Allarmi cyber, 80 attacchi al giorno contro l’Italia. Serve più difesa digitale
@Notizie dall'Italia e dal mondo
Non è più il tempo di soli sistemi anti missile o bunker sotto terra. La nuova guerra si combatte a colpi di attacchi ibridi al fine di destabilizzare le infrastrutture sociali di un Paese, per questa ragione va approntata una difesa digitale a 360 gradi non più
Notizie dall'Italia e dal mondo reshared this.
Attacco al Gruppo Ferrovie dello Stato e Almaviva SpA: cosa sappiamo sul data leak
@Informatica (Italy e non Italy 😁)
Un threat actor negli scorsi giorni ha rivendicato e diffuso online 2,3 TB di dati interni esfiltrati da infrastrutture che contengono documenti di Almaviva SpA e Gruppo FS. La nota di Almaviva: "immediatamente attivate le procedure di
reshared this
Mattarella sotto attacco, Gelli riabilitato da Nordio. Come reagire?
@Giornalismo e disordine informativo
articolo21.org/2025/11/mattare…
Ripetitività ossessiva di Teleradio Meloni sul cosiddetto ‘Caso Mattarella’, liquidato come ‘ridicolo’ dal Quirinale. Al contrario passata sotto silenzio l’incredibile,
Giornalismo e disordine informativo reshared this.
L’UE lancia il pacchetto per la semplificazione digitale con risparmi fino a 1 miliardo di euro all’anno
L'articolo proviene da #Euractiv Italia ed è stato ricondiviso sulla comunità Lemmy @Intelligenza Artificiale
Mercoledì la Commissione europea ha presentato un piano per ridurre la burocrazia nelle leggi sulla privacy e sul
Intelligenza Artificiale reshared this.
Poliversity - Università ricerca e giornalismo reshared this.
per chi si domandasse cos'è la scrittura asemica, due link rapidissimi:
it.wikipedia.org/wiki/Scrittur…
reshared this
Danimarca: crollano i socialdemocratici, a Copenaghen vince la sinistra
@Notizie dall'Italia e dal mondo
A Copenaghen ed in altre città della Danimarca crollano i socialdemocratici, puniti per la loro svolta a destra, e avanzano diversi partiti di sinistra più o meno radicale
L'articolo Danimarca: crollano i socialdemocratici, a Copenaghen vince la sinistra proviene da
Notizie dall'Italia e dal mondo reshared this.
La P2 continua ad accompagnare le sorti della nostra democrazia
@Giornalismo e disordine informativo
articolo21.org/2025/11/la-p2-c…
Probabilmente il ministro della Giustizia Carlo Nordio è l’unico magistrato a non conoscere il Piano di Rinascita Democratica di Licio Gelli. Eppure tra i tanti incarichi ricoperti da
Giornalismo e disordine informativo reshared this.
Truffe online sfruttano la condivisione schermo di WhatsApp: come difendersi
@Informatica (Italy e non Italy 😁)
Una nuova tattica ingannevole sta inducendo le persone a condividere lo schermo del proprio telefono durante una videochiamata su WhatsApp per rubare dati, identità e il loro denaro. Un meccanismo di truffa particolarmente efficace da cui è
Informatica (Italy e non Italy 😁) reshared this.
Cloudflare si scusa e spiega cos'è successo ieri: il peggior down dal 2019
Cloudflare ha spiegato la causa della grave interruzione globale dei servizi: una modifica alle autorizzazioni di un database ha generato file di configurazione corrotti nel sistema di Bot Management, mandando in crash i proxy e rendendo irraggiungib…Hardware Upgrade
Trump tra insulti e aggressività, gli attacchi a giornalisti e rivali
[quote]NEW YORK – Offese rivolte alle donne, alle persone con disabilità e anche ai suoi avversari. Gli insulti e le umiliazioni sembrano essere parte integrante della comunicazione del presidente degli…
L'articolo Trump tra insulti e aggressività, gli attacchi a giornalisti e rivali su
Manovra, si tratta. La Lega rilancia sulle pensioni. Ipotesi condono “largo” fino al 2025
Alle 16 il termine per l'indicazione degli emendamenti segnalati, cioè quelli per i quali i gruppi chiedono un esame in via prioritaria
L'articolo Manovra, si tratta. La Lega rilancia sulle pensioni. Ipotesi condono “largo” fino al 2025 su Lumsanews.
Trump tra insulti e aggressività, gli attacchi a giornalisti e rivali (Il Fatto del giorno)
[quote]a cura di Irene Di Castelnuovo
L'articolo Trump tra insulti e aggressività, gli attacchi a giornalisti e rivali (Il Fatto del giorno) su lumsanews.it/trump-tra-insulti…
Space&Underwater, il 3 dicembre la Conferenza a Roma. Tra gli speaker Samantha Cristoforetti
@Informatica (Italy e non Italy 😁)
Nel contesto geopolitico come affrontare e vincere le sfide per la Cybersecurity nello Spazio e nella Dimensione Subacquea? Sono due domìni sempre più strategici e interconnessi da cui dipendono sia la continuità delle transazioni
Informatica (Italy e non Italy 😁) reshared this.
Difesa comune, perché l’innovazione non è più un’opzione
@Notizie dall'Italia e dal mondo
L’incontro promosso da Sopra Steria Italia e dall’Ambasciata di Francia a Palazzo Farnese ha mostrato come la difesa europea stia vivendo una stagione in cui innovazione, governance dei dati e capacità industriali procedono insieme. La discussione tra istituzioni italiane e francesi, vertici militari e
Notizie dall'Italia e dal mondo reshared this.
Medici per i diritti umani denuncia uccisioni prigionieri di Gaza nelle carceri israeliane
@Notizie dall'Italia e dal mondo
Il rapporto, "Deaths of Palestinians in Israeli custody: enforced disappearances, systematic killings and cover-ups", descrive una macchina repressiva che con l’inizio dell'offensiva contro Gaza ha acquisito una violenza
Notizie dall'Italia e dal mondo reshared this.
Klimt da record, il ritratto di Elizabeth Lederer venduto per 236 milioni di dollari
[quote]NEW YORK – La produzione artistica di Gustav Klimt segna un nuovo primato. Il ritratto di Elizabeth Lederer, opera del pittore austriaco, è stato battuto da Sotheby’s per 236 milioni…
L'articolo Klimt da record, il ritratto di Elizabeth Lederer venduto per 236 milioni
Pioggia di droni russi Ucraina. Zelensky vola in Turchia, Mosca allontana un piano di pace
[quote]KIEV – Sale ancora il bilancio dei morti nel massiccio attacco russo di stanotte, 19 novembre, in Ucraina. Nella città di Ternopil il conteggio delle vittime è arrivato a sedici,…
L'articolo Pioggia di droni russi Ucraina. Zelensky vola in Turchia, Mosca
Anna Pompili al Festival Margherita per ricordare l’eredità di Etienne Emile Baulieu
Auditorium Centro Culturale Roberto Gritti – Biblioteca di Ranica, Bergamo
Sabato 22 novembre 2025 – ore 21:00
Nell’ambito del Festival Margherita – Nessun dogma sotto questo cielo, giunto alla sua quarta edizione e dedicato a Margherita Hack, si terrà la presentazione-dialogo “L’eredità di Etienne Emile Baulieu. L’inventore della pillola abortiva RU486”. A portare il contributo dell’Associazione Luca Coscioni sarà Anna Pompili, ginecologa e consigliera generale dell’Associazione, da sempre impegnata nella promozione dei diritti sessuali e riproduttivi. Insieme a lei interverranno il ginecologo Corrado Melega, tra i primi in Italia ad aver utilizzato la RU486.
Sarà occasione per approfondire l’impatto della RU486 in Italia e sulle battaglie ancora in corso per garantirne un accesso realmente libero e sicuro.
L'articolo Anna Pompili al Festival Margherita per ricordare l’eredità di Etienne Emile Baulieu proviene da Associazione Luca Coscioni.
IT threat evolution in Q3 2025. Mobile statistics
IT threat evolution in Q3 2025. Non-mobile statistics
The quarter at a glance
In the third quarter of 2025, we updated the methodology for calculating statistical indicators based on the Kaspersky Security Network. These changes affected all sections of the report except for the statistics on installation packages, which remained unchanged.
To illustrate the differences between the reporting periods, we have also recalculated data for the previous quarters. Consequently, these figures may significantly differ from the previously published ones. However, subsequent reports will employ this new methodology, enabling precise comparisons with the data presented in this post.
The Kaspersky Security Network (KSN) is a global network for analyzing anonymized threat information, voluntarily shared by users of Kaspersky solutions. The statistics in this report are based on KSN data unless explicitly stated otherwise.
The quarter in numbers
According to Kaspersky Security Network, in Q3 2025:
- 47 million attacks utilizing malware, adware, or unwanted mobile software were prevented.
- Trojans were the most widespread threat among mobile malware, encountered by 15.78% of all attacked users of Kaspersky solutions.
- More than 197,000 malicious installation packages were discovered, including:
- 52,723 associated with mobile banking Trojans.
- 1564 packages identified as mobile ransomware Trojans.
Quarterly highlights
The number of malware, adware, or unwanted software attacks on mobile devices, calculated according to the updated rules, totaled 3.47 million in the third quarter. This is slightly less than the 3.51 million attacks recorded in the previous reporting period.
Attacks on users of Kaspersky mobile solutions, Q2 2024 — Q3 2025 (download)
At the start of the quarter, a user complained to us about ads appearing in every browser on their smartphone. We conducted an investigation, discovering a new version of the BADBOX backdoor, preloaded on the device. This backdoor is a multi-level loader embedded in a malicious native library, librescache.so, which was loaded by the system framework. As a result, a copy of the Trojan infiltrated every process running on the device.
Another interesting finding was Trojan-Downloader.AndroidOS.Agent.no, which was embedded in mods for messaging and other apps. It downloaded Trojan-Clicker.AndroidOS.Agent.bl onto the device. The clicker received a URL from its server where an ad was being displayed, opened it in an invisible WebView window, and used machine learning algorithms to find and click the close button. In this way, fraudsters exploited the user’s device to artificially inflate ad views.
Mobile threat statistics
In the third quarter, Kaspersky security solutions detected 197,738 samples of malicious and unwanted software for Android, which is 55,000 more than in the previous reporting period.
Detected malicious and potentially unwanted installation packages, Q3 2024 — Q3 2025 (download)
The detected installation packages were distributed by type as follows:
Detected mobile apps by type, Q2* — Q3 2025 (download)
* Changes in the statistical calculation methodology do not affect this metric. However, data for the previous quarter may differ slightly from previously published figures due to a retrospective review of certain verdicts.
The share of banking Trojans decreased somewhat, but this was due less to a reduction in their numbers and more to an increase in other malicious and unwanted packages. Nevertheless, banking Trojans, still dominated by Mamont packages, continue to hold the top spot. The rise in Trojan droppers is also linked to them: these droppers are primarily designed to deliver banking Trojans.
Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q2 — Q3 2025 (download)
* The total may exceed 100% if the same users experienced multiple attack types.
Adware leads the pack in terms of the number of users attacked, with a significant margin. The most widespread types of adware are HiddenAd (56.3%) and MobiDash (27.4%). RiskTool-type unwanted apps occupy the second spot. Their growth is primarily due to the proliferation of the Revpn module, which monetizes user internet access by turning their device into a VPN exit point. The most popular Trojans predictably remain Triada (55.8%) and Fakemoney (24.6%). The percentage of users who encountered these did not undergo significant changes.
TOP 20 most frequently detected types of mobile malware
Note that the malware rankings below exclude riskware and potentially unwanted software, such as RiskTool or adware.
| Verdict | %* Q2 2025 | %* Q3 2025 | Difference in p.p. | Change in ranking |
| Trojan.AndroidOS.Triada.ii | 0.00 | 13.78 | +13.78 | |
| Trojan.AndroidOS.Triada.fe | 12.54 | 10.32 | –2.22 | –1 |
| Trojan.AndroidOS.Triada.gn | 9.49 | 8.56 | –0.93 | –1 |
| Trojan.AndroidOS.Fakemoney.v | 8.88 | 6.30 | –2.59 | –1 |
| Backdoor.AndroidOS.Triada.z | 3.75 | 4.53 | +0.77 | +1 |
| DangerousObject.Multi.Generic. | 4.39 | 4.52 | +0.13 | –1 |
| Trojan-Banker.AndroidOS.Coper.c | 3.20 | 2.86 | –0.35 | +1 |
| Trojan.AndroidOS.Triada.if | 0.00 | 2.82 | +2.82 | |
| Trojan-Dropper.Linux.Agent.gen | 3.07 | 2.64 | –0.43 | +1 |
| Trojan-Dropper.AndroidOS.Hqwar.cq | 0.37 | 2.52 | +2.15 | +60 |
| Trojan.AndroidOS.Triada.hf | 2.26 | 2.41 | +0.14 | +2 |
| Trojan.AndroidOS.Triada.ig | 0.00 | 2.19 | +2.19 | |
| Backdoor.AndroidOS.Triada.ab | 0.00 | 2.00 | +2.00 | |
| Trojan-Banker.AndroidOS.Mamont.da | 5.22 | 1.82 | –3.40 | –10 |
| Trojan-Banker.AndroidOS.Mamont.hi | 0.00 | 1.80 | +1.80 | |
| Trojan.AndroidOS.Triada.ga | 3.01 | 1.71 | –1.29 | –5 |
| Trojan.AndroidOS.Boogr.gsh | 1.60 | 1.68 | +0.08 | 0 |
| Trojan-Downloader.AndroidOS.Agent.nq | 0.00 | 1.63 | +1.63 | |
| Trojan.AndroidOS.Triada.hy | 3.29 | 1.62 | –1.67 | –12 |
| Trojan-Clicker.AndroidOS.Agent.bh | 1.32 | 1.56 | +0.24 | 0 |
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.
The top positions in the list of the most widespread malware are once again occupied by modified messaging apps Triada.ii, Triada.fe, Triada.gn, and others. The pre-installed backdoor Triada.z ranked fifth, immediately following Fakemoney – fake apps that collect users’ personal data under the guise of providing payments or financial services. The dropper that landed in ninth place, Agent.gen, is an obfuscated ELF file linked to the banking Trojan Coper.c, which sits immediately after DangerousObject.Multi.Generic.
Region-specific malware
In this section, we describe malware that primarily targets users in specific countries.
| Verdict | Country* | %** |
| Trojan-Dropper.AndroidOS.Hqwar.bj | Turkey | 97.22 |
| Trojan-Banker.AndroidOS.Coper.c | Turkey | 96.35 |
| Trojan-Dropper.AndroidOS.Agent.sm | Turkey | 95.10 |
| Trojan-Banker.AndroidOS.Coper.a | Turkey | 95.06 |
| Trojan-Dropper.AndroidOS.Agent.uq | India | 92.20 |
| Trojan-Banker.AndroidOS.Rewardsteal.qh | India | 91.56 |
| Trojan-Banker.AndroidOS.Agent.wb | India | 85.89 |
| Trojan-Dropper.AndroidOS.Rewardsteal.ab | India | 84.14 |
| Trojan-Dropper.AndroidOS.Banker.bd | India | 82.84 |
| Backdoor.AndroidOS.Teledoor.a | Iran | 81.40 |
| Trojan-Dropper.AndroidOS.Hqwar.gy | Turkey | 80.37 |
| Trojan-Dropper.AndroidOS.Banker.ac | India | 78.55 |
| Trojan-Ransom.AndroidOS.Rkor.ii | Germany | 76.90 |
| Trojan-Dropper.AndroidOS.Banker.bg | India | 75.12 |
| Trojan-Banker.AndroidOS.UdangaSteal.b | Indonesia | 75.00 |
| Trojan-Dropper.AndroidOS.Banker.bc | India | 74.73 |
| Backdoor.AndroidOS.Teledoor.c | Iran | 70.33 |
* The country where the malware was most active.
** Unique users who encountered this Trojan modification in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same modification.
Banking Trojans, primarily Coper, continue to operate actively in Turkey. Indian users also attract threat actors distributing this type of software. Specifically, the banker Rewardsteal is active in the country. Teledoor backdoors, embedded in a fake Telegram client, have been deployed in Iran.
Notable is the surge in Rkor ransomware Trojan attacks in Germany. The activity was significantly lower in previous quarters. It appears the fraudsters have found a new channel for delivering malicious apps to users.
Mobile banking Trojans
In the third quarter of 2025, 52,723 installation packages for mobile banking Trojans were detected, 10,000 more than in the second quarter.
Installation packages for mobile banking Trojans detected by Kaspersky, Q3 2024 — Q3 2025 (download)
The share of the Mamont Trojan among all bankers slightly increased again, reaching 61.85%. However, in terms of the share of attacked users, Coper moved into first place, with the same modification being used in most of its attacks. Variants of Mamont ranked second and lower, as different samples were used in different attacks. Nevertheless, the total number of users attacked by the Mamont family is greater than that of users attacked by Coper.
TOP 10 mobile bankers
| Verdict | %* Q2 2025 | %* Q3 2025 | Difference in p.p. | Change in ranking |
| Trojan-Banker.AndroidOS.Coper.c | 13.42 | 13.48 | +0.07 | +1 |
| Trojan-Banker.AndroidOS.Mamont.da | 21.86 | 8.57 | –13.28 | –1 |
| Trojan-Banker.AndroidOS.Mamont.hi | 0.00 | 8.48 | +8.48 | |
| Trojan-Banker.AndroidOS.Mamont.gy | 0.00 | 6.90 | +6.90 | |
| Trojan-Banker.AndroidOS.Mamont.hl | 0.00 | 4.97 | +4.97 | |
| Trojan-Banker.AndroidOS.Agent.ws | 0.00 | 4.02 | +4.02 | |
| Trojan-Banker.AndroidOS.Mamont.gg | 0.40 | 3.41 | +3.01 | +35 |
| Trojan-Banker.AndroidOS.Mamont.cb | 3.03 | 3.31 | +0.29 | +5 |
| Trojan-Banker.AndroidOS.Creduz.z | 0.17 | 3.30 | +3.13 | +58 |
| Trojan-Banker.AndroidOS.Mamont.fz | 0.07 | 3.02 | +2.95 | +86 |
* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats.
Mobile ransomware Trojans
Due to the increased activity of mobile ransomware Trojans in Germany, which we mentioned in the Region-specific malware section, we have decided to also present statistics on this type of threat. In the third quarter, the number of ransomware Trojan installation packages more than doubled, reaching 1564.
| Verdict | %* Q2 2025 | %* Q3 2025 | Difference in p.p. | Change in ranking |
| Trojan-Ransom.AndroidOS.Rkor.ii | 7.23 | 24.42 | +17.19 | +10 |
| Trojan-Ransom.AndroidOS.Rkor.pac | 0.27 | 16.72 | +16.45 | +68 |
| Trojan-Ransom.AndroidOS.Congur.aa | 30.89 | 16.46 | –14.44 | –1 |
| Trojan-Ransom.AndroidOS.Svpeng.ac | 30.98 | 16.39 | –14.59 | –3 |
| Trojan-Ransom.AndroidOS.Rkor.it | 0.00 | 10.09 | +10.09 | |
| Trojan-Ransom.AndroidOS.Congur.cw | 15.71 | 9.69 | –6.03 | –3 |
| Trojan-Ransom.AndroidOS.Congur.ap | 15.36 | 9.16 | –6.20 | –3 |
| Trojan-Ransom.AndroidOS.Small.cj | 14.91 | 8.49 | –6.42 | –3 |
| Trojan-Ransom.AndroidOS.Svpeng.snt | 13.04 | 8.10 | –4.94 | –2 |
| Trojan-Ransom.AndroidOS.Svpeng.ah | 13.13 | 7.63 | –5.49 | –4 |
* Unique users who encountered the malware as a percentage of all Kaspersky mobile security solution users attacked by ransomware Trojans.
IT threat evolution in Q3 2025. Non-mobile statistics
IT threat evolution in Q3 2025. Mobile statistics
IT threat evolution in Q3 2025. Non-mobile statistics
Quarterly figures
In Q3 2025:
- Kaspersky solutions blocked more than 389 million attacks that originated with various online resources.
- Web Anti-Virus responded to 52 million unique links.
- File Anti-Virus blocked more than 21 million malicious and potentially unwanted objects.
- 2,200 new ransomware variants were detected.
- Nearly 85,000 users experienced ransomware attacks.
- 15% of all ransomware victims whose data was published on threat actors’ data leak sites (DLSs) were victims of Qilin.
- More than 254,000 users were targeted by miners.
Ransomware
Quarterly trends and highlights
Law enforcement success
The UK’s National Crime Agency (NCA) arrested the first suspect in connection with a ransomware attack that caused disruptions at numerous European airports in September 2025. Details of the arrest have not been published as the investigation remains ongoing. According to security researcher Kevin Beaumont, the attack employed the HardBit ransomware, which he described as primitive and lacking its own data leak site.
The U.S. Department of Justice filed charges against the administrator of the LockerGoga, MegaCortex and Nefilim ransomware gangs. His attacks caused millions of dollars in damage, putting him on wanted lists for both the FBI and the European Union.
U.S. authorities seized over $2.8 million in cryptocurrency, $70,000 in cash, and a luxury vehicle from a suspect allegedly involved in distributing the Zeppelin ransomware. The criminal scheme involved data theft, file encryption, and extortion, with numerous organizations worldwide falling victim.
A coordinated international operation conducted by the FBI, Homeland Security Investigations (HSI), the U.S. Internal Revenue Service (IRS), and law enforcement agencies from several other countries successfully dismantled the infrastructure of the BlackSuit ransomware. The operation resulted in the seizure of four servers, nine domains, and $1.09 million in cryptocurrency. The objective of the operation was to destabilize the malware ecosystem and protect critical U.S. infrastructure.
Vulnerabilities and attacks
SSL VPN attacks on SonicWall
Since late July, researchers have recorded a rise in attacks by the Akira threat actor targeting SonicWall firewalls supporting SSL VPN. SonicWall has linked these incidents to the already-patched vulnerability CVE-2024-40766, which allows unauthorized users to gain access to system resources. Attackers exploited the vulnerability to steal credentials, subsequently using them to access devices, even those that had been patched. Furthermore, the attackers were able to bypass multi-factor authentication enabled on the devices. SonicWall urges customers to reset all passwords and update their SonicOS firmware.
Scattered Spider uses social engineering to breach VMware ESXi
The Scattered Spider (UNC3944) group is attacking VMware virtual environments. The attackers contact IT support posing as company employees and request to reset their Active Directory password. Once access to vCenter is obtained, the threat actors enable SSH on the ESXi servers, extract the NTDS.dit database, and, in the final phase of the attack, deploy ransomware to encrypt all virtual machines.
Exploitation of a Microsoft SharePoint vulnerability
In late July, researchers uncovered attacks on SharePoint servers that exploited the ToolShell vulnerability chain. In the course of investigating this campaign, which affected over 140 organizations globally, researchers discovered the 4L4MD4R ransomware based on Mauri870 code. The malware is written in Go and packed using the UPX compressor. It demands a ransom of 0.005 BTC.
The application of AI in ransomware development
A UK-based threat actor used Claude to create and launch a ransomware-as-a-service (RaaS) platform. The AI was responsible for writing the code, which included advanced features such as anti-EDR techniques, encryption using ChaCha20 and RSA algorithms, shadow copy deletion, and network file encryption.
Anthropic noted that the attacker was almost entirely dependent on Claude, as they lacked the necessary technical knowledge to provide technical support to their own clients. The threat actor sold the completed malware kits on the dark web for $400–$1,200.
Researchers also discovered a new ransomware strain, dubbed PromptLock, that utilizes an LLM directly during attacks. The malware is written in Go. It uses hardcoded prompts to dynamically generate Lua scripts for data theft and encryption across Windows, macOS and Linux systems. For encryption, it employs the SPECK-128 algorithm, which is rarely used by ransomware groups.
Subsequently, scientists from the NYU Tandon School of Engineering traced back the likely origins of PromptLock to their own educational project, Ransomware 3.0, which they detailed in a prior publication.
The most prolific groups
This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. As in the previous quarter, Qilin leads by this metric. Its share grew by 1.89 percentage points (p.p.) to reach 14.96%. The Clop ransomware showed reduced activity, while the share of Akira (10.02%) slightly increased. The INC Ransom group, active since 2023, rose to third place with 8.15%.
Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period (download)
Number of new variants
In the third quarter, Kaspersky solutions detected four new families and 2,259 new ransomware modifications, nearly one-third more than in Q2 2025 and slightly more than in Q3 2024.
Number of new ransomware modifications, Q3 2024 — Q3 2025 (download)
Number of users attacked by ransomware Trojans
During the reporting period, our solutions protected 84,903 unique users from ransomware. Ransomware activity was highest in July, while August proved to be the quietest month.
Number of unique users attacked by ransomware Trojans, Q3 2025 (download)
Attack geography
TOP 10 countries attacked by ransomware Trojans
In the third quarter, Israel had the highest share (1.42%) of attacked users. Most of the ransomware in that country was detected in August via behavioral analysis.
| Country/territory* | %** | |
| 1 | Israel | 1.42 |
| 2 | Libya | 0.64 |
| 3 | Rwanda | 0.59 |
| 4 | South Korea | 0.58 |
| 5 | China | 0.51 |
| 6 | Pakistan | 0.47 |
| 7 | Bangladesh | 0.45 |
| 8 | Iraq | 0.44 |
| 9 | Tajikistan | 0.39 |
| 10 | Ethiopia | 0.36 |
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.
TOP 10 most common families of ransomware Trojans
| Name | Verdict | %* | ||
| 1 | (generic verdict) | Trojan-Ransom.Win32.Gen | 26.82 | |
| 2 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 8.79 | |
| 3 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 8.08 | |
| 4 | WannaCry | Trojan-Ransom.Win32.Wanna | 7.08 | |
| 5 | (generic verdict) | Trojan-Ransom.Win32.Agent | 4.40 | |
| 6 | LockBit | Trojan-Ransom.Win32.Lockbit | 3.06 | |
| 7 | (generic verdict) | Trojan-Ransom.Win32.Crypmod | 2.84 | |
| 8 | (generic verdict) | Trojan-Ransom.Win32.Phny | 2.58 | |
| 9 | PolyRansom/VirLock | Trojan-Ransom.Win32.PolyRansom / Virus.Win32.PolyRansom | 2.54 | |
| 10 | (generic verdict) | Trojan-Ransom.MSIL.Agent | 2.05 |
* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.
Miners
Number of new variants
In Q3 2025, Kaspersky solutions detected 2,863 new modifications of miners.
Number of new miner modifications, Q3 2025 (download)
Number of users attacked by miners
During the third quarter, we detected attacks using miner programs on the computers of 254,414 unique Kaspersky users worldwide.
Number of unique users attacked by miners, Q3 2025 (download)
Attack geography
TOP 10 countries and territories attacked by miners
| Country/territory* | %** | ||
| 1 | Senegal | 3.52 | |
| 2 | Mali | 1.50 | |
| 3 | Afghanistan | 1.17 | |
| 4 | Algeria | 0.95 | |
| 5 | Kazakhstan | 0.93 | |
| 6 | Tanzania | 0.92 | |
| 7 | Dominican Republic | 0.86 | |
| 8 | Ethiopia | 0.77 | |
| 9 | Portugal | 0.75 | |
| 10 | Belarus | 0.75 |
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.
Attacks on macOS
In April, researchers at Iru (formerly Kandji) reported the discovery of a new spyware family, PasivRobber. We observed the development of this family throughout the third quarter. Its new modifications introduced additional executable modules that were absent in previous versions. Furthermore, the attackers began employing obfuscation techniques in an attempt to hinder sample detection.
In July, we reported on a cryptostealer distributed through fake extensions for the Cursor AI development environment, which is based on Visual Studio Code. At that time, the malicious JavaScript (JS) script downloaded a payload in the form of the ScreenConnect remote access utility. This utility was then used to download cryptocurrency-stealing VBS scripts onto the victim’s device. Later, researcher Michael Bocanegra reported on new fake VS Code extensions that also executed malicious JS code. This time, the code downloaded a malicious macOS payload: a Rust-based loader. This loader then delivered a backdoor to the victim’s device, presumably also aimed at cryptocurrency theft. The backdoor supported the loading of additional modules to collect data about the victim’s machine. The Rust downloader was analyzed in detail by researchers at Iru.
In September, researchers at Jamf reported the discovery of a previously unknown version of the modular backdoor ChillyHell, first described in 2023. Notably, the Trojan’s executable files were signed with a valid developer certificate at the time of discovery.
The new sample had been available on Dropbox since 2021. In addition to its backdoor functionality, it also contains a module responsible for bruteforcing passwords of existing system users.
By the end of the third quarter, researchers at Microsoft reported new versions of the XCSSET spyware, which targets developers and spreads through infected Xcode projects. These new versions incorporated additional modules for data theft and system persistence.
TOP 20 threats to macOS
Unique users* who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS (download)
* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.
The PasivRobber spyware continues to increase its activity, with its modifications occupying the top spots in the list of the most widespread macOS malware varieties. Other highly active threats include Amos Trojans, which steal passwords and cryptocurrency wallet data, and various adware. The Backdoor.OSX.Agent.l family, which took thirteenth place, represents a variation on the well-known open-source malware, Mettle.
Geography of threats to macOS
TOP 10 countries and territories by share of attacked users
| Country/territory | %* Q2 2025 | %* Q3 2025 |
| Mainland China | 2.50 | 1.70 |
| Italy | 0.74 | 0.85 |
| France | 1.08 | 0.83 |
| Spain | 0.86 | 0.81 |
| Brazil | 0.70 | 0.68 |
| The Netherlands | 0.41 | 0.68 |
| Mexico | 0.76 | 0.65 |
| Hong Kong | 0.84 | 0.62 |
| United Kingdom | 0.71 | 0.58 |
| India | 0.76 | 0.56 |
IoT threat statistics
This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.
In Q3 2025, there was a slight increase in the share of devices attacking Kaspersky honeypots via the SSH protocol.
Distribution of attacked services by number of unique IP addresses of attacking devices (download)
Conversely, the share of attacks using the SSH protocol slightly decreased.
Distribution of attackers’ sessions in Kaspersky honeypots (download)
TOP 10 threats delivered to IoT devices
Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download)
In the third quarter, the shares of the NyaDrop and Mirai.b botnets significantly decreased in the overall volume of IoT threats. Conversely, the activity of several other members of the Mirai family, as well as the Gafgyt botnet, increased. As is typical, various Mirai variants occupy the majority of the list of the most widespread malware strains.
Attacks on IoT honeypots
Germany and the United States continue to lead in the distribution of attacks via the SSH protocol. The share of attacks originating from Panama and Iran also saw a slight increase.
| Country/territory | Q2 2025 | Q3 2025 |
| Germany | 24.58% | 13.72% |
| United States | 10.81% | 13.57% |
| Panama | 1.05% | 7.81% |
| Iran | 1.50% | 7.04% |
| Seychelles | 6.54% | 6.69% |
| South Africa | 2.28% | 5.50% |
| The Netherlands | 3.53% | 3.94% |
| Vietnam | 3.00% | 3.52% |
| India | 2.89% | 3.47% |
| Russian Federation | 8.45% | 3.29% |
The largest number of attacks via the Telnet protocol were carried out from China, as is typically the case. Devices located in India reduced their activity, whereas the share of attacks from Indonesia increased.
| Country/territory | Q2 2025 | Q3 2025 |
| China | 47.02% | 57.10% |
| Indonesia | 5.54% | 9.48% |
| India | 28.08% | 8.66% |
| Russian Federation | 4.85% | 7.44% |
| Pakistan | 3.58% | 6.66% |
| Nigeria | 1.66% | 3.25% |
| Vietnam | 0.55% | 1.32% |
| Seychelles | 0.58% | 0.93% |
| Ukraine | 0.51% | 0.73% |
| Sweden | 0.39% | 0.72% |
Attacks via web resources
The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.
TOP 10 countries that served as sources of web-based attacks
This section gives the geographical distribution of sources of online attacks (such as web pages redirecting to exploits, sites hosting exploits and other malware, and botnet C2 centers) blocked by Kaspersky products. One or more web-based attacks could originate from each unique host.
To determine the geographic source of web attacks, we matched the domain name with the real IP address where the domain is hosted, then identified the geographic location of that IP address (GeoIP).
In the third quarter of 2025, Kaspersky solutions blocked 389,755,481 attacks from internet resources worldwide. Web Anti-Virus was triggered by 51,886,619 unique URLs.
Web-based attacks by country, Q3 2025 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.
This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country/territory* | %** | ||
| 1 | Panama | 11.24 | |
| 2 | Bangladesh | 8.40 | |
| 3 | Tajikistan | 7.96 | |
| 4 | Venezuela | 7.83 | |
| 5 | Serbia | 7.74 | |
| 6 | Sri Lanka | 7.57 | |
| 7 | North Macedonia | 7.39 | |
| 8 | Nepal | 7.23 | |
| 9 | Albania | 7.04 | |
| 10 | Qatar | 6.91 | |
| 11 | Malawi | 6.90 | |
| 12 | Algeria | 6.74 | |
| 13 | Egypt | 6.73 | |
| 14 | Bosnia and Herzegovina | 6.59 | |
| 15 | Tunisia | 6.54 | |
| 16 | Belgium | 6.51 | |
| 17 | Kuwait | 6.49 | |
| 18 | Turkey | 6.41 | |
| 19 | Belarus | 6.40 | |
| 20 | Bulgaria | 6.36 |
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average, over the course of the quarter, 4.88% of devices globally were subjected to at least one web-based Malware attack.
Local threats
Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.
Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media: flash drives, camera memory cards, phones, and external drives. The statistics are based on detection verdicts from the on-access scan (OAS) and on-demand scan (ODS) modules of File Anti-Virus.
In the third quarter of 2025, our File Anti-Virus recorded 21,356,075 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky users on whose computers File Anti-Virus was triggered during the reporting period. This statistic reflects the level of personal computer infection in different countries and territories around the world.
Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country/territory* | %** | ||
| 1 | Turkmenistan | 45.69 | |
| 2 | Yemen | 33.19 | |
| 3 | Afghanistan | 32.56 | |
| 4 | Tajikistan | 31.06 | |
| 5 | Cuba | 30.13 | |
| 6 | Uzbekistan | 29.08 | |
| 7 | Syria | 25.61 | |
| 8 | Bangladesh | 24.69 | |
| 9 | China | 22.77 | |
| 10 | Vietnam | 22.63 | |
| 11 | Cameroon | 22.53 | |
| 12 | Belarus | 21.98 | |
| 13 | Tanzania | 21.80 | |
| 14 | Niger | 21.70 | |
| 15 | Mali | 21.29 | |
| 16 | Iraq | 20.77 | |
| 17 | Nicaragua | 20.75 | |
| 18 | Algeria | 20.51 | |
| 19 | Congo | 20.50 | |
| 20 | Venezuela | 20.48 |
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers local Malware threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.
On average worldwide, local Malware threats were detected at least once on 12.36% of computers during the third quarter.
freezonemagazine.com/articoli/…
Un EP di duetti che è anche una confessione intima C’è qualcosa di profondamente umano nel modo in cui Margaret Glaspy affronta la voce altrui. In The Golden Heart Protector, la cantautrice californiana trapiantata a New York trasforma l’idea del duetto in un gesto di ascolto, più che di esposizione. Non cerca la fusione spettacolare, […]
L'articolo Margaret Glaspy –
ho smesso di avere rispetto per...
ho smesso di avere rispetto per un intellettuale/editore con cui dialogavo fino...
n. non c'entra, o non del tutto, ma - a proposito di cani (del sinai) - ecco: https://t.ly/YiBWu (bisogna leggere, attenzione, tutti i riquadri ai quali il post rinvia). differx & slowforward (entropia gratis) + ko-fi (help, support!)...differx
reshared this
La differenza fondamentale di Luciano Floridi
@Politica interna, europea e internazionale
L’intelligenza artificiale non è soltanto una nuova tecnologia: è la forza che sta ridefinendo il nostro presente. Capace di apprendere, adattarsi e decidere in autonomia, l’IA sta già trasformando in profondità la nostra vita quotidiana, l’economia, le imprese, il lavoro, l’istruzione, la politica, la cultura e
Politica interna, europea e internazionale reshared this.
seguendo il link https://t.ly/YiBWu si trova un riferimento alle pratiche di #tortura messe in atto dallo stato sionista contro #prigionieri palestinesi. tra queste pratiche ce n'è una, particolarmente atroce e umiliante, che ha una terribile consonanza con quell'espressione fortiniana.
reshared this
reshared this
ilgiorno.it/milano/cronaca/stu…
quello che io chiamo un classico involucro vuoto che parla, mangia ma che non ha un'anima o niente dentro. una specie di macchina assassina. che poi è a quanto pare è lo stato finale dell'umanità. anche chi non andrebbe a uccidere la gente per strada, è infatti spesso non in grado di esprimere un pensiero coerente e logico, e tutto sommato diventa difficile da definire una piena persona. che questo coincida con il 60% di definiti analfabeti funzionali?
Studente bocconiano massacrato per 50 euro, il branco dei ‘bravi ragazzi’ dopo il raid: “Speriamo che muoia. Bro, facciamoci una storia su Instagram”
Milano, le frasi choc intercettate al commissariato: “Magari quel c... è ancora in coma, domani schiatta e ti danno omicidio”. “Ma speriamo bro, almeno non parla! Gli stacco tutti i cavi”.MARIANNA VAZZANA (Il Giorno)
Perché l’alleanza tra Nvidia, Microsoft e Anthropic non convince i mercati
L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Nvidia e Microsoft investiranno 10 e 5 miliardi di dollari in Anthropic. La startup di intelligenza artificiale fondata dai fratelli Amodei vuole accrescere ancora la sua capacità di calcolo, dopo il recente accordo con
Informatica (Italy e non Italy 😁) reshared this.
La Francia in rivolta sui pesticidi riscrive il rapporto tra scienza e potere
@Notizie dall'Italia e dal mondo
Il 7 agosto 2025, il Consiglio costituzionale francese ha dichiarato incostituzionale la cosiddetta legge Duplomb, approvata dal Parlamento un mese prima. La norma prevedeva la reintroduzione dell’acetamiprid, pesticida vietato dal 2018 per la sua comprovata
Notizie dall'Italia e dal mondo reshared this.
è sbagliato mettere sempre di mezzo la chiesa... ci fosse solo e soltanto unico cattivo... sarebbe bello. di certo gli italiani non sono estranei a questa cultura maschilista e patriarcale, di bullismo e di machismo.
credo che il primo passo per liberarsi della chiesa sia liberarsi dall'ossessione e smettere di parlarne. dopotutto qualcuno diceva che va bene che si parli di qualcuno, anche male, purché se ne parli... parlarne così è dare e sopratutto riconoscere (molto peggio) potere. è un palloncino che va lasciaro sgonfiare naturalmente, senza pestarlo continuamente. da ignorare.
dopotutto i grandi mangiatori di preti, la cosiddetta sinistra "vera", quella che oggi difende un fascista come putin, ha prodotto una cultura altrettanto tossica...
sarà pur vero che la sinistra, sempre quella "vera", non ha mai mangiato bambini, ma è pur vero che sostiene putin che lo fa, con quelli ucraini. si dice attorno ai 35'000 bambini. che oggi combattono in ucraina a fianco dei russi, con il cervello lavato, e più sfortunati dei russi.
La Francia in rivolta sui pesticidi riscrive il rapporto tra scienza e potere
@Notizie dall'Italia e dal mondo
Il 7 agosto 2025, il Consiglio costituzionale francese ha dichiarato incostituzionale la cosiddetta legge Duplomb, approvata dal Parlamento un mese prima. La norma prevedeva la reintroduzione dell’acetamiprid, pesticida vietato dal 2018 per la sua comprovata
Notizie dall'Italia e dal mondo reshared this.
Radio Dreyeckland: Hausdurchsuchung wegen eines Links war verfassungswidrig
Dalla scrivania alla scuola
pnlug.it/2025/11/19/donazione-…
Segnalato dal Grupo Linux di #Pordenone e pubblicato sulla comunità Lemmy @GNU/Linux Italia
PNLUG e Electrolux danno nuova vita alla tecnologia e all'apprendimento a Pordenone donando 50 pc all’Istituto Comprensivo Pordenone Centro
GNU/Linux Italia reshared this.
Kissing is ubiquitous among many animals, especially primates, suggesting deep evolutionary roots of the behavior.#TheAbstract
“Most drivers are unaware that San Jose’s Police Department is tracking their locations and do not know all that their saved location data can reveal about their private lives and activities."#Flock
Ministero dell'Istruzione
Dalle ore 12.00 di domani, mercoledì #19novembre, la piattaforma #CartadelDocente sarà accessibile per gli insegnanti che dispongano di eventuali residui dell’Anno Scolastico 2024/2025 e per i beneficiari di sentenze a cui è stata data esecuzione.Telegram
Roberto Rossetti reshared this.
Pare 🚲 🌞
in reply to differx • • •Dico solo che se io vedo un indirizzo ofuscato per il quale non ho neppure una vaga indicazione che mi anticipi dove porta, senza uno straccio di descrizione che mi spieghi di cosa si tratta, posso solo pensare allo SPAM; non lo seguitò mai.
Se chi pubblica pensa che non valga la pena spendere due minuti per spiegare perché il riferimento proposto può essere interessante, perché mai dovrei dedicare tempo a guardarlo?
Preferisco spenderlo per dire: rispettate chi vi legge.
@differx @poliversity
differx
in reply to Pare 🚲 🌞 • •ti ringrazio della critica, che trovo giusta: ho corretto e ampliato il post!
differx
in reply to Pare 🚲 🌞 • •@Pare 🚲 🌞 @Poliversity - Università ricerca e giornalismo
ecco il post corretto: poliverso.org/display/0477a01e…
differx
2025-11-19 10:52:13