# Kaspersky ICS CERT: Threat landscape for industrial automation systems, Asia Q4 2025 (XWorm 'curriculum-vitae-catalina' phishing campaign, AutoCAD malware, miners, spyware)

> Kaspersky ICS CERT reports that in Q4 2025 malicious objects were blocked on 25.6% of ICS computers in Southeast Asia, 21.5% in South Asia, about 20.2% in East Asia and 19.2% in Central Asia & South Caucasus. A Q4 2025 wave of the 'curriculum-vitae-catalina' campaign delivered Backdoor.MSIL.XWorm through job-application phishing emails carrying a malicious executable, peaking in November.

- **Published:** 2026-10-31T10:28:03Z
- **Last reviewed:** 2026-10-31T10:28:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4897
- **ID:** TL-2026-4897
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a statistical threat-landscape report, not a single exploited vulnerability. Kaspersky ICS CERT's Asia Q4 2025 edition (published 2026-04-27; the global Q4 2025 edition is dated 2026-04-02) breaks down the share of ICS computers on which malicious objects were blocked. Southeast Asia reached 25.6% (about 1.3x the global figure), South Asia 21.5% (fourth place regionally, 2.5x Northern Europe), East Asia about 20.2% (8.27% in Japan to 25.87% in Mainland China) and Central Asia & South Caucasus 19.2% (2.3x Northern Europe). The global figure for Q4 2025 was 19.7%.

A Q4 2025 wave of the 'curriculum-vitae-catalina' campaign affected all four Asian regions. Phishing emails posing as job applications (subjects such as 'Resume' or 'Attached Resume') carried a malicious executable disguised as a curriculum vitae (reported as 'Curriculum Vitae-Catalina.exe'). The payload is detected as Backdoor.MSIL.XWorm, a remote-administration backdoor/worm used for data theft, spyware and remote control. Secondary reporting says the campaign has been known since 2024, started in October in Russia, Western Europe, South America and Canada, peaked in November in other regions including Asia, and subsided in December. It targeted HR managers and recruiters, and Kaspersky linked its evasion to obfuscation techniques. Worm blocking on ICS computers globally rose 1.6x to 1.60% in the quarter. The source gives no hashes, domains, IPs or CVEs for the campaign.

Other regional findings: Southeast Asia had the highest AutoCAD-malware rate (2.12%, described as 212 times Northern Europe) and spyware ranked second at 5.79%. East Asia ranked spyware first at 4.56%, network folders at 0.18% (25.9x Northern Europe) and removable media at 0.66%. South Asia led malicious scripts and phishing pages at 10.50% (1.49x growth in the quarter) and internet threats at 11.33%. This was driven by a wave of infections of WordPress sites popular in India, which served malicious JavaScript redirecting visitors to phishing sites (India's malicious-script metric rose 1.87x). South Asia ransomware was 0.17% (Afghanistan 1.66%). Central Asia & South Caucasus led globally for executable Windows miners (1.17%, about 2.0x the global average; Tajikistan 3.96%, Turkmenistan 3.80%), with miners spreading via the internet and removable media using worm functionality. Ransomware there was 0.18% (Tajikistan 0.83%). Miner tooling named in secondary reporting includes XMRig, NBMiner and OneZeroMiner.

Contributing risk factors named by Kaspersky are weak phishing protection, weak segmentation between enterprise and OT networks, weak removable-media control and internet-facing OT computers. Recommended defenses include blocking executable attachments, behavior-based detection, policy-based blocking of CDN/messenger/repository/cloud-storage access from OT networks, network segmentation and removable-media control. Attribution to a named actor is not provided.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1091 Replication Through Removable Media
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1080 Taint Shared Content
- T1219 Remote Access Tools
- T1496 Resource Hijacking

## Sources

- [Threat landscape for industrial automation systems. Asia, Q4 2025 (Kaspersky ICS CERT)](https://ics-cert.kaspersky.com/publications/reports/2026/04/27/threat-landscape-for-industrial-automation-systems-asia-q4-2025/)
- [Threat landscape for industrial automation systems Q4 2025 (Kaspersky ICS CERT, global)](https://ics-cert.kaspersky.com/publications/threat-landscape-for-industrial-automation-systems-q4-2025/)
- [Kaspersky ICS CERT Threat landscape for industrial automation systems Q4 2025 (PDF)](https://ics-cert.kaspersky.com/wp-content/uploads/2026/04/Kaspersky-ICS-CERT-Threat-landscape-for-industrial-automation-systems-Q4-2025-En.pdf)
- [Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems (Cryptika)](https://www.cryptika.com/email-borne-worm-surge-drives-new-threat-wave-across-industrial-control-systems/)
- [Kaspersky ICS CERT report: malicious objects were blocked on almost every fifth industrial control system in India (CRN Asia)](https://www.crnasia.com/india/news-network/news/kaspersky-ics-cert-report-malicious-objects-were-blocked-on-almost-every-fifth-industrial-control-system-in-india)
- [Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection (CSO Online)](https://csoonline.com/article/4131340/phishing-campaign-chains-old-office-flaw-with-fileless-xworm-rat-to-evade-detection.html)
- [Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails (SOC Prime)](https://socprime.com/active-threats/xworm-campaign-utilizing-multiple-themed-phishing-emails/)
- [XWorm Malware Exploits Follina (The Hacker News)](https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4897