Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Russia, Q4 2025 (Curriculum-vitae-catalina XWorm phishing)

Key facts for TL-2026-4899

Detection coverage for TL-2026-4899

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4899 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Curriculum-vitae-catalina XWorm - Resume/CV-Named Executable Execution

Detects process creation of an executable named like a resume or curriculum vitae (for example 'Curriculum Vitae-Catalina.exe'), the lure used by the Curriculum-vitae-catalina phishing campaign to deliver Backdoor.MSIL.XWorm to HR staff and hiring managers. Flags whether the binary was launched from a mail-client cache, download folder, or a mail/browser/archiver parent. Maps to T1566.001, T1204.002 and T1036.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1036
• Data sources: sysmon, DeviceProcessEvents, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```Sysmon process creation; keep only executables whose file name mimics a CV or resume```
| eval img=lower(Image), parent=lower(coalesce(ParentImage,"")), fname=mvindex(split(img,"\\"),-1)
| where match(fname,"^(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)[0-9]*([ _(-].*)?[.](exe|scr|com|pif)$")
| eval mail_or_download_origin=if(match(img,"(content[.]outlook|downloads|temporary internet files|appdata.local.temp)") OR match(parent,"(outlook|thunderbird|chrome|msedge|firefox|winrar|7zfm|7zg)[.]exe$"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as Image values(CommandLine) as CommandLine values(ParentImage) as ParentImage values(Hashes) as Hashes max(mail_or_download_origin) as mail_or_download_origin by host, User
| convert ctime(first_seen) ctime(last_seen)
| sort 0 -mail_or_download_origin, -count

Microsoft KQL

let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName matches regex '(?i)^(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)[0-9]*([ _(-].*)?[.](exe|scr|com|pif)$'
| extend MailOrDownloadOrigin = FolderPath has_any ('Content.Outlook', @'\Downloads\', 'Temporary Internet Files', @'\AppData\Local\Temp\') or InitiatingProcessFileName in~ ('outlook.exe', 'olk.exe', 'thunderbird.exe', 'chrome.exe', 'msedge.exe', 'firefox.exe', 'winrar.exe', '7zfm.exe', '7zg.exe')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, MailOrDownloadOrigin
| order by MailOrDownloadOrigin desc, Timestamp desc

Sigma

title: Resume or CV Themed Executable Launched - Curriculum-vitae-catalina XWorm
id: 7c1e4b52-3a9d-4f6e-8b21-5d0a9c3e7f14
status: experimental
description: Detects execution of an executable named like a resume or curriculum vitae (for example Curriculum Vitae-Catalina.exe), the lure used by the Curriculum-vitae-catalina phishing campaign to deliver Backdoor.MSIL.XWorm.
references:
  - https://securelist.com/industrial-threat-report-q4-2025/119392/
  - https://ics-cert.kaspersky.com/publications/reports/2026/04/23/threat-landscape-for-industrial-automation-systems-russia-q4-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-31
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|re: '(?i)\\(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)[0-9]*([ _(-][^\\]*)?[.](exe|scr|com|pif)$'
  condition: selection
falsepositives:
  - Legitimate resume-builder or CV utilities with a similar executable name
  - Internal HR tooling named cv.exe
level: high

Known false positives:

• Legitimate resume-builder or CV utilities installed by HR staff
• Internal tooling with an executable named cv.exe

Tuning notes: Prioritise hits where mail_or_download_origin=1. Allowlist signed, known-good binaries by hash or publisher. Source reports no file hashes, so extend the name regex with new lure names as they are observed; community SHA256 siblings can be loaded into an EDR IOC list.

• 🔒 Resume/CV-Named Executable Written by Mail Client, Browser or Archiver · unlock with TL Creds
• 🔒 XWorm Persistence - Scheduled Task Launching From User-Writable Path · unlock with TL Creds
• 🔒 XWorm USB Worm Propagation - Executable Dropped at Removable Drive Root · unlock with TL Creds
• 🔒 Resume Lure or Double-Extension Executable Spawned by Mail Client or Archiver · unlock with TL Creds
• 🔒 Unsigned .NET Executable in User-Writable Path Loading CLR - XWorm MSIL Loader · unlock with TL Creds
• 🔒 Cryptominer Command Line Activity on ICS Endpoints - Worm-Propagated Miners · unlock with TL Creds
• 🔒 XWorm Persistence - Run Key Pointing to User-Writable Path · unlock with TL Creds
• 🔒 XWorm Network Connection to Community-Observed Sibling Infrastructure · unlock with TL Creds

Indicators of compromise for TL-2026-4899

As of 2026-10-31, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-4899.

How Kaspersky ICS CERT works

Kaspersky ICS CERT's quarterly statistics (from Kaspersky Security Network, with user consent) cover enterprise OT infrastructure computers: SCADA servers, HMI systems, data gateways, engineering workstations and building-automation systems. For Russia in Q4 2025, 15.6% of ICS computers had malicious objects blocked, ranking 10th globally and about 1.8x the lowest-ranked region (Northern Europe). The share has fallen for three consecutive quarters, and Q4 2025 is the lowest value in that run.

Threat sources in Russia: internet 5.78% (12th globally), email clients 0.66% (13th), removable media 0.17% (8th) and network folders 0.018% (11th). By category: denylisted internet resources 3.41% (3rd globally), spyware 2.61% (9th), worms 1.13% (10th), Windows-executable miners 0.90% (2nd globally, with Russia first for quarterly increase; miners use worm components for lateral movement), malicious documents 0.61%, web miners 0.26% (4th), ransomware 0.11% (9th) and viruses 0.14% (9th). By industry: biometric systems had the highest detection rates in Russia; electric power ranked first for internet threats, malicious documents, web miners and ransomware; building automation ranked first for denylisted resources and web miners; oil and gas ranked first for network-folder threats and AutoCAD malware.

The notable campaign is the phishing activity known as 'Curriculum-vitae-catalina', which targeted organizations in all regions. Emails were disguised as job applications (subject lines such as 'Resume' or 'Attached Resume', aimed at HR staff and hiring managers) and carried a malicious executable masquerading as a curriculum vitae, typically named 'Curriculum Vitae-Catalina.exe'. The payload is Backdoor.MSIL.XWorm, a worm-backdoor giving remote administration and persistence across reboots. Kaspersky ties its spread to an obfuscation technique used heavily in Q4 2025 mass phishing, whose details are not published. The campaign has been known since 2024. Secondary reporting describes an October 2025 wave (Russia, Western Europe, South America, Canada), a November expansion and a slowdown in December. Globally, 19.7% of ICS computers were attacked (8.5% Northern Europe to 27.3% Africa), the worm share rose 1.6x to 1.60%, and XWorm, not seen on ICS computers in Q3, appeared in all regions. In Russia, removable media stayed the main worm source despite the campaign.

The report names no CVEs, CVSS scores or network/file-hash IOCs. Severity is analyst-assigned. Network IOCs from separate, later XWorm campaigns were deliberately not attached to this record because the source does not link them to Curriculum-vitae-catalina, so no BeaconBeagle lookups were applicable.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Initial Access

T1091 Replication Through Removable Media; T1566.001 Spearphishing Attachment

Lateral Movement

T1091 Replication Through Removable Media

Execution

T1204.002 Malicious File

Command and Control

T1219 Remote Access Tools

Impact

T1496.001 Compute Hijacking

Persistence

T1547 Boot or Logon Autostart Execution

Remediation for Kaspersky ICS CERT

Immediate actions

• Block executable attachments (including .exe disguised as CV/resume files) at the email gateway
• Alert on and quarantine mail with subjects such as 'Resume' or 'Attached Resume' carrying executable attachments
• Hunt endpoints for Backdoor.MSIL.XWorm detections and files named 'Curriculum Vitae-Catalina.exe'

Workarounds

• Disable autorun and restrict USB use on ICS computers
• Segment email-reachable IT hosts from OT engineering workstations

Longer-term hardening

• Train HR and recruiting staff, and anyone with access to OT-adjacent systems, to recognize hiring-themed phishing
• Deploy behavior-based detection on ICS endpoints
• Tighten removable-media policy and enforce internet/web-filter policy to reduce denylisted-resource and miner exposure
• Keep endpoint protection and software updated

Affected and fixed versions

• Various — Windows-based ICS/OT computers (SCADA servers, HMI, data gateways, engineering workstations, building automation systems)
  Vulnerable versions: Not version-specific; exposure is via phishing, internet access and removable media

Timeline of Kaspersky ICS CERT

• 2024-01-01 Curriculum-vitae-catalina phishing campaigns (CV-themed executable lures) begin to be tracked; secondary reporting says they have been known since 2024 (exact date not stated).
• 2025-10-01 First wave of Curriculum-vitae-catalina locked-ioc-8 phishing peaks in Russia, with activity in Western Europe, South America and Canada.
• 2025-11-01 Second wave expands the campaign to additional regions worldwide; worm detections rise across all regions.
• 2025-12-01 Campaign activity slows; Russian ICS attacked-computer share ends the quarter at its lowest value in three quarters (15.6%).
• 2025-12-31 Q4 2025 closes: 15.6% of ICS computers attacked in Russia (10th globally) versus 19.7% globally; locked-ioc-4, absent on ICS computers in Q3, observed in all regions.
• 2026-04-02 Kaspersky ICS CERT publishes the global Q4 2025 industrial threat landscape report.
• 2026-04-15 Securelist publishes the Q4 2025 industrial threat report summary.
• 2026-04-23 Kaspersky ICS CERT publishes the Russia-specific Q4 2025 report.

Sources cited for Kaspersky ICS CERT

• Threat landscape for industrial automation systems. Russia, Q4 2025 Kaspersky · Research · 2026-04-23
• Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q4 2025 (global) Kaspersky · Research · 2026-04-02
• Kaspersky ICS CERT Q4 2025 report (PDF) Kaspersky · Research · 2026-04-02
• Red Sky Alliance: XWorm DeepDive (family background; separate 2026 campaign) redskyalliance.org · Research · 2026-02-18
• Securelist: Industrial threat report Q4 2025 Kaspersky Securelist · Blog · 2026-04-15
• SOC Prime: Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails socprime.com · Blog
• Cryptika: Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems cryptika.com · News
• The Hacker News: XWorm Malware Exploits Follina (family background) The Hacker News · News · 2023-05-01

More in threat intel

• ARTEX AI-Powered Pentest Platform Abused for Autonomous Cybercrime Campaigns (Apple Certificates, Crypto Draining, Gaming Credentials)
• OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework
• OpenAI Finds GPT-6 Astra Covertly Underperforming on Safety Research and Exploit Tasks
• Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc)
• BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors