# Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Russia, Q4 2025 (Curriculum-vitae-catalina XWorm phishing)

> Kaspersky ICS CERT reports malicious objects were blocked on 15.6% of ICS computers in Russia in Q4 2025 (10th globally), driven by internet threats (5.78%), email (0.66%) and removable media (0.17%). The 'Curriculum-vitae-catalina' phishing campaign delivered Backdoor.MSIL.XWorm disguised as CV files and peaked in October 2025.

- **Published:** 2026-10-31T11:03:00Z
- **Last reviewed:** 2026-10-31T11:03:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4899
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4899.png
- **ID:** TL-2026-4899
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

Kaspersky ICS CERT's quarterly statistics (from Kaspersky Security Network, with user consent) cover enterprise OT infrastructure computers: SCADA servers, HMI systems, data gateways, engineering workstations and building-automation systems. For Russia in Q4 2025, 15.6% of ICS computers had malicious objects blocked, ranking 10th globally and about 1.8x the lowest-ranked region (Northern Europe). The share has fallen for three consecutive quarters, and Q4 2025 is the lowest value in that run.

Threat sources in Russia: internet 5.78% (12th globally), email clients 0.66% (13th), removable media 0.17% (8th) and network folders 0.018% (11th). By category: denylisted internet resources 3.41% (3rd globally), spyware 2.61% (9th), worms 1.13% (10th), Windows-executable miners 0.90% (2nd globally, with Russia first for quarterly increase; miners use worm components for lateral movement), malicious documents 0.61%, web miners 0.26% (4th), ransomware 0.11% (9th) and viruses 0.14% (9th). By industry: biometric systems had the highest detection rates in Russia; electric power ranked first for internet threats, malicious documents, web miners and ransomware; building automation ranked first for denylisted resources and web miners; oil and gas ranked first for network-folder threats and AutoCAD malware.

The notable campaign is the phishing activity known as 'Curriculum-vitae-catalina', which targeted organizations in all regions. Emails were disguised as job applications (subject lines such as 'Resume' or 'Attached Resume', aimed at HR staff and hiring managers) and carried a malicious executable masquerading as a curriculum vitae, typically named 'Curriculum Vitae-Catalina.exe'. The payload is Backdoor.MSIL.XWorm, a worm-backdoor giving remote administration and persistence across reboots. Kaspersky ties its spread to an obfuscation technique used heavily in Q4 2025 mass phishing, whose details are not published. The campaign has been known since 2024. Secondary reporting describes an October 2025 wave (Russia, Western Europe, South America, Canada), a November expansion and a slowdown in December. Globally, 19.7% of ICS computers were attacked (8.5% Northern Europe to 27.3% Africa), the worm share rose 1.6x to 1.60%, and XWorm, not seen on ICS computers in Q3, appeared in all regions. In Russia, removable media stayed the main worm source despite the campaign.

The report names no CVEs, CVSS scores or network/file-hash IOCs. Severity is analyst-assigned. Network IOCs from separate, later XWorm campaigns were deliberately not attached to this record because the source does not link them to Curriculum-vitae-catalina, so no BeaconBeagle lookups were applicable.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1091 Replication Through Removable Media
- T1204.002 Malicious File
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1091 Replication Through Removable Media
- T1219 Remote Access Tools
- T1496.001 Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Curriculum-vitae-catalina XWorm - Resume/CV-Named Executable Execution** (`TL-2026-4899-SPL-001`)

Detects process creation of an executable named like a resume or curriculum vitae (for example 'Curriculum Vitae-Catalina.exe'), the lure used by the Curriculum-vitae-catalina phishing campaign to deliver Backdoor.MSIL.XWorm to HR staff and hiring managers. Flags whether the binary was launched from a mail-client cache, download folder, or a mail/browser/archiver parent. Maps to T1566.001, T1204.002 and T1036.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1036
- **Data sources:** sysmon, DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```Sysmon process creation; keep only executables whose file name mimics a CV or resume```
| eval img=lower(Image), parent=lower(coalesce(ParentImage,"")), fname=mvindex(split(img,"\\"),-1)
| where match(fname,"^(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)[0-9]*([ _(-].*)?[.](exe|scr|com|pif)$")
| eval mail_or_download_origin=if(match(img,"(content[.]outlook|downloads|temporary internet files|appdata.local.temp)") OR match(parent,"(outlook|thunderbird|chrome|msedge|firefox|winrar|7zfm|7zg)[.]exe$"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as Image values(CommandLine) as CommandLine values(ParentImage) as ParentImage values(Hashes) as Hashes max(mail_or_download_origin) as mail_or_download_origin by host, User
| convert ctime(first_seen) ctime(last_seen)
| sort 0 -mail_or_download_origin, -count
````

### Microsoft KQL

```kql
let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName matches regex '(?i)^(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)[0-9]*([ _(-].*)?[.](exe|scr|com|pif)$'
| extend MailOrDownloadOrigin = FolderPath has_any ('Content.Outlook', @'\Downloads\', 'Temporary Internet Files', @'\AppData\Local\Temp\') or InitiatingProcessFileName in~ ('outlook.exe', 'olk.exe', 'thunderbird.exe', 'chrome.exe', 'msedge.exe', 'firefox.exe', 'winrar.exe', '7zfm.exe', '7zg.exe')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, MailOrDownloadOrigin
| order by MailOrDownloadOrigin desc, Timestamp desc
```

### Sigma

```yaml
title: Resume or CV Themed Executable Launched - Curriculum-vitae-catalina XWorm
id: 7c1e4b52-3a9d-4f6e-8b21-5d0a9c3e7f14
status: experimental
description: Detects execution of an executable named like a resume or curriculum vitae (for example Curriculum Vitae-Catalina.exe), the lure used by the Curriculum-vitae-catalina phishing campaign to deliver Backdoor.MSIL.XWorm.
references:
  - https://securelist.com/industrial-threat-report-q4-2025/119392/
  - https://ics-cert.kaspersky.com/publications/reports/2026/04/23/threat-landscape-for-industrial-automation-systems-russia-q4-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-31
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|re: '(?i)\\(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)[0-9]*([ _(-][^\\]*)?[.](exe|scr|com|pif)$'
  condition: selection
falsepositives:
  - Legitimate resume-builder or CV utilities with a similar executable name
  - Internal HR tooling named cv.exe
level: high
```

**Known false positives:**

- Legitimate resume-builder or CV utilities installed by HR staff
- Internal tooling with an executable named cv.exe

**Tuning notes:** Prioritise hits where mail_or_download_origin=1. Allowlist signed, known-good binaries by hash or publisher. Source reports no file hashes, so extend the name regex with new lure names as they are observed; community SHA256 siblings can be loaded into an EDR IOC list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Resume/CV-Named Executable Written by Mail Client, Browser or Archiver (locked: unlock with TL Creds)
- XWorm Persistence - Scheduled Task Launching From User-Writable Path (locked: unlock with TL Creds)
- XWorm USB Worm Propagation - Executable Dropped at Removable Drive Root (locked: unlock with TL Creds)
- Resume Lure or Double-Extension Executable Spawned by Mail Client or Archiver (locked: unlock with TL Creds)
- Unsigned .NET Executable in User-Writable Path Loading CLR - XWorm MSIL Loader (locked: unlock with TL Creds)
- Cryptominer Command Line Activity on ICS Endpoints - Worm-Propagated Miners (locked: unlock with TL Creds)
- XWorm Persistence - Run Key Pointing to User-Writable Path (locked: unlock with TL Creds)
- XWorm Network Connection to Community-Observed Sibling Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Threat landscape for industrial automation systems. Russia, Q4 2025](https://ics-cert.kaspersky.com/publications/reports/2026/04/23/threat-landscape-for-industrial-automation-systems-russia-q4-2025/)
- [Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q4 2025 (global)](https://ics-cert.kaspersky.com/publications/threat-landscape-for-industrial-automation-systems-q4-2025/)
- [Securelist: Industrial threat report Q4 2025](https://securelist.com/industrial-threat-report-q4-2025/119392/)
- [Kaspersky ICS CERT Q4 2025 report (PDF)](https://ics-cert.kaspersky.com/wp-content/uploads/2026/04/Kaspersky-ICS-CERT-Threat-landscape-for-industrial-automation-systems-Q4-2025-En.pdf)
- [Cryptika: Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems](https://www.cryptika.com/email-borne-worm-surge-drives-new-threat-wave-across-industrial-control-systems/)
- [Red Sky Alliance: XWorm DeepDive (family background; separate 2026 campaign)](https://redskyalliance.org/xindustry/xworm-deepdive)
- [The Hacker News: XWorm Malware Exploits Follina (family background)](https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html)
- [SOC Prime: Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails](https://socprime.com/active-threats/xworm-campaign-utilizing-multiple-themed-phishing-emails/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4899