Threat reportMalwareTL-2026-4897
Kaspersky ICS CERT: Threat landscape for industrial automation systems, Asia Q4 2025 (XWorm 'curriculum-vitae-catalina' phishing campaign, AutoCAD malware, miners, spyware)
Kaspersky ICS CERT (TL-2026-4897), also tracked as curriculum-vitae-catalina, is a medium-severity malware campaign, first published 2026-10-31. It has no confirmed attribution, affects Various Windows-based ICS/OT computers (engineering workstations, maps to 10 MITRE ATT&CK techniques (T1027, T1036, T1059.007), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4897
- Threat ID
- TL-2026-4897
- Also known as
- curriculum-vitae-catalina
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, construction, electric power, energy, engineering, industrial automation, biometrics
- Target regions
- Southeast Asia, South Asia, East Asia, 143 - Central Asia, South Caucasus
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Kaspersky ICS CERT
Malware and tooling: Backdoor.MSIL.XWorm, XWorm, xmrig, NBMiner, OneZeroMiner, XMRig
How Kaspersky ICS CERT works
Kaspersky ICS CERT reports that in Q4 2025 malicious objects were blocked on 25.6% of ICS computers in Southeast Asia, 21.5% in South Asia, about 20.2% in East Asia and 19.2% in Central Asia & South Caucasus. A Q4 2025 wave of the 'curriculum-vitae-catalina' campaign delivered Backdoor.MSIL.XWorm through job-application phishing emails carrying a malicious executable, peaking in November.
This is a statistical threat-landscape report, not a single exploited vulnerability. Kaspersky ICS CERT's Asia Q4 2025 edition (published 2026-04-27; the global Q4 2025 edition is dated 2026-04-02) breaks down the share of ICS computers on which malicious objects were blocked. Southeast Asia reached 25.6% (about 1.3x the global figure), South Asia 21.5% (fourth place regionally, 2.5x Northern Europe), East Asia about 20.2% (8.27% in Japan to 25.87% in Mainland China) and Central Asia & South Caucasus 19.2% (2.3x Northern Europe). The global figure for Q4 2025 was 19.7%.
A Q4 2025 wave of the 'curriculum-vitae-catalina' campaign affected all four Asian regions. Phishing emails posing as job applications (subjects such as 'Resume' or 'Attached Resume') carried a malicious executable disguised as a curriculum vitae (reported as 'Curriculum Vitae-Catalina.exe'). The payload is detected as Backdoor.MSIL.XWorm, a remote-administration backdoor/worm used for data theft, spyware and remote control. Secondary reporting says the campaign has been known since 2024, started in October in Russia, Western Europe, South America and Canada, peaked in November in other regions including Asia, and subsided in December. It targeted HR managers and recruiters, and Kaspersky linked its evasion to obfuscation techniques. Worm blocking on ICS computers globally rose 1.6x to 1.60% in the quarter. The source gives no hashes, domains, IPs or CVEs for the campaign.
Other regional findings: Southeast Asia had the highest AutoCAD-malware rate (2.12%, described as 212 times Northern Europe) and spyware ranked second at 5.79%. East Asia ranked spyware first at 4.56%, network folders at 0.18% (25.9x Northern Europe) and removable media at 0.66%. South Asia led malicious scripts and phishing pages at 10.50% (1.49x growth in the quarter) and internet threats at 11.33%. This was driven by a wave of infections of WordPress sites popular in India, which served malicious JavaScript redirecting visitors to phishing sites (India's malicious-script metric rose 1.87x). South Asia ransomware was 0.17% (Afghanistan 1.66%). Central Asia & South Caucasus led globally for executable Windows miners (1.17%, about 2.0x the global average; Tajikistan 3.96%, Turkmenistan 3.80%), with miners spreading via the internet and removable media using worm functionality. Ransomware there was 0.18% (Tajikistan 0.83%). Miner tooling named in secondary reporting includes XMRig, NBMiner and OneZeroMiner.
Contributing risk factors named by Kaspersky are weak phishing protection, weak segmentation between enterprise and OT networks, weak removable-media control and internet-facing OT computers. Recommended defenses include blocking executable attachments, behavior-based detection, policy-based blocking of CDN/messenger/repository/cloud-storage access from OT networks, network segmentation and removable-media control. Attribution to a named actor is not provided.
MITRE ATT&CK techniques used in TL-2026-4897
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Lateral Movement
Initial Access
T1091 Replication Through Removable Media; T1566.001 Spearphishing Attachment
Command and Control
Impact
Persistence
Affected products and versions in Kaspersky ICS CERT
- Various — Windows-based ICS/OT computers (engineering workstations, SCADA hosts) and AutoCAD installations
Vulnerable versions: Not version-specific; exposure driven by email, internet, removable media and network-folder access
Remediation for Kaspersky ICS CERT
Immediate actions
- Block executable attachments and double-extension or CV/resume-themed executables at the email gateway
- Hunt for Backdoor.MSIL.XWorm detections and files named 'Curriculum Vitae-Catalina.exe' on ICS and adjacent enterprise hosts
- Block access to denylisted internet resources and phishing pages at the network perimeter
Workarounds
- Enforce strict control over removable media on ICS computers
- Remove direct internet access from OT computers
Longer-term hardening
- Segment enterprise IT from OT/ICS networks to limit worm and miner propagation
- Apply policy-based blocking of CDN platforms, messengers, code repositories and cloud storage from OT networks
- Deploy behavior-based endpoint detection on ICS computers
- Train HR and recruiting staff to recognize hiring-themed phishing
Timeline of Kaspersky ICS CERT
- Q4 2025 begins; secondary reporting says the 'curriculum-vitae-catalina' XWorm wave started in October (Russia, Western Europe, South America, Canada). Month-level granularity only.
- XWorm job-application phishing wave peaks in November across South Asia, Southeast Asia, East Asia and Central Asia & South Caucasus (month-level granularity).
- Activity of the Backdoor.MSIL.XWorm wave subsides across regions in December (per secondary reporting of the Kaspersky report).
- End of Q4 2025 measurement period: global ICS blocked-malicious-object share 19.7%; Southeast Asia 25.6%, South Asia 21.5%, East Asia about 20.2%, Central Asia & South Caucasus 19.2%.
- Kaspersky ICS CERT publishes the global Threat landscape for industrial automation systems Q4 2025 report.
- Kaspersky ICS CERT publishes the Asia Q4 2025 regional report documenting the XWorm campaign, AutoCAD malware, miners, spyware, WordPress-driven phishing redirects and ransomware statistics.
Sources cited for Kaspersky ICS CERT
- Threat landscape for industrial automation systems. Asia, Q4 2025 (Kaspersky ICS CERT)
- Threat landscape for industrial automation systems Q4 2025 (Kaspersky ICS CERT, global)
- Kaspersky ICS CERT Threat landscape for industrial automation systems Q4 2025 (PDF)
- Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems (Cryptika)
- Kaspersky ICS CERT report: malicious objects were blocked on almost every fifth industrial control system in India (CRN Asia)
- Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection (CSO Online)
- Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails (SOC Prime)
- XWorm Malware Exploits Follina (The Hacker News)
Detection coverage for TL-2026-4897
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4897 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.