is and how to defend against it Original
A new category of malicious tools has been gaining popularity with crypto scammers lately: crypto wallet drainers. This post will explain what crypto drainers are, how they work, what makes them dangerous — even for experienced users — and how to defend against them. What a crypto (wallet) drainer is A crypto drainer — or crypto wallet drainer — is a type of malware that’s been targeting crypto owners since it first appeared just over a year ago.
Scammers pretend to be financial regulators
scam Scammers are sending e-mails under the guise of government agencies to coax personal data and money out of users. Olga Svistunova November 10, 2022 Online fraud knows no bounds. Cybercriminals are adapting — not always successfully — their usual schemes for new countries. To wheedle out victims’ personal and banking data, they send e-mails purporting to be from, among others, online marketplaces, video streaming services and, of course, government agencies.
How to glean passwords using thermal imaging
In at least two of our previous posts, we touched upon the topic of side-channel attacks. These are attacks in which a certain confidential information (a password, encryption key, or just data that needs securing) is extracted in a certain non-trivial way. For example, instead of directly cracking an encryption system, an attacker can reconstruct the key based on ever so slight changes in the power consumption of the device.
CVE-2022-35737 vulnerability in SQLite
In October 2022, researchers at Trail of Bits published a detailed breakdown of an SQLite DBMS vulnerability. The article discusses possible attacks via CVE-2022-35737, with consequences ranging from a simple application crash to arbitrary code execution. The rather trivial bug in the SQLite code is interesting and potentially dangerous for two reasons. Firstly, it has been in SQLite since October 2000 – from almost the very beginning of development of this open source software.
Why you shouldn’t download programs from YouTube links
Earlier this month, Kaspersky experts published a detailed report on a threat they’ve called OnionPoison. They discovered malicious code being distributed through YouTube video. The video advertised using Tor Browser for private browsing. This browser is a modified version of the Firefox browser — with maximum privacy settings. But its most important feature is that it can redirect all user data through The Onion Router (hence the name Tor) network.
How to find out if there’s a virus on your computer?
malware What signs may indicate that a device is infected or being attacked by a hacker. Hugh Aver October 26, 2022 As a rule, cybercriminals try conduct their attacks stealthily. After all, the longer they remain undetected by the victims, the more likely the criminals will achieve their goals. However, they don’t always succeed in hiding their activity. Often, based on a number of signs, you can tell that something is wrong with your computer or smartphone.
Top-5 cryptocurrency heists in history (so far)
Cryptocurrency is an ideal target for cybercriminals: there are many ways to steal it, and it’s very difficult for the victims to ever recover it. And some hackers make an absolute killing from it — getting tens, or sometimes hundreds of millions of dollars from a cryptoexchange attack. This post looks at the Top-5 biggest ever heists in the relatively short history of cryptocurrencies. And there’s a bonus at the end: an amazing story of a cryptocurrency robbery worthy of a Netflix show… 5.
What hackers hunt for
If outsiders somehow get inside your network, it won’t be pleasant — no matter what. However, you can minimize the potential damage of such a breach by thinking ahead about which assets an attacker would be most interested in and then beefing up their security. Here’s what to focus on: 1. Personal data This is one of the most sought-after types of information for cybercriminals. First, personal data (be it that of clients or employees) gives great leverage for extortion.
The history of Flash
Let’s pretend we’re back in, say, 2008. You’ve just bought a new computer with Windows XP on it, hooked it up to the internet, opened the browser, navigated to your favorite website… and found that half of it doesn’t display. “Try installing Adobe Flash,” a friend who knows all about computers advises over the phone.
Kaspersky VPN Secure Connection gets a big update
VPN applications make the digital lives of millions of users both easier and more secure. Many use the technology to change their virtual location, getting access to movies, TV shows and other media content not available in their region. A VPN also encrypts users’ internet traffic and secures data transmitted online. And some, of course, use a VPN to hide their real IP address. If for some reason you don’t have a reliable VPN yet, it’s time to consider getting one.
CVE-2022-41352 - vulnerability in Zimbra
Kaspersky experts have uncovered ongoing exploitation of the recently discovered CVE-2022-41352 vulnerability in Zimbra Collaboration software by unknown APT groups. At least one of those groups is attacking vulnerable servers in Central Asia. What is CVE-2022-41352 and why is it so dangerous? This vulnerability was found in the archive unpacking utility named cpio, which is used by the Amavis content filter, which in turn is part of the Zimbra Collaboration suite.
YoWhatsApp - an infected WhatsApp mod
Another WhatsApp modification, known as YoWhatsApp, has turned out to be malicious: it downloads the Triada Trojan to smartphones, which shows ads, secretly subscribes the user to paid content, and steals WhatsApp accounts. How did this happen and what lessons can we learn? Don’t feed crocodiles with your hand, or Simple Cybersecurity Rules Probably the most important rule of information security is to reduce your risks.
Top-4 outdated technologies
In August 2022, Japanese Minister of Digital Affairs, Taro Kono, “declared war” on old storage media such as floppy disks. The original Japanese-language document provides a simple analysis of Japanese legislation, which to this day still has nearly 1900 references to outdated storage media, most of which belong in a museum. They include ordinary floppy disks, optical recording media, common definitions like “magneto-optical drive” and even “magnetic tape”.
Alternative malware propagation methods
Logic dictates that the most reliable way to prevent a cyberincident is to stop malware from penetrating the corporate infrastructure. So, when developing an information security strategy, experts often focus on the most obvious attack vectors – like through e-mail. Most attacks do indeed start with an e-mail, but don’t forget that cybercriminals have many other malware delivery methods up their digital sleeve.
NullMixer simulates pirated software and delivers malware
Downloading pirated software is always a lottery: some get lucky, other less so: the user might end up losing even more money than they’d pay for a license. We’ve already talked a lot about various types of malware that hide under the guise of pirated games and spread through torrents. Recently, our researchers published a new study of the NullMixer dropper — another widespread threat that users may encounter if downloading unlicensed software. What are Trojan droppers?
Vulnerable Cisco updates
Among the presentations at this August’s Black Hat 2022 conference, few were of practical use to system administrators and security officers. A welcome exception was the report by Rapid7 researcher, Jacob Baines, who spoke in detail about how he’d analyzed Cisco enterprise software and found multiple vulnerabilities therein. Jacob’s findings are available as slides, in a detailed report, and as a set of utilities on GitHub.
Vulnerability in tarfile module
In September 2022, Trellix published a report on a vulnerability in the tarfile module, which is part of a standard library for the Python programming language and can be used by anyone. The vulnerability allows an arbitrary file to be written to an arbitrary folder on the hard drive, and in some cases it also allows for malicious code execution.
Have you revoked ex-employees’ access?
access Are you sure your former colleagues don’t have access to corporate data or systems? Hugh Aver September 27, 2022 How confident are you that your former employees no longer have access to corporate information? As practice shows, this isn’t an irrelevant question. Recently, our colleagues analyzed how well small and medium-sized businesses (SMBs) are prepared for cyberincidents in an unpredictable world.
Agent Tesla trojan in spam
We’re witnessing a new malicious mass-mailing campaign aimed at company employees using Agent Tesla spyware attachments. This time, when creating their e-mail messages, the attackers pay special attention to detail — so that their messages can really be mistaken for regular business e-mails with attached documents. Their final goal is to trick the recipient into opening the attached archive to then execute the malicious file. Why is this malicious mailing special?
The Harly Trojan subscriber in Google Play apps
It’s common to find all sorts of malware lurking under what seem to be harmless apps on the official Google Play store. Unfortunately, even if the platform is policed carefully, moderators can’t always catch these apps before they’re posted. One of the most popular variations of this kind of malware is Trojan subscribers, which sign up for paid services without the user’s knowledge. We’ve previously written about the most common families of this kind of Trojans. Here we’ll tell you about another.
Global Transparency Initiative update: September 2022
Businesses are showing increased interest in having confidence in their technology providers, with more than 70% of IT decision makers declaring a strong importance of having ongoing assurance that the IT solutions they use are operating in a known and trusted state. This is why we decided to open two new trust-building facilities for the company’s partners and customers in Italy and in the Netherlands.
Kaspersky EDR optimum updated
Naming products and services – and also their many different functions and features – in the infosec domain is, in a word, tricky. Why? Complexity… Cybersecurity: it’s not a one-dimensional object like, say, a boat. There are different sized boats, but besides things like that, a boat is mostly always a boat.
RedLine stealer spreads on YouTube disguised as game cheats
gamers The RedLine Trojan stealer spreads under the guise of cheats for popular games and posts videos on victims’ YouTube channels with a link to itself in the description. John Snow September 15, 2022 The video games market, with its 3.2-billion-strong audience worldwide, attracts every kind of business under the sun. All sorts of computer devices specially created for gamers are already par for the course. But it went beyond that a long time ago.
Microsoft patches 64 vulnerabilities, one being exploited
Microsoft’s vulnerability hunters presented a fresh catch: 64 vulnerabilities in various products and services, five of which are critical. Two vulnerabilities were publicly disclosed before the patch was released (which technically makes them zero-days), and one is actively exploited by some attackers. As usual, we recommend installing updates with no delays. In the meantime, we will briefly talk about those vulnerabilities that deserve special attention.
A Genshin Impact driver weaponized as an attack tool
Released on PC and consoles in September 2020, the action-adventure video game Genshin Impact was created by miHoYo Limited of China. The Windows version comes with a module combating gaming cheats, which incorporates a driver named mhyprot2.sys. It provides the game’s defense mechanism with broad system privileges, and has a digital signature to prove its rights. The game needs this for detecting and blocking tools that help circumvent built-in restrictions.
Browser extensions: more dangerous than you think
Each of us has probably installed some kind of browser extension at least once: an ad blocker, an online translator, a spellchecker or something else. However, few of us stop to think: is it safe? Unfortunately, these seemingly innocuous mini-apps can be far more dangerous than they seem at first glance. Let’s see what might go wrong. For this, we shall use data from our experts’ recent report on the most common families of malicious browser extensions. What are extensions and what do they do?
Vulnerability in Zoom for macOS
In March 2020, as the whole world was just getting to grips with working remotely, a vulnerability was discovered in the installer of Zoom — one of the world’s prime remote communication tools — allowing arbitrary code execution on Apple computers. Zoom fixed the vulnerability… almost. Fast-forward to August 2022, and a similar hole has been found (in terms of both location and exploitation consequences).
Findings and tips from the GERT report
incident response Highlights from “The nature of cyber incidents” report by the Kaspersky GERT team. Kaspersky Team September 6, 2022 Our Kaspersky Global Emergency Response Team (GERT) has analyzed the incidents our experts investigated in 2021 to prepare a detailed report. You can get the full report by filling out the form on the Securelist blog. Meanwhile here, we’d like to share the main findings and top recommendations of the response experts.
How to distribute SOC tasks
Advanced cyberthreats keep throwing up increasingly challenging tasks for enterprise security operations centers (SOCs) to contend with. Organizations are also having to deal with internal problems, such as a lack of security talent, professional burnout, and tight budgets. A typical SOC consists of analysts who take the brunt of the alert triage and incident analysis, experts who analyze the most advanced threats, threat intelligence specialists, and a management team.
Is the social network Poparazzi a threat to privacy?
In a world already chock full of social networks, new services have to fight for user attention and come up with something original. In doing so, the creators of new platforms sometimes forget about basic features such as privacy and security. A striking example of this was the security fiasco with the social network Clubhouse, which became a smash hit in the spring of 2021.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Mikhail
Contact Mikhail, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack