Skip to navigation

Threat reportThreat IntelligenceTL-2026-4915

Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Europe Q4 2025 (XWorm 'Curriculum-vitae-catalina' phishing campaign)

mediumMONITORING

Kaspersky ICS CERT reports the share of ICS computers with blocked malicious objects in Q4 2025 by European region: Southern Europe 18.8%, Eastern Europe 18.1%, Western Europe 11.2%, Northern Europe 8.5%. Worm detections rose in all regions, driven by the 'Curriculum-vitae-catalina' phishing campaign delivering Backdoor.MSIL.XWorm, and ransomware blocks in Southern Europe rose x1.47. First disclosed .

Key facts for Europe ICS XWorm wave

IdentifiersTL-2026-4915
Also known asCurriculum-vitae-catalina
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows (ICS/OT workstations and servers: SCADA, historian, engineering and operator workstations, HMI)
MalwareBackdoor.MSIL.XWorm, XWorm
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1053.005 Scheduled Task, T1204.002 Malicious File, T1497 Virtualization/Sandbox Evasion, T1547.001 Registry Run Keys / Startup Folder, T1566.001 Spearphishing Attachment, T1571 Non-Standard Port, T1685 Disable or Modify Tools
MotivationUNKNOWN
Target sectorsindustrial, manufacturing, energy, oil-and-gas, chemical, transport-and-logistics, pharmaceuticals, food-and-beverage, building-automation
Target regions039 - Southern Europe, 151 - Eastern Europe, 155 - Western Europe, 154 - Northern Europe, 005 - South America, canada, russia
Detection rules9 (1 shown free)
Sources5 cited sources

Detection coverage for Europe ICS XWorm wave

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4915 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XWorm 'Curriculum Vitae-Catalina.exe' Execution — CV Phishing Lure (Exploitation)

Detects process creation of 'Curriculum Vitae-Catalina.exe', the executable attachment used in the Curriculum-vitae-catalina phishing campaign (Q4 2025) to deliver Backdoor.MSIL.XWorm to HR/recruiting staff and ICS-adjacent Windows hosts. Matches on image path, PE OriginalFileName or command line, and flags launches from mail clients or archivers. Source: Kaspersky ICS CERT / Securelist.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1036, T1566.001
  • Data sources: sysmon, windows_security
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(Image="*\\Curriculum Vitae-Catalina.exe" OR OriginalFileName="Curriculum Vitae-Catalina.exe" OR CommandLine="*Curriculum Vitae-Catalina*")
| eval parent_hint=if(match(ParentImage,"(?i)(outlook|thunderbird|olk|winrar|7z|explorer)"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent_image values(User) as user values(Hashes) as hashes max(parent_hint) as parent_hint by host Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host user Image parent_image command_line hashes parent_hint count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "Curriculum Vitae-Catalina.exe" or ProcessVersionInfoOriginalFileName =~ "Curriculum Vitae-Catalina.exe" or ProcessCommandLine has "Curriculum Vitae-Catalina"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: Curriculum Vitae-Catalina.exe Execution - XWorm CV Phishing Lure
id: 5b1e7c3a-4d29-4f6e-9a8b-1c2d3e4f5a61
status: experimental
description: Detects execution of the executable 'Curriculum Vitae-Catalina.exe' used in the Curriculum-vitae-catalina phishing campaign to deliver Backdoor.MSIL.XWorm.
references:
  - https://securelist.com/industrial-threat-report-q4-2025/119392/
  - https://ics-cert.kaspersky.com/publications/reports/2026/04/28/threat-landscape-for-industrial-automation-systems-europe-q4-2025/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\Curriculum Vitae-Catalina.exe'
  selection_original:
    OriginalFileName: 'Curriculum Vitae-Catalina.exe'
  selection_cmd:
    CommandLine|contains: 'Curriculum Vitae-Catalina'
  condition: 1 of selection_*
falsepositives:
  - A legitimate applicant file that happens to share the exact file name (extremely unlikely as an executable)
level: high

Known false positives:

  • Security teams detonating the sample in a lab or sandbox
  • Email-security or EDR testing that replays the campaign attachment name

Tuning notes: Exclude known malware-analysis hosts by host/index. The file name is campaign-specific so no threshold is needed; add the SHA256 of any sample you recover to tighten matching. Raise priority when parent_hint=1 or the host is an HR/recruiting or ICS-adjacent workstation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Resume-Themed Phishing Email with Executable Attachment (Exploitation) · unlock with TL Creds
  • XWorm Security-Tool Tampering and VM/Sandbox Checks from User-Writable Process (Post-Exploitation) · unlock with TL Creds
  • Connections to Community-Observed XWorm-Related Infrastructure and Payload URLs (C2) · unlock with TL Creds
  • Double-Extension Executable Masquerading as a Document (Exploitation) · unlock with TL Creds
  • Run Key Persistence Written by User-Writable or CV Executable (Post-Exploitation) · unlock with TL Creds
  • Community-Observed XWorm-Related Payload Hashes and Names Executed (C2 / Tool Transfer) · unlock with TL Creds
  • XWorm Scheduled Task Persistence from User-Writable Path or CV Executable (Post-Exploitation) · unlock with TL Creds
  • XWorm C2 — Outbound Non-Standard Port from User-Writable Process (C2) · unlock with TL Creds

Indicators of compromise for Europe ICS XWorm wave

As of 2026-10-31, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-4915.

8 indicators of compromise · unlock with TL Creds. Compare plans

How Europe ICS XWorm wave works

Kaspersky ICS CERT's Q4 2025 European threat-landscape report (published 2026-04-28) is built on Kaspersky Security Network (KSN) telemetry from anonymized, consenting users. It covers enterprise OT assets such as SCADA servers, historian servers, engineering and operator workstations, HMIs and building-automation systems. A computer counts as attacked when a Kaspersky product blocked at least one threat on it during the quarter.

Regional share of ICS computers with malicious objects blocked: Southern Europe 18.8% (8th globally), Eastern Europe 18.1% (9th globally, lowest in three years), Western Europe 11.2% (13th) and Northern Europe 8.5% (14th, the lowest of any region worldwide). The most affected countries were Greece (24.97%) and Malta (10.96%) in Southern Europe; Bosnia and Herzegovina (26.68%) and Poland (10.60%) in Eastern Europe; France (11.62%) and Luxembourg (4.61%) in Western Europe; and Latvia (8.73%) and Norway (4.32%) in Northern Europe. Email remained the main distribution vector in every region. Email-borne threats reached 6.34% in Southern Europe (2.3x the global average) and 3.69% in Eastern Europe.

The notable development is a rise in worm detections in all European regions, with Southern Europe up 2.16x. Kaspersky links it to the 'Curriculum-vitae-catalina' phishing campaign, in which emails posing as job applications (Curriculum Vitae) carried a malicious executable detected as Backdoor.MSIL.XWorm, a remote-administration backdoor/worm designed to persist on the host and be controlled remotely. Kaspersky ties the spread to an obfuscation technique used in mass phishing campaigns in Q4 2025 and known since 2024 under this campaign name. Securelist's global report adds that the lures targeted HR managers, recruiters and hiring staff, that the file was typically named 'Curriculum Vitae-Catalina.exe', that the threat was not seen on ICS computers in the previous quarter yet appeared in all regions in Q4 2025, and that detections came in two waves: October (Russia, Western Europe, South America, Canada) and November (peak in other regions, including Eastern Europe), subsiding everywhere in December. Worms were blocked on 1.60% of ICS computers globally (x1.6).

Ransomware: Southern Europe 0.28% (3rd globally, x1.47 quarter on quarter), with Greece at 1.03% (x3.6); Western Europe 0.10% (12th), with Austria at 0.19% (x2.71). Other category figures (Southern / Eastern / Western Europe): malicious documents 3.82% / 2.72% / 0.89%; malicious scripts and phishing pages 8.92% / 6.47% / 4.11%; spyware 5.12% / 3.95% / 1.30%; worms 1.77% / 2.06% / 0.35%.

The source report states no CVEs, hashes, C2 addresses, domains, IPs or actor attribution. This record therefore contains only the delivery filename, email subject lines and malware family names reported by Kaspersky, and attribution is Unknown. Persistence via scheduled tasks is reported by a secondary analysis (Aviatrix), not by Kaspersky, and is tagged accordingly.

MITRE ATT&CK techniques by tactic:

Stealth

T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1204.002 Malicious File

Initial Access

T1566.001 Spearphishing Attachment

Command and Control

T1571 Non-Standard Port

Defense Impairment

T1685 Disable or Modify Tools

Remediation for Europe ICS XWorm wave

Immediate actions

  • Block or quarantine executable attachments (including .exe files named 'Curriculum Vitae-Catalina.exe') at the email gateway
  • Hunt mail logs for subjects 'Resume' and 'Attached Resume' carrying executable attachments, especially delivered to HR and recruiting mailboxes
  • Search endpoints for execution of 'Curriculum Vitae-Catalina.exe' and for detections of Backdoor.MSIL.XWorm

Workarounds

  • Strip or sandbox executable and archive attachments from external senders
  • Restrict execution of unsigned binaries from user-writable and email-download paths

Longer-term hardening

  • Keep email access off ICS/OT workstations and segment IT mail users from OT networks
  • Deploy endpoint protection with behavioral detection on engineering and operator workstations, and keep AV databases current
  • Run phishing-awareness training for HR and recruiting staff on executable 'CV' attachments

Affected and fixed versions

  • Microsoft — Windows (ICS/OT workstations and servers: SCADA, historian, engineering and operator workstations, HMI)
    Vulnerable versions: Hosts where a user can run the executable attachment

Timeline of Europe ICS XWorm wave

  • Q4 2025 begins; locked-ioc-5, absent from ICS computers in the prior quarter, starts appearing
  • October wave of 'locked-ioc-4' phishing: Russia, Western Europe, South America and Canada affected (Western Europe peaked in October)
  • November wave: detections peak in other regions, including Eastern Europe; worm detections rise in all regions (Southern Europe x2.16)
  • Campaign activity subsides in all regions by December; Q4 2025 closes with worms blocked on 1.60% of ICS computers globally
  • Aviatrix publishes secondary analysis of the locked-ioc-5 campaign based on Kaspersky reporting
  • locked-ioc-6 publishes 'Threat landscape for industrial automation systems. Europe, Q4 2025'

Sources cited for Europe ICS XWorm wave

Further reading

Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats