Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems - South America and North America (Canada), Q4 2025 - Backdoor.MSIL.XWorm 'Curriculum-vitae-catalina' Phishing Wave

Key facts for XWorm phishing wave

Detection coverage for XWorm phishing wave

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4913 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XWorm 'Curriculum Vitae-Catalina.exe' CV-Lure Executable Execution (TL-2026-4913)

Detects execution of the executable that poses as a CV ('Curriculum Vitae-Catalina.exe') in the Curriculum-vitae-catalina phishing wave that delivered Backdoor.MSIL.XWorm to HR and recruiting staff (Kaspersky ICS CERT Q4 2025), plus CV/Resume-named executables (including double-extension forms such as resume.pdf.exe) launched from mail clients, archivers, browsers or user-writable paths (T1566.001 / T1204.002 / T1036). Behaviour-first: the exact filename is a high-fidelity hit on its own, while generic CV-style names only alert when the execution context is risky.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1036
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, EventCode 1), microsoft_defender_endpoint (DeviceProcessEvents), windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*.exe"
| eval img=lower(Image), parent=lower(ParentImage)
| eval ioc_name=if(match(img,"(^|[^a-z0-9 _.()-])curriculum[ _-]?vitae[ _-]?catalina[a-z0-9 _()-]*[.]exe$"),1,0)
| eval cv_lure=if(match(img,"(^|[^a-z0-9 _.()-])(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)([ _-][a-z0-9 _()-]*)?([.](pdf|docx?|xlsx?|jpg|png))?[.]exe$"),1,0)
| eval risky_ctx=if(match(img,"(users.[a-z0-9._-]+.(downloads|desktop|appdata)|.temp.|content.outlook)") OR match(parent,"(outlook|winword|excel|winrar|7zfm|7zg|thunderbird|msedge|chrome|firefox)[.]exe$"),1,0)
| where ioc_name=1 OR (cv_lure=1 AND risky_ctx=1)
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line values(Hashes) as hashes by Computer, User, Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T"), threat_id="TL-2026-4913", campaign="Curriculum-vitae-catalina", family="XWorm"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName endswith ".exe"
| extend Img = tolower(FolderPath), Name = tolower(FileName)
| extend IocName = Name matches regex @"^curriculum[ _-]?vitae[ _-]?catalina[a-z0-9 _()-]*[.]exe$"
| extend CvLure = Name matches regex @"^(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)([ _-][a-z0-9 _()-]*)?([.](pdf|docx?|xlsx?|jpg|png))?[.]exe$"
| extend RiskyCtx = Img matches regex @"(users.[a-z0-9._-]+.(downloads|desktop|appdata)|.temp.|content.outlook)" or InitiatingProcessFileName in~ ("outlook.exe", "winword.exe", "excel.exe", "winrar.exe", "7zfm.exe", "7zg.exe", "thunderbird.exe", "msedge.exe", "chrome.exe", "firefox.exe")
| where IocName or (CvLure and RiskyCtx)
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: XWorm Curriculum Vitae-Catalina Lure Executable Execution
id: 4c1d7a52-8e3b-4f6a-9d21-6a0b5e7c3f11
status: experimental
description: Detects execution of the executable posing as a CV (Curriculum Vitae-Catalina.exe) used in the Curriculum-vitae-catalina phishing wave that delivered Backdoor.MSIL.XWorm, or CV and resume named executables launched from mail clients, archivers, browsers or user-writable paths.
references:
  - https://securelist.com/industrial-threat-report-q4-2025/119392/
  - https://ics-cert.kaspersky.com/publications/reports/2026/04/29/threat-landscape-for-industrial-automation-systems-south-and-north-america-canada-q4-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_ioc:
    Image|endswith:
      - '\Curriculum Vitae-Catalina.exe'
      - '\Curriculum-Vitae-Catalina.exe'
  selection_cv_name:
    Image|re: '(?i)(^|[^a-z0-9 _.()-])(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)([ _-][a-z0-9 _()-]*)?([.](pdf|docx?|xlsx?|jpg|png))?[.]exe$'
  selection_ctx_path:
    Image|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\'
      - '\Temp\'
      - '\Content.Outlook\'
  selection_ctx_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\olk.exe'
      - '\thunderbird.exe'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\winrar.exe'
      - '\7zFM.exe'
      - '\7zG.exe'
  condition: selection_ioc or (selection_cv_name and 1 of selection_ctx_*)
falsepositives:
  - Employees or HR tooling legitimately running a vendor application whose name starts with CV or Resume from the Downloads folder
level: high

Known false positives:

• Legitimate resume-builder or HR software executables named CV or Resume launched from Downloads or AppData
• Security awareness or phishing-simulation exercises that drop a CV-named test executable

Tuning notes: The exact 'Curriculum Vitae-Catalina.exe' branch needs no tuning and should alert at high priority. For the generic CV/Resume branch, add the hostnames of HR and recruiting endpoints to a watchlist to raise priority and allow-list signed vendor binaries by publisher or SHA256. Pair with an email-gateway hunt for subjects 'Resume' and 'Attached Resume' sent to HR mailboxes.

• 🔒 Executable Attachment Dropped by Mail Client or Archiver - CV/Resume Lure (XWorm Phishing Delivery) · unlock with TL Creds
• 🔒 Browser Credential Store Access by Non-Browser Process (XWorm Stealer and Chromium Plugins) · unlock with TL Creds
• 🔒 Worm Self-Replication to Removable Drive Root by User-Path Process (XWorm USB Spread) · unlock with TL Creds
• 🔒 Obfuscated or AMSI-Bypassing PowerShell Spawned by Mail, Script Host or User-Path Parent (XWorm Delivery) · unlock with TL Creds
• 🔒 XWorm Plugin DLLs and [indicator] Ransomware-Module Artifacts in User-Writable Paths · unlock with TL Creds
• 🔒 Web Proxy Retrieval of Community-Observed XWorm Payload URLs (ngrok MicrosoftUpdateServices.exe, ygz.bet fps.exe) · unlock with TL Creds
• 🔒 XWorm Autostart Persistence - Run Key or Startup Folder Pointing to User-Writable Path · unlock with TL Creds
• 🔒 XWorm Community-Observed C2 and Payload Infrastructure - Direct Connections and ngrok Tunnels from User Paths · unlock with TL Creds

Indicators of compromise for XWorm phishing wave

As of 2026-10-31, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-4913.

How XWorm phishing wave works

This record summarizes Kaspersky ICS CERT's regional Q4 2025 report for South America and North America (Canada), published 2026-04-29, together with the global Q4 2025 ICS report (ICS CERT 2026-04-02; Securelist 2026-04-15). The report is aggregate telemetry. It names no CVEs, file hashes, domains, IP addresses or threat actor.

Regional statistics. In South America, 20.4% of ICS computers blocked malicious objects (6th globally; 8.11% in Trinidad and Tobago to 29.50% in Cuba). Threat sources were the internet at 8.65% (4th globally), email clients at 5.30% (2nd globally, behind Southern Europe) and removable media at 0.09%. By category, malicious scripts and phishing pages affected 9.65% of computers (2nd globally; Panama highest at 18.24%), malicious documents 3.08% (2nd; Mexico highest at 5.28%), spyware 3.93% (7th; Uruguay highest at 7.12%), web miners 0.27% (2nd; Cuba highest at 0.77%) and worms 1.14% (9th; Cuba highest at 5.75%). Mexico led regional email threats at 9.51%. Biometrics, building automation and oil and gas were the most affected industries in the region, and the report highlights a high risk of targeted attacks through email-distributed malicious documents and scripts. It also notes a Q3 2025 surge of WordPress site infections affecting Panamanian government organizations.

In Canada, 11.9% of ICS computers blocked malicious objects (12th globally, below the global average for every threat source). The internet accounted for 6.71% (9th), email clients 1.79% (9th), removable media 0.08% (11th) and network folders 0.024% (6th). Malicious scripts and phishing pages affected 4.94% (9th), denylisted internet resources 1.75%, spyware 1.43% and malicious documents 1.06%. Manufacturing was the most affected industry (6th globally).

The XWorm campaign. Globally, worms blocked on ICS computers rose 1.6 times to 1.60% in Q4 2025, and worms arriving in email attachments roughly doubled because of phishing aimed at delivering Backdoor.MSIL.XWorm. XWorm is a worm-backdoor built to persist on the host and be remotely controlled, and it had not been detected on ICS computers in Q3 2025 but appeared in all regions in Q4. Kaspersky links the activity to an obfuscation technique used in mass phishing campaigns known since 2024 as 'Curriculum-vitae-catalina'. Lures were emails to HR and recruiting staff with subjects such as 'Resume' or 'Attached Resume', carrying an executable named 'Curriculum Vitae-Catalina.exe' that posed as a CV. The campaign came in two waves. In October it hit Russia, Western Europe, South America and Canada. In November it hit other regions, and it subsided everywhere in December. XWorm detections on ICS computers were highest in Southern Europe, South America and the Middle East, with secondary spread through USB storage in Africa.

XWorm background (Trellix research via BleepingComputer). XWorm is a commodity RAT with more than 35 plugins covering browser, email, messaging, FTP and crypto-wallet theft, remote desktop, shell access, keylogging, clipboard theft, webcam access, DDoS and a Ransomware.dll module that appends .ENC and uses AES-CBC in 4096-byte blocks. Versions 6.0, 6.4 and 6.5 circulate after the original developer (XCoder) abandoned the project. Other known XWorm delivery vectors include malicious JavaScript, LNK files, PowerShell scripts that bypass AMSI, disguised EXEs and shellcode embedded in Excel files. The Kaspersky report itself does not say which of these capabilities or vectors were seen in the Q4 2025 wave.

Defender takeaways: block or sandbox executable attachments (including executables inside archives) in HR and recruiting mailboxes; hunt for 'Curriculum Vitae-Catalina.exe' and Resume-themed lures; and restrict email clients and removable media on OT-adjacent endpoints. Because the sources provide no network IOCs, no BeaconBeagle C2 correlation could be performed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Collection

T1056.001 Keylogging; T1113 Screen Capture

Lateral Movement

T1091 Replication Through Removable Media

Execution

T1204.002 Malicious File

Command and Control

T1219 Remote Access Tools

Persistence

T1547 Boot or Logon Autostart Execution

Credential Access

T1555.003 Credentials from Web Browsers

Initial Access

T1566.001 Spearphishing Attachment

Remediation for XWorm phishing wave

Immediate actions

• Block or detonate executable attachments (including executables inside archives) at the email gateway, especially for HR and recruiting mailboxes
• Hunt endpoints for the filename 'Curriculum Vitae-Catalina.exe' and for emails with subjects 'Resume' or 'Attached Resume'
• Detect and quarantine Backdoor.MSIL.XWorm with EDR/AV signatures

Workarounds

• Enforce allow-listing of executables on ICS workstations
• Disable macro, script and LNK execution from mail attachments where not required

Longer-term hardening

• Restrict email clients and web browsing on ICS and OT-adjacent computers
• Control removable media use on industrial endpoints
• Train HR and recruiting staff to treat executable 'CV' attachments as malicious
• Segment OT networks from corporate email and internet-facing hosts

Affected and fixed versions

• Various — ICS computers (Windows-based industrial automation endpoints and engineering workstations)
  Vulnerable versions: Not version-specific; exposure is via email clients, internet and removable media

Timeline of XWorm phishing wave

• 2024-01-01 Approximate date: Kaspersky states the 'Curriculum-vitae-catalina' mass phishing/obfuscation campaigns have been known since 2024 (no exact date given)
• 2025-10-01 First locked-ioc-3 wave in Q4 2025 (date approximate: October) hits ICS computers in Russia, Western Europe, South America and Canada
• 2025-11-01 Second wave (date approximate: November) spikes locked-ioc-12 detections on ICS computers in other regions
• 2025-12-01 locked-ioc-12 phishing activity subsides in all regions (date approximate: December)
• 2026-03-06 Kaspersky ICS CERT publishes 'APT and financial attacks on industrial organizations in Q4 2025'
• 2026-04-02 Kaspersky ICS CERT publishes the global Q4 2025 ICS threat landscape report (19.7% of ICS computers attacked; worms up to 1.60%)
• 2026-04-15 Securelist publishes 'Threat landscape for industrial automation systems in Q4 2025' describing the locked-ioc-12 / Curriculum-vitae-catalina wave
• 2026-04-29 Kaspersky ICS CERT publishes the South and North America (Canada) Q4 2025 regional report: South America 20.4%, Canada 11.9% of ICS computers attacked

Sources cited for XWorm phishing wave

• Threat landscape for industrial automation systems. South and North America (Canada), Q4 2025 Kaspersky · Research · 2026-04-29
• Threat landscape for industrial automation systems. Q4 2025 (Kaspersky ICS CERT) Kaspersky · Research · 2026-04-02
• Threat landscape for industrial automation systems. Europe, Q4 2025 Kaspersky · Research · 2026-04-28
• APT and financial attacks on industrial organizations in Q4 2025 Kaspersky · Research · 2026-03-06
• Threat landscape for industrial automation systems in Q4 2025 (Securelist) Kaspersky Securelist · Blog · 2026-04-15
• XWorm malware resurfaces with ransomware module, over 35 plugins (BleepingComputer, Trellix research) BleepingComputer · News
• Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems (Cryptika) cryptika.com · News

More in threat intel

• ARTEX AI-Powered Pentest Platform Abused for Autonomous Cybercrime Campaigns (Apple Certificates, Crypto Draining, Gaming Credentials)
• OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework
• OpenAI Finds GPT-6 Astra Covertly Underperforming on Safety Research and Exploit Tasks
• Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc)
• BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors