# Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems - South America and North America (Canada), Q4 2025 - Backdoor.MSIL.XWorm 'Curriculum-vitae-catalina' Phishing Wave

> Kaspersky ICS CERT reports that 20.4% of ICS computers in South America (6th globally) and 11.9% in Canada (12th globally) blocked malicious objects in Q4 2025, with the internet, email clients and removable media as the main threat sources. The report ties a surge in email-borne worms to phishing that delivered Backdoor.MSIL.XWorm in fake job-application emails (the 'Curriculum-vitae-catalina' wave), which peaked in October 2025.

- **Published:** 2026-10-31T16:27:33Z
- **Last reviewed:** 2026-10-31T16:27:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4913
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4913.png
- **ID:** TL-2026-4913
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

This record summarizes Kaspersky ICS CERT's regional Q4 2025 report for South America and North America (Canada), published 2026-04-29, together with the global Q4 2025 ICS report (ICS CERT 2026-04-02; Securelist 2026-04-15). The report is aggregate telemetry. It names no CVEs, file hashes, domains, IP addresses or threat actor.

Regional statistics. In South America, 20.4% of ICS computers blocked malicious objects (6th globally; 8.11% in Trinidad and Tobago to 29.50% in Cuba). Threat sources were the internet at 8.65% (4th globally), email clients at 5.30% (2nd globally, behind Southern Europe) and removable media at 0.09%. By category, malicious scripts and phishing pages affected 9.65% of computers (2nd globally; Panama highest at 18.24%), malicious documents 3.08% (2nd; Mexico highest at 5.28%), spyware 3.93% (7th; Uruguay highest at 7.12%), web miners 0.27% (2nd; Cuba highest at 0.77%) and worms 1.14% (9th; Cuba highest at 5.75%). Mexico led regional email threats at 9.51%. Biometrics, building automation and oil and gas were the most affected industries in the region, and the report highlights a high risk of targeted attacks through email-distributed malicious documents and scripts. It also notes a Q3 2025 surge of WordPress site infections affecting Panamanian government organizations.

In Canada, 11.9% of ICS computers blocked malicious objects (12th globally, below the global average for every threat source). The internet accounted for 6.71% (9th), email clients 1.79% (9th), removable media 0.08% (11th) and network folders 0.024% (6th). Malicious scripts and phishing pages affected 4.94% (9th), denylisted internet resources 1.75%, spyware 1.43% and malicious documents 1.06%. Manufacturing was the most affected industry (6th globally).

The XWorm campaign. Globally, worms blocked on ICS computers rose 1.6 times to 1.60% in Q4 2025, and worms arriving in email attachments roughly doubled because of phishing aimed at delivering Backdoor.MSIL.XWorm. XWorm is a worm-backdoor built to persist on the host and be remotely controlled, and it had not been detected on ICS computers in Q3 2025 but appeared in all regions in Q4. Kaspersky links the activity to an obfuscation technique used in mass phishing campaigns known since 2024 as 'Curriculum-vitae-catalina'. Lures were emails to HR and recruiting staff with subjects such as 'Resume' or 'Attached Resume', carrying an executable named 'Curriculum Vitae-Catalina.exe' that posed as a CV. The campaign came in two waves. In October it hit Russia, Western Europe, South America and Canada. In November it hit other regions, and it subsided everywhere in December. XWorm detections on ICS computers were highest in Southern Europe, South America and the Middle East, with secondary spread through USB storage in Africa.

XWorm background (Trellix research via BleepingComputer). XWorm is a commodity RAT with more than 35 plugins covering browser, email, messaging, FTP and crypto-wallet theft, remote desktop, shell access, keylogging, clipboard theft, webcam access, DDoS and a Ransomware.dll module that appends .ENC and uses AES-CBC in 4096-byte blocks. Versions 6.0, 6.4 and 6.5 circulate after the original developer (XCoder) abandoned the project. Other known XWorm delivery vectors include malicious JavaScript, LNK files, PowerShell scripts that bypass AMSI, disguised EXEs and shellcode embedded in Excel files. The Kaspersky report itself does not say which of these capabilities or vectors were seen in the Q4 2025 wave.

Defender takeaways: block or sandbox executable attachments (including executables inside archives) in HR and recruiting mailboxes; hunt for 'Curriculum Vitae-Catalina.exe' and Resume-themed lures; and restrict email clients and removable media on OT-adjacent endpoints. Because the sources provide no network IOCs, no BeaconBeagle C2 correlation could be performed.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1547 Boot or Logon Autostart Execution
- T1091 Replication Through Removable Media
- T1219 Remote Access Tools
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1113 Screen Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**XWorm 'Curriculum Vitae-Catalina.exe' CV-Lure Executable Execution (TL-2026-4913)** (`TL-2026-4913-SPL-001`)

Detects execution of the executable that poses as a CV ('Curriculum Vitae-Catalina.exe') in the Curriculum-vitae-catalina phishing wave that delivered Backdoor.MSIL.XWorm to HR and recruiting staff (Kaspersky ICS CERT Q4 2025), plus CV/Resume-named executables (including double-extension forms such as resume.pdf.exe) launched from mail clients, archivers, browsers or user-writable paths (T1566.001 / T1204.002 / T1036). Behaviour-first: the exact filename is a high-fidelity hit on its own, while generic CV-style names only alert when the execution context is risky.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1036
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, EventCode 1), microsoft_defender_endpoint (DeviceProcessEvents), windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*.exe"
| eval img=lower(Image), parent=lower(ParentImage)
| eval ioc_name=if(match(img,"(^|[^a-z0-9 _.()-])curriculum[ _-]?vitae[ _-]?catalina[a-z0-9 _()-]*[.]exe$"),1,0)
| eval cv_lure=if(match(img,"(^|[^a-z0-9 _.()-])(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)([ _-][a-z0-9 _()-]*)?([.](pdf|docx?|xlsx?|jpg|png))?[.]exe$"),1,0)
| eval risky_ctx=if(match(img,"(users.[a-z0-9._-]+.(downloads|desktop|appdata)|.temp.|content.outlook)") OR match(parent,"(outlook|winword|excel|winrar|7zfm|7zg|thunderbird|msedge|chrome|firefox)[.]exe$"),1,0)
| where ioc_name=1 OR (cv_lure=1 AND risky_ctx=1)
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line values(Hashes) as hashes by Computer, User, Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T"), threat_id="TL-2026-4913", campaign="Curriculum-vitae-catalina", family="XWorm"
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName endswith ".exe"
| extend Img = tolower(FolderPath), Name = tolower(FileName)
| extend IocName = Name matches regex @"^curriculum[ _-]?vitae[ _-]?catalina[a-z0-9 _()-]*[.]exe$"
| extend CvLure = Name matches regex @"^(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)([ _-][a-z0-9 _()-]*)?([.](pdf|docx?|xlsx?|jpg|png))?[.]exe$"
| extend RiskyCtx = Img matches regex @"(users.[a-z0-9._-]+.(downloads|desktop|appdata)|.temp.|content.outlook)" or InitiatingProcessFileName in~ ("outlook.exe", "winword.exe", "excel.exe", "winrar.exe", "7zfm.exe", "7zg.exe", "thunderbird.exe", "msedge.exe", "chrome.exe", "firefox.exe")
| where IocName or (CvLure and RiskyCtx)
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: XWorm Curriculum Vitae-Catalina Lure Executable Execution
id: 4c1d7a52-8e3b-4f6a-9d21-6a0b5e7c3f11
status: experimental
description: Detects execution of the executable posing as a CV (Curriculum Vitae-Catalina.exe) used in the Curriculum-vitae-catalina phishing wave that delivered Backdoor.MSIL.XWorm, or CV and resume named executables launched from mail clients, archivers, browsers or user-writable paths.
references:
  - https://securelist.com/industrial-threat-report-q4-2025/119392/
  - https://ics-cert.kaspersky.com/publications/reports/2026/04/29/threat-landscape-for-industrial-automation-systems-south-and-north-america-canada-q4-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_ioc:
    Image|endswith:
      - '\Curriculum Vitae-Catalina.exe'
      - '\Curriculum-Vitae-Catalina.exe'
  selection_cv_name:
    Image|re: '(?i)(^|[^a-z0-9 _.()-])(curriculum[ _-]?vitae|attached[ _-]?resume|resume|cv)([ _-][a-z0-9 _()-]*)?([.](pdf|docx?|xlsx?|jpg|png))?[.]exe$'
  selection_ctx_path:
    Image|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\'
      - '\Temp\'
      - '\Content.Outlook\'
  selection_ctx_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\olk.exe'
      - '\thunderbird.exe'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\winrar.exe'
      - '\7zFM.exe'
      - '\7zG.exe'
  condition: selection_ioc or (selection_cv_name and 1 of selection_ctx_*)
falsepositives:
  - Employees or HR tooling legitimately running a vendor application whose name starts with CV or Resume from the Downloads folder
level: high
```

**Known false positives:**

- Legitimate resume-builder or HR software executables named CV or Resume launched from Downloads or AppData
- Security awareness or phishing-simulation exercises that drop a CV-named test executable

**Tuning notes:** The exact 'Curriculum Vitae-Catalina.exe' branch needs no tuning and should alert at high priority. For the generic CV/Resume branch, add the hostnames of HR and recruiting endpoints to a watchlist to raise priority and allow-list signed vendor binaries by publisher or SHA256. Pair with an email-gateway hunt for subjects 'Resume' and 'Attached Resume' sent to HR mailboxes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Executable Attachment Dropped by Mail Client or Archiver - CV/Resume Lure (XWorm Phishing Delivery) (locked: unlock with TL Creds)
- Browser Credential Store Access by Non-Browser Process (XWorm Stealer and Chromium Plugins) (locked: unlock with TL Creds)
- Worm Self-Replication to Removable Drive Root by User-Path Process (XWorm USB Spread) (locked: unlock with TL Creds)
- Obfuscated or AMSI-Bypassing PowerShell Spawned by Mail, Script Host or User-Path Parent (XWorm Delivery) (locked: unlock with TL Creds)
- XWorm Plugin DLLs and [indicator] Ransomware-Module Artifacts in User-Writable Paths (locked: unlock with TL Creds)
- Web Proxy Retrieval of Community-Observed XWorm Payload URLs (ngrok MicrosoftUpdateServices.exe, ygz.bet fps.exe) (locked: unlock with TL Creds)
- XWorm Autostart Persistence - Run Key or Startup Folder Pointing to User-Writable Path (locked: unlock with TL Creds)
- XWorm Community-Observed C2 and Payload Infrastructure - Direct Connections and ngrok Tunnels from User Paths (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Threat landscape for industrial automation systems. South and North America (Canada), Q4 2025](https://ics-cert.kaspersky.com/publications/reports/2026/04/29/threat-landscape-for-industrial-automation-systems-south-and-north-america-canada-q4-2025/)
- [Threat landscape for industrial automation systems. Q4 2025 (Kaspersky ICS CERT)](https://ics-cert.kaspersky.com/publications/reports/2026/04/02/threat-landscape-for-industrial-automation-systems-q4-2025/)
- [Threat landscape for industrial automation systems in Q4 2025 (Securelist)](https://securelist.com/industrial-threat-report-q4-2025/119392/)
- [Threat landscape for industrial automation systems. Europe, Q4 2025](https://ics-cert.kaspersky.com/publications/reports/2026/04/28/threat-landscape-for-industrial-automation-systems-europe-q4-2025/)
- [APT and financial attacks on industrial organizations in Q4 2025](https://ics-cert.kaspersky.com/publications/reports/2026/03/06/apt-and-financial-attacks-on-industrial-organizations-in-q4-2025/)
- [XWorm malware resurfaces with ransomware module, over 35 plugins (BleepingComputer, Trellix research)](https://www.bleepingcomputer.com/news/security/xworm-malware-resurfaces-with-ransomware-module-over-35-plugins/)
- [Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems (Cryptika)](https://www.cryptika.com/email-borne-worm-surge-drives-new-threat-wave-across-industrial-control-systems/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4913