Small and medium-sized businesses (SMBs) across Europe and North, West, and Central Africa are being targeted by malware masquerading as legitimate tools.

According to Kaspersky, cyber criminals are disguising malware and potentially unwanted applications (PUAs) as trusted tools such as ChatGPT, Microsoft Office applications ,and Google Drive.

Between January and April this year, Austria, Italy, and Germany were among the hardest hit countries in Europe, with the campaign accelerating at pace.

Austria accounted for 40% of all detected cases in which PUAs and malware mimicked legitimate brands, followed by Italy at 25%, Germany at 11%, and Spain (10%). Meanwhile, in Africa, Morocco topped the list, with 41% of all detected PUAs.

The most common threats affecting SMBs in Europe included backdoors (24%), Trojans (17%), and not-a-virus:Downloaders (16%). All of these are designed to infiltrate networks without raising suspicion, Kaspersky noted.

In Africa, not-a-virus: Downloaders dominated (55%), followed by DangerousObjects (14%) and Trojans (13%).

“Small businesses face enterprise-level threats, often with startup-level budgets," said Marc Rivero, lead security researcher at the Global Research and Analysis Team (GreAT) at Kaspersky. “The key is knowing where to focus their limited resources for maximum protection."

Kaspersky said these growing threats highlight the need for more robust employee awareness training. Enabling staff to spot the telltale signs of cyber criminal activity is crucial to preventing disaster.

The company also advised enforcing strong authentication and authorization with strict password policies and multi-factor authentication (MFA), regularly updating software and patching vulnerabilities.

Meanwhile, organizations should carry out regular training sessions, focusing on safe email practices, secure password management, recognizing phishing attempts, and the proper handling of sensitive data.

All software should come from official sources – not via search engines – and be installed centrally by the IT team to prevent hidden threats. Similarly, clear access rules should be set for emails, shared folders, and online services, with user activity monitored and access revoked promptly when employees leave the company.

"The best defense against sophisticated malware isn't the most expensive tool - it's understanding how attackers think and closing the doors they're looking for,” said Rivero.

MORE FROM ITPRO

• Warning issued as Pakistan-based malware group hits millions globally
• The best malware removal tools 2025
• What is Malware as a Service and why should businesses take note?

Almost half (40%) of US organizations are still using Kaspersky software despite a ban enacted in the summer, new research from Bitsight has revealed.

Though the ban went into effect months ago, active use of Kaspersky products remains high, with more than 1,000 US organizations observed to be connecting to Kaspersky servers post-ban.

Bitsight said only 58% of US organizations observed using Kaspersky products appear to have eliminated their usage of the cybersecurity platform.

Strikingly, given this ban came from the governmental level, Bitsight’s research revealed 19 government agencies in the US were observed to be communicating with Kaspersky update servers as of November 2024.

Bitsight said its research is based on observing connections and communications between global IP addresses associated with specific organizations and Kaspersky update servers.

The firm acknowledged its research may have also captured traffic being used to perform security research or intelligence collection.

Though the US introduced the ban, it has not seen as restrictive a move as in other countries. According to Bitsight’s analysis, the US is the country with the largest number of organizations using Kaspersky.

By comparison, global usage of Kaspersky has seen a dramatic decrease in organizations operating in countries that do not have formal bans on Kaspersky technology.

Between April and November 2024, the number of global organizations communicating with Kaspersky dropped from 22,000 firms and 7 million unique IP addresses to 8,000 firms and 2 million unique IP addresses.

Inside the Kasperky ban

The US government originally banned Kaspersky based on supposed links to the Russian government. Lawmakers claimed use of the software could be a risk to national security as it could be used to steal corporate data or install malware.

Fear of Kaspersky had been long-running before the ban, with tensions surging after Russia’s invasion of Ukraine and the US, UK, and Germany all issuing warnings about the software.

Kaspersky has not kept quiet. A statement from Kaspersky following the ban insisted that allegations of ties to the Russian government are false, and that the ban decision is politically motivated.

“Kaspersky believes that the Department of Commerce made its decision based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of Kaspersky’s products and services,” the firm said.

About a month after news of the ban emerged, it announced that it would be shutting down its operations in the US.

Four-in-ten cybersecurity teams are understaffed, with senior team members particularly hard to find, according to new research.

While seven-in-ten junior cybersecurity staff positions are typically filled within six months and only 3% of roles take more than a year to fill, things are very different further up the hierarchy.

More than half of companies told Kaspersky it takes between four and nine months to find suitable candidates, and 36%, nine months or more. Only 6% of roles are filled in less than three months.

The good news, though, is that these senior InfoSec professionals tend to stay longer in their roles, with 49% remaining in top-level positions for more than five years. Junior employees have a higher turnover rate, with most staying three to four years and only 3% remaining beyond five years.

The main reasons for quitting include personal factors such as compensation issues, inadequate working conditions, and lack of management support.

However, a significant portion of professionals cited the need for continuous skills development as well as growing frustration with not having opportunities to work with the latest technologies and tools.

Overall, professional dissatisfaction is the leading cause of resignations, with lack of growth opportunities being the main reason, cited by 58%.

Burnout is still pervasive in cyber

Lack of management support and monotonous work are also significant factors, with both the main reason for leaving for around half of job-seekers. High stress levels and inflexible working policies were also factors.

Notably, the study from Kaspersky showed burnout is still rampant InfoSec professionals, who feel they're accomplishing very little in the face of monotonous work and constant monitoring of security alerts.

"To combat burnout, companies must rethink their approach to managing InfoSec teams. They need to find ways to relieve the stress faced by InfoSec professionals, provide them with tools to alleviate pressure, and offer support and feedback," the researchers said.

"Automation plays a key role in this process, significantly reducing the daily burden on professionals by handling repetitive tasks such as monitoring alerts, analyzing logs, and responding to low-level threats. This shift allows professionals to focus on more complex and rewarding tasks, enhancing job satisfaction and career growth."

Burnout is rife in the tech profession generally, with nearly three-quarters of software developers experiencing it at some point in their career, according to JetBrains’ 2023 State of the Developer Ecosystem report.

And it's particularly common in security departments. In a survey last year, CyberArk found nearly two-thirds of staff struggle to contend with growing workloads, and more than two-thirds of C-suite executives said burnout is fueled by heightened threat levels, which is affecting their ability to make critical, high-level decisions.

Kaspersky recommends that organizations should bring in reward systems and recognition programs to boost morale, along with training, evaluating staff, and providing regular feedback.

They should ensure management support, rotate employees’ roles, and manage workloads to prevent monotony and reduce stress, while also automating processes for routine tasks.

Russian security company Kaspersky is shutting operations in the US ahead of sanctions that will ban sales of its software nationwide. 

The move comes amid ever-worsening relations between the US and Russia, exacerbated by the war in Ukraine, but Kaspersky has been answering questions about its ties to its home country for years.

After a series of recent sanctions, Kaspersky confirmed to security site Zero Day that it was winding down operations and cutting staff, though the total headcount being laid off is fewer than 50.

"Kaspersky has been operating in the US for close to 20 years, contributing to the nation’s strategic cybersecurity goals by safeguarding organizations and individuals in the country from ever-evolving cyber threats," a spokesperson for Kaspersky told ITPro.

"The company has carefully examined and evaluated the impact of the US legal requirements and made this sad and difficult decision as business opportunities in the country are no longer viable."

Kaspersky’s slow march to a full ban

Kaspersky was founded in Moscow, Russia in 1997, by Eugene Kaspersky, Natalya Kaspersky, and Alexey De-Monkerik, and first began selling overseas in 2005. It has divisions in the UAE, Turkey, the UK, Mexico, South Africa, Brazil, and Singapore. 

The Russian connection has long been a tough sell. Eugene Kaspersky told ITPro in 2016 that geopolitics was always a concern for a security lab with "Russian roots", but that the company does its "best not to be connected [to one country], to be international."

But that didn't convince the American government. In 2017, the US government ordered all civilian agencies to remove all Kaspersky systems from their networks amid concerns about the relationship between "certain Kaspersky officials and Russian intelligence".

Concerns were also raised that aspects of Russian law could force the company to intercept communications, the Department for Homeland Security said at the time.

Later that year, Lithuania followed suit by banning Kaspersky software from sensitive computers at government agencies or those that control critical infrastructure. The next year, the Netherlands also began cutting out Kaspersky from government systems, and the US expanded its ban to military systems.

Kaspersky responded by holding international customers' data in Switzerland rather than Russia, as part of a wider transparency effort.

Rising tensions after the Ukraine invasion 

Days after the invasion of Ukraine by Russia in 2022, the US government privately issued warnings to local companies, suggesting that Kaspersky software could be abused by the Russian government to wreak havoc among American companies or for wider cyber attacks. 

In June, the US government said it would ban new sales of Kaspersky's antivirus, not just for government agencies but across all businesses.

"Russia has shown it has the capacity and ... the intent to exploit Russian companies like Kaspersky to collect and weaponize the personal information of Americans and that is why we are compelled to take the action that we are taking today," Commerce Secretary Gina Raimondo said in a call with reporters at the time, according to Reuters.

Kaspersky hit back at the move, claiming the decision was based entirely on "theoretical concerns". 

The Russian government, meanwhile, said the sales restriction was nothing to do with security but a "favorite technique of unfair competition from the United States." The US responded by sanctioning 12 Kaspersky employees, including c-level leadership.

End of US operations 

Now, Kaspersky said it would wind down operations by 20 July, the same day the ban on new business comes into effect. All software updates, sales, and resales will be banned as of 29 September. 

"Starting from July 20, 2024 Kaspersky will gradually wind down its US operations and eliminate US-based positions," the statement from Kaspersky added.

"The decision and process follows the Final Determination by the US Department of Commerce, prohibiting the sales and distribution of Kaspersky products in the US.

"Kaspersky’s business remains resilient, and our key priority remains the same – to protect our customers in any country from cyberthreats. Being a global cybersecurity vendor, the company will continue investing in strategic markets and remain committed to serving its customers and partners and ensuring their protection."

Cyber criminals are offering ready-made botnets on the dark web for as little as $99, according to Kaspersky, making cyber attacks cheaper and easier than ever to carry out.

Botnets like Mirai - which targets online consumer devices such as IP cameras and home routers - have individually tailored infection processes, malware types, infrastructure, and evasion techniques.

According to recent research from Cloudflare, 4% of HTTP DDoS attacks, and 2% of L3/4 DDoS attacks, were launched by a Mirai-variant botnet during the first quarter of this year.

"Mirai is one of the most infamous examples of a botnet. It scans the internet for IoT devices with weak default passwords, uses a set of known default credentials to gain access, and infects them," said Alisa Kulishenko, security analyst at Kaspersky Digital Footprint Intelligence.

"The infected devices then become part of the botnet, which can be controlled remotely to perform various types of cyberattacks."

Since the beginning of this year, Kaspersky researchers found more than 20 offers for botnets for hire or sale on dark web forums and Telegram channels. The lowest offers started at $99 and the highest reached $10,000, researchers said.

As well as being available as one-time purchases, botnets can be hired or acquired as leaked source code for between $30 and $4,800 per month, with custom botnet development also available in some cases.

Access to leaked source code can be obtained for free or a fee of between $10 and $50, based on information from approximately 400 dark web and shadow Telegram posts observed since the beginning of 2024.

However, Kaspersky said leaked botnets are generally deployed by less sophisticated actors, as they are more likely to be detected by security solutions.

"Potential earnings from attacks using botnets for hire or sale can exceed the associated costs. They allow for activities such as illegal cryptocurrency mining or ransomware attacks, and more," Kulishenko said.

"Open sources report that an average ransom payment is two million US dollars. In contrast, renting a botnet costs significantly less and can pay off with just one successful attack."

A threat actor can also commission a botnet to be developed from scratch, with development costs varying widely, but starting at just $3,000.

"Most of these deals occur privately, through personal messages, and partners are typically chosen based on reputation, such as forum ratings," Kulishenko noted.

Botnet activity is on the rise

Earlier this year, researchers at NetScout said they'd discovered a sharp rise in global botnet activity, spiking at more than a million devices.

Meanwhile, a Trustwave report last year found that botnets were responsible for more than 95% of all the malicious traffic on the internet, with the Mirai, Mozi, and Kinsing botnets accounting for almost all exploit attempts that were run over the HTTP or HTTPS protocols.

Global law enforcement action to tackle botnets has been escalating in recent years, with a series of high-profile takedowns crippling operations. But while these operations often inflict initial damage, history shows that many come back with a vengeance.

Qakbot, ranked among one of the most prolific botnets of all time, was taken down last year in a US-led operation. But within weeks of the sting operation, there were signs of recovery.

In October 2023, researchers at Cisco Talos warned that Qakbot-affiliated hackers still remained a pervasive threat, with threat actors in fact waging a devastating ransomware campaign that began “just before the takedown”.

Qakbot’s return isn’t an isolated example, either. Emotet, another notorious botnet, made a return after a law enforcement takedown.

Small and medium sized businesses (SMBs) are increasingly being hit by cyber attacks, according to new research, with Microsoft Excel the number one channel of attack.

Analysis from Kaspersky shows, the number of infections experienced by SMBs in the first quarter of this year rose by 5% compared to the same period last year.

More than 2,400 firms encountered malware and unwanted software hiding in or mimicking software products, with 4,110 unique files distributed under the guise of SMB-related software.

This, the firm said, represents an 8% increase year-on-year and implies that the activity will only continue to increase.

"Although SMBs might be under the illusion they are not a target, they belong to a huge ecosystem of interconnected assets and cyber criminals will exploit any weakness," said Vasily Kolesnikov, a cybersecurity expert at Kaspersky.

The most common type of attack continues to be Trojans. These are especially hazardous, Kaspersky said, because unlike viruses they cannot self-replicate and usually mimic legitimate software, allowing them to evade traditional security measures.

The number of Trojan attacks between January and April this year hit 100,465 - a 7% increase on the same period in 2023.

The next highest threat came from the DangerousObjects malicious software, with 17,320 attacks recorded – nearly seven thousand more than in 2023, and the fastest-rising threat year on year.

Microsoft Excel is once again the number one channel of attack, moving from fourth to first place between 2023 and 2024. Microsoft Word is in second place, with Microsoft PowerPoint and Salesforce the third-most targeted applications.

Kolesnikov said threat actors are ramping up attempts to exploit Excel in cyber attacks due to the popular use of the software among small businesses.

"The ubiquitous use of Microsoft Excel in office environments provides fertile ground for cyber criminals who can hide and manipulate malicious data in large datasets that are then widely shared across a business," Kolesnikov commented.

Human error is still a big threat, however, with phishing attacks distributed via various channels, including spoofed emails and social media.

In recent years, Kaspersky said it's observed a trend of spreading web pages that mimic the most commonly used Microsoft services, such as Microsoft 365, Outlook and OneDrive.

This technique exploits the tendency for businesses to use a single software package for all business purposes, making its users more dependent on particular applications and services and thus more susceptible to this attack vector.

Meanwhile, attackers are using legitimate Facebook infrastructure to compromise corporate social media accounts, with Kaspersky uncovering numerous cases of attackers mimicking genuine social media login pages.

The company said it's discovered multiple cases of SMB-oriented spam.

"It is critical for all SMBs to create clear policies for accessing any corporate assets and ensure that staff are regularly reminded of the importance of following basic cybersecurity rules," Kolesnikov said.

The majority of passwords can be easily guessed or cracked by hackers, new research shows, prompting renewed calls from security experts to bolster password security practices. 

In a study conducted by Kaspersky, the security firm analyzed 193 million compromised passwords available on the dark web and the results of the investigation indicated 45% of the passwords could be guessed by hackers within a minute.

The study calculated that hackers armed with a high-performance laptop CPU would be able to brute force an eight-character password composed of lowercase letters and digits in 7 minutes.

Only 23% of the analyzed passwords met the requirements to be classified as resistant, meaning they would take an attacker over a year to compromise on average.

Over half (57%) of the examined passwords contained a word from the dictionary, which experts agree significantly reduces a passwords’ strength.

Furthermore, just 14% of passwords contained ‘signs’ of a strong, difficult-to-crack combination, which would include both uppercase and lowercase letters as well as numbers, and symbols.

Speaking to ITPro, Mark Lomas, technical architect at technology services provider Probrand, said passwords have been the Achilles heel in many enterprises’ security posture, and are one of the top targets for threat actors looking to save time gaining initial access.

“Passwords have long been the weak link in security. It's often said that in many successful attacks, criminals don't 'hack' in, they just log in. They do so by gaining the password using a variety of techniques,” he explained.

“These could include phishing to trick someone into handing over a password, stealing credentials if someone has used the same password in multiple places which might have then leaked onto the dark web, for example, or simply by using brute-force attacks.”

Increasing password complexity makes them harder to manage

Chris Hauk, consumer privacy advocate at Pixel Privacy, told ITPro businesses need to ensure they are educating their staff on how to create unique and secure passwords, outlining his criteria for a robust password.

“Passwords should be lengthy and should at a minimum be 12 characters or more and should be made up of a mix of uppercase and lowercase letters, symbols, and numbers," he explained.

“Never use guessable passwords, like pet names, birthdays, parents' maiden names, birthdays, or anything else that could be easily determined. Passphrases (long strings of words or sentences) make passwords both strong and memorable.”

While creating more complex passwords is advised, this does have certain downsides, according to Joel Rennich, VP of Product Strategy at JumpCloud.

Speaking to ITPro, Rennich noted that increasing password complexity makes them far harder to remember, and sometimes encourages users to dumb them down again to make them easier to recall when logging in.

"As the number and complexity of passwords increases, they become harder for users to remember,” he said. “And while length and complexity requirements align with many organizations’ best practices, too many long passwords could drive users to resort to unsecure methods for remembering them or re-use the same password across multiple business accounts.”

The solution, according to Rennich, as well as Hauk, is using a password manager that allows users to use unique, complex passwords across a wide range of accounts without the fear of forgetting them and having to go through tiresome password reset processes.

“To begin with, password managers relieve users of the burden of memorizing passwords and increase the IT department’s control and visibility over users’ passwords and their use,” Rennich argued.

“Password managers allow businesses to enforce password creation rules (including stronger passwords that do not need to be remembered), send update reminders, and safely share and manage access to the right resources and applications.”

Stronger passwords aren’t enough in the modern threat landscape

Using more complex passwords or credential management tools isn’t the only way to prevent compromise, however. Increasingly, organizations globally are adopting passphrases, according to Rick Jones, CEO and co-founder of DigitalXRAID. 

Jones told ITPro that even eight-character passwords are still susceptible to passwords, and called for a more comprehensive industry shift toward passphrases. 

“Statistics show that an eight character password hash can be cracked in a matter of minutes by a password cracking rig, while an 18-character password takes far longer. This dramatic increase should be reason enough to switch to passphrases rather than passwords,” he said. 

Probrand’s Lomas stated that due to the damage they can cause if they fall into the wrong hands, many security vendors have been trying to transition away entirely from the login methods that can be stolen. 

“Vendors have been working to move away from passwords entirely, and towards solutions that rely on login protection factors that can't be stolen or phished. Various solutions have been pushed forward, but we're starting to finally see the emergence of some standards around this,” he explained.

“Solutions like passkeys for example, are beginning to enter use with online services. In the corporate space, solutions like physical tokens have already been established around standards like FIDO2 WebAuthN.”

Additional security layers such as multi-factor authentication (MFA) are also essential for adequate identity security, according to Raj Samani, SVP and chief scientist at Rapid 7.

“We’ve seen with recent breaches that password leaks are rife. As a result, even with good password hygiene, we need to go one step further,” he said. “Multi-factor authentication (MFA) is vital and with 41% of incidents due to missing or unenforced MFA, for many is the biggest security accomplishment which can be made if not already implemented. Implementing this solution in tandem with basic password hygiene can greatly improve an organization’s security posture.” 

Cyber security vendor Kaspersky has hit out at plans by US lawmakers to ban sales of its antivirus software. 

Reports emerged on 20 June that the US government is set to prohibit the sale of Kaspersky products amid concerns over alleged links between the firm and the Russian government.

Under the plans, which are expected to come into force in late September, inbound sales of Kaspersky software will be banned for US companies. This will include any software updates, resales, and licensing of the product by US suppliers.

Sales of white-labeled products – those that use Kaspersky software under a different name – will also be barred.

The move marks the latest flashpoint in a long-running war of words between Kaspersky and US legislators, who have repeatedly argued that Kaspersky has links to the Russian government that present a national security risk.

Officials have previously suggested that elements of Russian law mean the government could lean on the company for intelligence-gathering purposes.

In a statement given to ITPro, Kaspersky insisted these allegations are false, and said the US Department of Commerce’s decision to float a product ban is politically motivated.

“Despite proposing a system in which the security of Kaspersky products could have been independently verified by a trusted third party, Kaspersky believes that the Department of Commerce made its decision based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of Kaspersky’s products and services,” the firm said.

The company added that it “does not engage in activities which threaten US national security” and has made “significant contributions” by reporting on –and protecting against –threat actors that have actively targeted US institutions.

Kaspersky appears to be preparing for a lengthy battle to argue its case against any proposed ban.

“The company intends to pursue all legally available options to preserve its current operations and relationships,” Kaspersky said.

Kaspersky says ban proposals will harm enterprises

In its statement, Kaspersky said it has implemented “significant transparency measures that are unmatched by any of its cyber security industry peers” to show it’s free of any government interference. 

In 2018, the company announced plans to relocate some of its operations from Russia to Switzerland. The move, which formed part of its Global Transparency Initiative (GTI), took more than two years to complete. 

The company said at the time it chose Switzerland due to its "policy of neutrality"

Kaspersky suggested that the US' decision to impose a ban "unfairly ignores" evidence of proactive efforts to improve transparency and warned the decision will negatively impact its customers. 

The company argued that a ban would ultimately aid threat actors and have a detrimental effect on international efforts to combat cyber crime.

“The primary impact of these measures will be the benefit they provide to cybercrime,” the firm said. “International cooperation between cyber security experts is crucial in the fight against malware, and yet this will restrict those efforts.

“Furthermore, it takes away the freedom that consumers and organizations, large and small, should have to use the protection they want. This will cause a dramatic disruption for our customers, who will be forced to urgently replace technology they prefer and have relied upon for their protection for years.”

The US government is set to ban the sale of Kaspersky Lab's antivirus software in the US, according to reports from Reuters.

Citing sources familiar with the matter, the move is reportedly due to alleged links between the cyber security vendor and the Russian government.

Lawmakers are worried the use of the software by US firms might pose a serious risk to national security and critical infrastructure as it could be used to steal corporate data or install malware.

The move will be made possible using powers introduced by the Trump administration and will see the company added to a trade restriction list, Reuters noted.

These powers were initially introduced to limit the use of products created by companies operating in “foreign adversary” nations.

This will, in practice, prevent US suppliers from selling to the company and also prevent inbound sales of Kaspersky software – including updates, any resales, and licensing of the product.

Sales of white-labeled products – or those that use Kaspersky software sold under a different name – will also be barred, sources told Reuters.

The ban is expected to come into force by 29 September to provide US firms with ample time to seek alternatives.

Kaspersky has long denied its ties to the Russian government

The move by US lawmakers marks the latest incident in a long-running spat between Kaspersky and Western governments. Critics have previously argued that the security company represents a security risk due to its alleged ties to the Russian government. 

In 2017, the US Department of Homeland Security banned the firm’s antivirus product from being used on federal networks due to these concerns.

At the time, the department argued that aspects of Russian law could allow intelligence agencies to strongarm the company into providing assistance to intercept information.

Following Russia's invasion of Ukraine in early 2022, the company was declared a “national security risk” to the US and placed on an FCC blacklist.

ITPro has approached Kaspersky for comment.

There were more than two critical cyber incidents with direct human involvement per day last year, according to new research from Kaspersky.

The company's annual Managed Detection and Response (MDR) Analyst Report concludes that nearly a quarter of incidents were driven by humans.

Just over one-in-five involved various types of cyber exercises which had been previously classified by Kaspersky as targeted attacks, but which were redesignated after explanation by the customer.

The government sector was hardest-hit, accounting for 22.9% of all detected high-severity incidents. IT companies came second. at 15.4%, closely followed by financial and industrial companies with 14.9% and 11.8% of incidents respectively.

The most incidents per 10,000 devices were found in mass media organizations, development companies, and government agencies.

Despite concerns over human-related errors, Kaspersky noted that the percentage of malware attacks resulting in serious consequences dipped slightly last year, accounting for just over 12% of the total reported critical incidents.

This, the company noted, marks the smallest share of high-severity incidents in recent years.

This trend can be attributed to the commoditization of attacks through the widespread adoption of existing tools, originally designed for conducting targeted campaigns which, due to deliberate or accidental leaks, have become common.

These tools are now being repurposed in attempts to implement fully automated attacks, says the firm.

"In 2023, Kaspersky detected a smaller number of high-severity incidents, but observed a simultaneous increase in the number of medium and low severity ones. This redistribution of occurrences is associated with the detection of malware without visible traces of active human participation in attacks, which can be explained by the commoditization of tools," said Sergey Soldatov, head of security operations center at Kaspersky.

"However, it’s important to understand that the low number of high-severity incidents does not necessarily indicate low damage. Targeted attacks are now planned more carefully, and become more dangerous. Therefore, we recommend the use of effective automated cybersecurity solutions managed with the help of experienced SOC analysts."

Malware attacks accounted for just over 12% of incidents - the lowest proportion yet, according to the firm. Most were classified as medium or low severity.

Fewer than one-in-twenty related to publicly available critical vulnerabilities, while around 4% were the result of successful social engineering with further attack development.

And fewer than 1% of incidents were linked to insiders, while nearly one in three related to suspicious activity from legitimate accounts with no visible signs of compromise.

Almost one-in-ten incidents involved Living Off the Land Binaries - LOLBins - with the figure rising to a third of high-severity incidents. The most popular LOLBins were powershell.exe and rundll32.exe, which were used in 2% of all incidents and in 12% of critical incidents.

Meanwhile, a relatively high number of incidents were associated with the detection of adding accounts to various privileged groups such as domain admins or enterprise admins.

Cyber security specialist Kaspersky has announced the promotion of Alfonso Ramirez to the role of managing director for Europe.

A seasoned industry veteran, Ramirez brings more than 20 years’ experience to the role, including success in shaping development strategies and driving business growth within the IT business sector.

He first joined Kaspersky in 2008 as director of consumer business in Iberia, working to position the company’s consumer products in the region, and was later promoted to general manager, where he spent ten years directing the firm’s business strategies across Spain and Portugal.

Prior to joining Kaspersky, he held various senior sales and marketing positions at multinational companies.

In his new role as managing director for Europe, Ramirez will leverage this experience to lead Kaspersky’s consumer and corporate strategies across the wider continent.

“We are thrilled to welcome Alfonso Ramirez to lead our European operations," said Robert Cataldo, Kaspersky’s vice president of global sales. 

"His extensive experience leading our markets in Iberia and strategic acumen will be instrumental in promoting Kaspersky's technology leadership approach in the region."

Founded in 1997, Kaspersky provides a portfolio of cyber security and digital privacy solutions and services that incorporate endpoint protection, specialized security products, as well as its Cyber Immune solutions. The company currently serves more than 400 million customers worldwide, as well as over 220,000 corporate clients.

As new managing director for Europe, Kaspersky said Ramirez will leverage the firm’s broad distribution and partner network to capitalize on business growth and revenue opportunities for all strategic segments – with a particular focus on cyber security for both enterprises and SMBs.

"I’m honored to embark on this journey to lead the European business,” Ramirez said. “In the ever-expanding threat landscape, companies and individuals alike are increasingly vulnerable to cyber threats and often do not have the right security measures in place.

“We believe that our award-winning approach is the cornerstone of the future of cyber security, and I am confident in our ability to propel our business to new heights in Europe, contributing to Kaspersky’s mission of building a safer world."

Cyber security training costs organizations around $100,000 on average each year, according to research from Kaspersky, highlighting the steep price of battling long-running skills gaps.

Analysis from the cyber security firm showed nearly half (43%) of firms usually spend between $100,000 and $200,000 per year on information security courses for staff, while around one-third are spending more.

Just one-quarter of respondents told Kaspersky they spend less than $100,000 on educational initiatives.

Despite these efforts though, many cyber security practitioners believe they’re not offered adequate training to contend with an escalating threat landscape. Around 40% of respondents told Kaspersky that training courses were inadequate, or few and far between.

Some said they are willing to pay for additional training courses out of their pocket to ensure their knowledge and skills are up to date.

Cyber security training costs aren’t the only hindrances

According to Kaspersky, the costs of cyber security training isn't the only issue organizations are contending with in 2024. 

The study found the education/training market is struggling to keep up with current demands, with many failing to deliver the necessary training programs and learning materials on time.

The shortage of courses covering new challenging spheres was the main problem for those searching for cyber security training, cited by more than half of respondents.

Meanwhile, nearly half said that trainees tend to forget what they've learned because they have no opportunity to apply their newly-acquired knowledge.

The need for special training prerequisites such as coding and advanced mathematics, which weren’t actually specified at the pre-registration stage, were also a problem for 45%.

How can firms bolster cyber security training?

Kaspersky said one of the best strategies for maintaining cyber security skills is to develop high-profile specialists within the company and build internal expertise, rather than simply hunting for new candidates. 

"With a constantly evolving threat landscape, businesses should continually improve the skills of their cybersecurity personnel in order to be well prepared for sophisticated cyberattacks," said Veniamin Levtsov, VP, center of corporate business expertise at Kaspersky.

"For organizations served by managed service providers, it is also important to maintain a pretty high level of expertise internally and use the same language when discussing the scope of services and service level agreement with them."

Skills shortages still run rampant

According to the report, there is still a significant cyber security skills shortage, with 40% of InfoSec professionals noting their organization’s cyber security teams are somewhat or significantly understaffed. 

These shortages are the worst in Russia, followed by Latin America, the Asia–Pacific region and the Middle East, Turkey and Africa, while the least understaffed regions are Europe and North America.

Information security research and malware analysis are the most understaffed roles globally, cited by four-in-ten, while the biggest recruitment challenges are the discrepancy between certification and practical skills and lack of experience, both cited by around half.

Almost half of security professionals claim it takes more than six months to fill an information security position.

The good news for cyber security staff is that the ongoing skills shortage is causing salaries to rise, with a recent report from Cybershark Recruitment finding that salaries in 17 out of 20 categories of cyber security work increased last year.

These rises were highest in critical national infrastructure, digital forensics, identity and access management (IAM), and business continuity management.

Over 50% of acting cyber security professionals have admitted to making mistakes early in their career due to a lack of technical knowledge, new research suggests. 

The study, conducted globally by Kaspersky, found that this percentage rose to nearly 60% in those with just two-to-five years of experience in cyber security. 

There were several areas in which cyber security professionals reported practical and theoretical knowledge to be missing, according to the study

43% admitted that they failed to update software, 42% said that they were guilty of using weak and easily-guessed passwords, and 40% of surveyed staff claimed they had neglected to perform backups in a timely manner. 

All these mistakes, the professionals said, were made early on in their careers. In North America and the Asia-pacific region, the use of outdated security measures was also cited as a common mistake made by cyber security experts at the beginning of their career. 

Kaspersky said the research highlights the importance of robust training for early-stage cyber security professionals, especially given that over two-thirds (64%) of all security incidents were due to human error. 

Some cyber security workers “lack confidence”

Over the past two years, every organization has fallen victim to “at least one” cyber security incident as a result of underqualified or undertrained staff, according to Kaspersky. 

Undertrained staff take longer to get comfortable in their roles, with nearly half (46%) of all cyber security employees stating it took over a year for them to feel confident in their InfoSec positions.  

While 31% managed to get to grips with the job within one or two years, nearly 10% claimed it took them two or three years, and 6% said it took more than three. 

Company recruitment teams need to shoulder some of the blame as well, though, Kaspersky said Over one-third (34%) of respondents said they had three or more failed interviews before being selected for an InfoSec role.

This points to knowledge gaps within companies as a whole, suggesting that many businesses don't know what to look for in a cyber security expert. 

Recent research from recruitment firm Hays found that over three-quarters (78%) of tech employers were willing to employ IT staff without the necessary requirements as an attempt to mitigate the tech skills gap, with the intention of upskilling in the future. 

With current estimates putting that cyber security workforce shortfall at nearly 4 million, the skills deficit is placing significant strain on the task of mitigating cyber security risks.

“It’s no secret that formal training programs often struggle to keep up with industry developments, and that is especially true for the cybersecurity field,” said Marina Alekseeva, chief human resources officer at Kaspersky. 

“The fact that many employees in the market might have limited practical skills or gaps in their knowledge underlines the importance of a comprehensive onboarding process with a focus on peer learning and means companies must pay more attention to the upskilling of their employees,” she added.  

Kasperysky’s study suggests a program of education which is flexible and adaptable to regularly changing InfoSec demands, while also encouraging the use of practical cyber security exercises and upskilling procedures. 

Many employees are deliberately circumventing their organization’s security procedures, according to new research from Kaspersky.

Analysis from the firm found that a considerable portion of cyber incidents are attributed to workers disregarding security protocols. In the last two years, for example, 26% of cyber incidents occurred after a staff member violated procedures. 

The issue has reached such a scale that the level of danger breaches of this nature pose to businesses is almost equal to that of external threats, such as hacking, Kaspersky warned.

Both IT and non-IT employees were found to be circumventing security procedures, the study found. Around 13% of cyber security incidents since 2021 were caused by intentional information security violations from IT security officers, for example. 

In terms of the specific actions causing these policy violations, the study revealed employees in 12% of polled organizations had intentionally used unauthorized devices to access sensitive data.

Additionally, other businesses reported 12% of their staff were found to have sent sensitive information to their personal email address. 

Potentially the most alarming finding from Kaspersky’s research is that 20% of malicious actions were made by staff for personal gain. 

This also implies another portion of intentional breaches were caused by employees who simply did not want to follow sometimes tedious security procedures.

Accidental breaches are still the most common security incidents affecting firms

Despite the concerning findings around intentional policy violations, the report shows the majority (38%) of cyber security incidents are still caused by accidental human error.

Breaking these incidents down by the actions that caused them, Kaspersky found downloading malware to be the leading cause of incidents by non-IT personnel, accounting for 28% of accidental breaches. 

A quarter of respondents said using weak passwords, or failing to update them regularly was to blame for the incident, and 24% said they were responsible for a breach when they visited an unsecured website. 

Accidental breaches were not solely caused by non-IT staff, however, 14% of cyber incidents caused by unintentional human error were attributed to senior IT professionals.

Ensuring all employees, regardless of department or seniority, have robust cyber hygiene habits is critical for an organization to implement an effective security posture, according to Kaspersky.

Alexey Vovk, Kaspersky’s head of information security, underlined the necessity of a holistic approach to security and compliance in addressing the risks posed by employee behavior. 

“Along with external cybersecurity threats, there are many internal factors that can lead to incidents in any organization. As statistics show, employees from any department, whether it's non-IT specialists or IT Security professionals, can negatively influence cybersecurity both intentionally and unintentionally,” he said. 

“That is why, it is important to consider methods of preventing information security policy violations when ensuring security, i.e. to implement an integrated approach to cybersecurity.

“As the numbers are alarming, it is necessary to create a cybersecurity culture in an organization from the get-go by developing and enforcing security policies, as well as raising cybersecurity awareness among employees. Thus, the staff will approach the rules more responsibly and clearly understand the possible consequences of their violations.” 

Executives are increasingly worried that employees are using generative artificial intelligence (AI) at work without explicit permission, but are failing to act on these concerns according to a new report.

Almost all (95%) of the C-suite executives surveyed in a new Kaspersky report said they think popular AI tools such as ChatGPT are being used within their business, while 59% expressed serious concerns that their use could lead to a leak of confidential data.

There have already been cases in which employee use of AI tools has led to sensitive data leakage. In April, TechRadar Pro reported Samsung workers inadvertently handed trade secrets to OpenAI by using ChatGPT for programming help on source code.

Cyber security firm Kaspersky took in responses from 1,863 C-suite executives across the UK, France, Germany, Greece, Italy, Netherlands, Romania, and Spain between 25  September and 2 October 2023.

Results showed that executive anxieties stemmed largely from a pervasive lack of trust and understanding of how generative AI tools use data: most of the respondents (91%) said they want more insight into how generative AI works.

Despite all this, just 22% of surveyed executives said they had even had discussions about putting rules in place for generative AI.

A quarter (25%) of executives said they will allow employees to use generative AI as they are currently, and a further 6% stated that they have no strong feelings about whether employees use the technology or not.

The number of executives actively intending to implement generative AI solutions at their business also remained high, with 50% stating they would use the technology to automate tiring manual tasks and 44% hoping they can use it to lighten the workload at their own level.

Almost a quarter (24%) of executives stated they were eager to automate their IT and cyber security teams using generative AI, even as fears around the technology persist among the majority of respondents.

"One might assume that the prospect of sensitive data loss and losing control of critical business units might give the C-suite pause for thought, but our findings reveal that almost a quarter of industry bosses are currently considering the delegation of some of their most important functions to AI,” said David Emm, principal security researcher at Kaspersky.

“Before this happens, it is imperative that a comprehensive understanding of data management and the implementation of robust policies precede any further integration of [generative] AI into the corporate environment.”

How and where employees are using generative AI was a point for speculation among respondents.

More than half (53%) had suspicions that generative AI is already being used to entirely replace some tasks within certain departments in secret, with 25% suggesting it is being used in the IT department and 19% suspecting their marketing teams.

The tasks that employees are suspected of using AI for include writing emails, with 49% of executives identifying this as a common use for generative AI tools, as well as for finding efficient ways to get through to-do lists.

Both are in line with the range of AI productivity tools being offered by public cloud providers such as Duet AI and Copilot, produced by Google and Microsoft respectively. While both of these services have been built with the enterprise in mind and have additional data security measures, public-facing or free generative AI services may come with no such guarantees.

Within the suspected use cases, it is clear that C-suite executives see generative AI tools as a path to productivity gains and that there is pressure to adopt the technology or fall behind. Just under half (49%) were either ‘very’ or ‘fairly’ concerned about losing a competitive advantage if they did not use generative AI more.

Recent research by Gartner found that among businesses adopting generative AI solutions, more than a third are investing in AI application security solutions as a mitigation strategy against AI flaws.

Russian cyber security firm Kaspersky Lab has discovered covert spyware on its staff’s iPhones that dates back to at least 2019.

The advanced persistent threat (APT) campaign, which Kaspersky has dubbed Operation Triangulation, involves the infection of iOS devices through the iMessage app in order to steal user data.

Researchers said they discovered evidence of the campaign targeting its own staff dating as far back as 2019, and that it, at the time of writing, remains an ongoing threat.

Kaspersky believes the intention of the attack was to place spyware on devices belonging to senior employees at the cyber security company.

The attack is thought to begin with a hidden iMessage being sent to victims, which contains a malicious attachment. This initial payload is then triggered on a device without user knowledge through a zero-click vulnerability.

Once active, the package connects to the attackers’ command and control (C2) server to download a much larger payload. This exfiltrates personal data, microphone recordings, geolocation information, and photos sent on messaging apps.

“Our experts have discovered an extremely complex, professional targeted cyberattack that uses Apple’s mobile devices,” wrote Kaspersky Lab CEO Eugene Kaspersky.

“The purpose of the attack is the inconspicuous placing of spyware into the iPhones of employees of at least our company – both middle and top management.”

Although the closed nature of iOS has impeded efforts to analyze the Triangulation payload, initial research showed that it exploits iOS flaws to perform privilege escalation.

This allows it to run code with root privileges, in which the malware effectively gains total control over a system with the power to amend or remove even core system files.

Kaspersky Lab discovered Operation Triangulation while conducting a scan of its Wi-Fi network traffic.

Malicious activity can be identified in network traffic including network interaction between iMessage and the domain ‘*.ess.apple.com’, connections to a series of known C2 domains, or the download of an encrypted, 242 Kb iMessage attachment.

Another indicator of compromise for Operation Triangulation that has already been found is the appearance of a process titled ‘BackupAgent’ in a device’s data usage lines. Infected devices are also unable to update to the latest version of iOS.

Researchers are confident that the firm is not the main target of Operation Triangulation, but stopped short of speculation over who may be. Further investigation will look at the international spread of the campaign.

Eugene Kaspersky noted that this is not the first time his company has fallen victim to a targeted malware campaign.

He cited Duqu 2.0 as one example, an APT which was discovered on Kaspersky Lab systems in 2015. This sophisticated worm exploited zero-day vulnerabilities in Windows to steal data without detection and did so for three months before being rooted out.

The threat actors behind the sophisticated attack have not yet been identified. 

Reuters reported that Russia’s Federal Security Service (FSB) accused the US National Security Agency (NSA) of committing the attacks in collaboration with Apple, without evidence.

Some have compared the activity of the spyware to NSO Group’s Pegasus, the spyware that authoritarian governments used to target high-profile business and media figures through covert observation and data theft.

However, in a Twitter thread Eugene Kaspersky reported that the activity of Operation Triangulation does not overlap with that of known iOS malware such as Pegasus.

Kaspersky researcher Georgy Kucherin also tweeted that the spyware does not persist, and that attackers “have to reinfect the device when it reboots”. 

This could raise hopes that regular phone reboots would work as a measure against prolonged device infection. 

Evidence of the attack chain suggests that disabling iMessage would protect iOS devices from Operation Triangulation but that once infected, devices have to undergo a factory reset and manual reinstallation of iOS and the user environment.

As infected devices cannot update, a reboot does nothing to make a device less vulnerable to subsequent reinfection.

Eugene Kaspersky speculated in a tweet that the iOS Lockdown Mode security feature could protect against initial infection, but this has not yet been proven.

The US is reportedly considering enforcement action against cyber security firm Kaspersky.

The news comes a year after Kaspersky was declared a ‘national security risk’ to the US and placed on an FCC blacklist following Russia’s invasion of Ukraine.

What type of enforcement action Kaspersky could receive is currently unknown, but measures typically include cease and desist orders, corrective action directives, prohibition orders, and more.

This means it could potentially be bundled with TikTok in the products under consideration for a nationwide ban.

The US already banned the use of Kaspersky security products across the federal government back in 2017 over concerns that it could aid Russian spying efforts, with or without Kaspersky’s cooperation.

Moscow-headquartered Kaspersky has consistently and vehemently denied the numerous allegations regarding fears it could be used as a spying tool by the Russian government.

It did not reply to ITPro’s request for comment.

Sources speaking to the Wall Street Journal, which first reported the story, did not provide details of when the Biden administration’s decision would be made.

The US Commerce Department’s Bureau of Industry and Security told Reuters that the department “is committed to fully exercising its authorities to protect Americans' sensitive data, and to working with Congress in a bipartisan way to adapt to evolving risks".

Is Kasperksy a national security risk?

Much like the fears surrounding Huawei and ZTE, the national security concerns surrounding Kaspersky are largely theoretical.

At least, no concrete evidence that it has been used for Russian spying has ever been made available to the public.

Nevertheless, Kaspersky could potentially soon face the same restrictions as the aforementioned Chinese firms.

Concerns around Huawei and ZTE started in 2018 after the National Cyber Security Centre (NCSC) said they both presented a national security risk, given their equipment’s heavy presence in the nation’s telecoms network.

This led to an order to rip and replace Huawei’s equipment from said network, favouring other vendors like Nokia and Ericsson.

The US also imposed similar restrictions which, in November 2022, culminated in a blanket ban on sales and imports of Huawei and ZTE products in the country.

Efforts to uproot Chinese telecoms equipment from the US first began during Barrack Obama’s presidency and were continued throughout Donald Trump’s and now Joe Biden’s administrations.

Huawei and ZTE have both strenuously denied the allegations brought against them.

The underlying reasoning for these national security concerns is that the Chinese government could theoretically order companies to relinquish data to authorities, offering no chance for refusal.

This means providers of telecoms equipment could theoretically send data on essentially the entire population of a nation, as well as the businesses operating within its borders.

Kaspersky co-founder, Eugene Kaspersky, has well-known historical ties to Russia’s intelligence services.

Russia has similar government collaboration laws as China in that domestic businesses must comply with orders from the security services (FSB).

Coupled with the alleged ongoing link between the security firm’s co-founder and Russian intelligence, this seemingly presents enough cause to warrant such decisive measures.

In an exclusive interview with ITPro back in 2016, Eugene Kaspersky said that if the company were to discover evidence of state-sponsored spying, it may be forced to remain silent on the matter.

“If it's [found] working for a customer, we must ask ‘’can we disclose this information or not’. If they agree to disclose this information, we do. If not, unfortunately, we must be silent about it,” he said.

“In some cases, we can see there's something anomalous going on ourselves, and we find it and we analyse it, we find the victims and report the victims not directly to the victim, but to the nation's organisation responsible for security so we share the information. But, we share only the pieces of information that are related to that nation, we don't share everything to everyone.”

What’s happened in the Kaspersky story so far?

Eugene Kaspersky co-founded his namesake security firm in 1997 after previously working as a software engineer for the Soviet Ministry of Defence’s intelligence branch.

Accusations of potential collaboration between the company’s CEO and the Kremlin began even before Kaspersky was formed, back in 1994 when the civilian IT firm for which Eugene Kaspersky worked at the time first started winning US contracts, he has previously said.

Ever since, the company has repeatedly denied the allegations that have been brought against it. From turning a blind eye to cyber attacks that benefitted Russia, to appointing a large number of its executives with Russian military or intelligence backgrounds.

One of the key turning points for the company came in 2017 when, in the US, the Trump administration banned the company’s products across federal government IT environments, citing security risks.

Kasperksy tried to appeal the decision but its case ultimately failed.

Eugene Kaspersky said the decision was based on “subjective and non-technical public sources like uncorroborated and often anonymously sourced media reports”.

Months earlier, Bloomberg reported claims that Kaspersky had been working with the Russian intelligence services and had built products for them - more allegations the company’s co-founder branded “unfounded” and “total BS”.

Perhaps the most significant shift in attitude, at least globally speaking, came last year following the Russian invasion of Ukraine.

A Reuters report suggested that the US government started warning domestic companies about the potential risks of running Kaspersky software the day after the invasion.

The US later added the company to the FCC’s blacklist, branding it a national security risk, despite the company officially denouncing the war.

The UK’s NCSC and Germany’s equivalent agency, the BSI, also both separately advised organisations to avoid using Kaspersky’s products, with the latter claiming it could be used to facilitate offensive cyber operations.

Kaspersky has unveiled an updated free decryptor tool to support victims of a modified strain of Conti ransomware.

The ransomware strain, tracked by some researchers as MeowCorp, is one of several modified strains based on Conti source code leaked in March 2022, and has been used to target a range of companies and state institutions.

This latest tool was developed following an investigation into a new portion of leaked Conti data published on forums. Analysis of the leak uncovered 258 private keys, source code, and some pre-compiled decryptors, researchers noted.

“The leaked private keys are located in 257 folders (only one of these folders contains two keys). Some of them contain previously generated decryptors and several ordinary files: documents, photos, etc,” the company said in a statement this week.

“Presumably the latter are test files – a couple of files that the victim sends to the attackers to make sure that the files can be decrypted.”

Kaspersky said the decryption code and all 258 keys were added to the latest build of its RakhniDecryptor utility. In addition, the tool has been added to Kaspersky’s long-running No Ransom site.

Hundreds of organisations impacted

First observed in 2019, Conti's eponymous ransomware strain was among the most prolific throughout 2020, accounting for more than 13% of all ransomware victims across that period.

When Conti source code was leaked last year, a slew of new modifications and strains emerged and were used to devastating effect by cyber criminal gangs.

Leaked keys for the MeowCorp variant were uncovered by Kaspersky researchers in December 2022. However, Fedor Sinitsyn, lead malware analyst at Kaspersky, told IT Pro that this strain could have been active for some time.

"Our research indicates that the private keys were operational between the 13th of November 2022 and the 5th of February 2023, and the last decryptor we identified was on the 9th of February," he said.

"It is vital that organisations take proactive measures to protect their systems against such attacks, including regular data backups and robust cybersecurity measures."

The analysis found that 34 folders “explicitly named companies and government agencies” impacted by the strain.

Sinitsyn said that 257 companies had fallen victim to the ransomware strain, the majority of which have not been disclosed by threat actors.

"Our analysis reveals that 257 companies have fallen prey to this malicious software, with 34 of the victims/organisations identified by name," he said. "The identities of the remaining 223 victims currently remain concealed by the threat actors."

The release of this decryptor tool follows a number of similar moves by cyber security companies and government agencies globally.

Earlier this month, Bitdefender released a free decryption tool for the MortalKombat ransomware strain which has risen to prominence over the last several months.

Similarly, in February CISA unveiled a recovery script for organisations that have fallen victim to the rampant ESXiArgs ransomware which emerged at the beginning of the month.

A new wiper trojan, disguised as a ransomware payload, has been discovered in the wild by researchers, raising questions about the reason for its existence and the identity of its operators.

CryWiper, named for the distinctive ‘.cry’ extension which it appends onto files, appears on first impression to be a new ransomware strain. Victims’ devices are seemingly encrypted and a ransom note is left demanding money be sent to a bitcoin wallet address. However, the files are actually corrupted beyond recovery.

Kaspersky researchers laid out findings that prove the malware is actually a wiper that corrupts all but the most critical system files, overwriting each with data produced through a pseudo-random number generator.

Once on a victim’s system, CryWiper sends the name of the victim’s device to a command and control (C2) server, waiting for an activation command to launch an attack.

This follows a similar methodology to ransomware, with functions performed including the deletion of volume shadow copy to prevent files from being restored and scheduling itself in Windows Task Scheduler to ensure that it restarts every five minutes.

CryWiper also ceases MS SQL, MySQL, MS Active Directory, and MS Exchange services, so that files associated with them are not prevented from being corrupted.

Researchers noted that it disables connection to infected devices through remote desktop protocol (RDP) too, and posited that this is to frustrate the efforts of security teams responding to the incident.

This marks a divergence from typical ransomware behaviour, as payloads generally maintain RDP access in order to facilitate lateral attacks across networks.

A wiper is a malware strain designed to destroy systems indiscriminately, or otherwise cause chaos and destruction on a victim’s device. Wipers have been widely used in Russia’s cyber war against Ukraine, and form part of a malware arsenal that has formed the backbone of the growing threat against critical national infrastructure (CNI).

An email address provided in the ransom text file has been in use since 2017, linking it to several former ransomware families. No conclusive identification has yet been made linking any of the groups.

In a Russian-language blog post unpacking the technical details of the malware, Kaspersky researchers drew further similarities between CryWiper and another wiper observed attacking public infrastructure in Ukraine earlier this year, known as IsaacWiper.

Both wipers use the same pseudo-random generator, ‘Mersenne Vortex’, and are the only two to do so due to the relative complexity of the algorithm compared to other options.

“It’s not common practice, however, deploying destructive payloads that contain ransom notes, with no intention to receive a ransom has been seen before,” said Andy Norton, European cyber risk officer at Armis.

“NotPetya is an example of a previous wiper attack. Plausible deniability is one reason to add false flags to malware payloads, another tactic is to invent fictitious threat actor groups, such as the 'Cutting Sword of Justice' again with the reason to deflect attribution of the attack.”

At the time of writing, Kaspersky has only observed targeted CryWiper attacks within the Russian Federation. Given the unknown nature of the group behind CryWiper, as well as the strategic intent of the trojan at this stage, businesses should remain alert to the telltale signs of the payload.

To avoid compromise, Kaspersky recommends close oversight of remote network connections, the use of VPN tunnels for RDP access, as well as strong rather than common passwords, and two-factor authentication (2FA) where possible.

Kaspersky Lab has used phishing simulator data in a study that has revealed employees are most likely to click on a phishing link within an email if the subject line and sender appear to relate to work or a missed delivery.

The most effective phishing email in the study carried the subject line “Failed delivery attempt - Unfortunately, our courier was unable to deliver your item,” with 18.5% of people sent the email clicking the link it provided.

Using the Kaspersky Security Awareness Platform, system administrators can mimic phishing emails and send them without warning to employees. The results can then be tracked to indicate the level of security awareness amongst employees.

Other effective subject lines included “Emails not delivered due to overloaded mail servers,” “Online employee survey: What would you improve about working at the company,” and “Reminder: New company-wide dress code,” all of which prompted 17.5-18% of recipients to click their links. The most effective sender names included “Mail delivery service,” “The Google support team,” and “HR Department.”

Kaspersky’s study was conducted between January 2021 and May 2022 and included the results of over 29,000 employees from 100 countries. With phishing emails behind an estimated 91% of all cyberattacks, the importance of understanding those campaigns that employees will fall for the easiest cannot be overstated.

Conversely, emails that contained threats or promised rewards for clicking links were less likely to prompt clicks with “I hacked your computer and know your search history” and another promising $1,000 only gained 2% and 1% of clicks respectively.

Educating employees on the telltale signs of a phishing campaign can be an effective measure against cyberattacks. Communicating the importance of verifying links and sender addresses, checking attachments aren’t executable files, and flagging up any suspected phishing attacks to your company's IT department can greatly improve safety.

On an administrative level, IT teams should remain vigilant against novel attacks that might circumvent existing security filters. Simulations such as those achievable through Kaspersky Security Awareness Program can provide useful insights into how susceptible employees are to tricks by threat actors.

“Since the methods used by cybercriminals are constantly changing, the simulation has to reflect up-to-date social engineering trends, alongside common cybercrime scenarios,” stated Elena Molchanova, Head of Security Awareness Business Development at Kaspersky.

“It is crucial that simulated attacks are carried out regularly and supplemented with appropriate training – so users will develop a strong vigilance skill that will allow them [to] avoid falling for targeted attacks or so-called spear phishing.”

Kaspersky Lab makes no secret of its Russian origins, and in the current climate you might be wary of trusting it with your security. In the past few years though the company has taken steps to put its operations beyond reach of the Kremlin: data storage and processing are now handled in Switzerland, while additional “transparency centres” in Brazil, Canada, Malaysia and Spain allow governments and other institutions to review the company’s code and practices.

There’s no question about Kaspersky’s malware-blocking credentials, though. In the latest independent tests by AV-Comparatives.org the Kaspersky engine achieved a superb online protection score of 99.98% – slightly better than Microsoft Defender on 99.96%. It racked up fewer false positives too: against a set of more than 10,000 items, Kaspersky wrongly raised the alarm just twice, while Defender missed the mark five times. AV-Test.org confirms the engine’s effectiveness: in its tests for January and February 2022, Kaspersky provided impeccable 100% protection against both new “zero-day” and widespread threats.

The user experience is delightfully clean. Although Kaspersky’s main business is commercial security products, the Kaspersky Free Windows client has no adverts or non-functional buttons – a real breath of fresh air.

Instead there are just a few buttons for the major functions. From the Home page you can quickly scan your computer for malware and check online to see whether your personal credentials have been compromised; on the Security page you’ll also find buttons to download emergency boot media, and to scan your Windows configuration for suspicious or corrupted settings.

That may sound a bit minimal, but there’s more going on behind the scenes. Kaspersky Free also quietly takes care of web and email scanning, while the System Watcher component keeps an eye out for ransomware-like behaviour and automatically offers to undo potentially harmful activity. If anything, these components are perhaps a bit too unobtrusive: unless you delve into the program settings you might never realise that they’re enabled. Still, that’s better than AVG’s approach, which puts big fake buttons in its interface purely to tell you that these features aren’t available in the free suite.

A few other tools are hidden away under Settings. A Privacy Cleaner scans your system for records of recently accessed files, cookies, caches and so forth, while an optional on-screen keyboard helps defeat keyloggers. The resource consumption options let you tweak things like automatic scans, to help minimise battery drain or avoid possible interference with games.

That’s not a huge issue, as Kaspersky Free is fairly lightweight. In AV-Test.org’s performance tests, it slowed down web browsing on a standard PC by 14% – that’s some way behind Defender’s 5% impact, but better than Avast One Essential on 17% and well ahead of AVG AntiVirus Free’s 28%. Similarly, Kaspersky had a 10% impact on application launch speed, versus 6% from Defender and 12% from Avast and AVG.

One thing that Kaspersky Free lacks is centralised administration; you can connect up to three installations under an individual email address, but it’s not designed to be managed across businesses. Even if you can live with that, it’s understandable if you’re still uncomfortable rolling out a Russian security solution. But with its excellent protection, generous feature set and unobtrusive design, Kaspersky Free has enough going for it to deserve serious consideration.

Kaspersky is one of the oldest names in the antivirus game, founded in 1997, but has recently gone through several rounds in the PR boxing ring. This is in no small part due to the geography of its head office – Moscow, Russia.

Questions around Kaspersky have been raised over the last few years, including whether the firm has ties to the Russian government in any capacity, and whether the products are vulnerable. While these concerns have rumbled for some time, Russia’s invasion of Ukraine has thrown them into the spotlight.

Cyber security authorities from countries including the UK and the US have lined up in recent days to dissuade businesses from using Kaspersky’s products. This may prompt many organisations into asking whether Kaspersky’s products are, ultimately, safe to use. Arriving at a definitive answer, though, is far from straightforward.

Serious allegations, severe real-world consequences

Since the invasion, Germany, the US, and the UK have all released separate advisories warning businesses of the alleged risks of using Kaspersky’s products. The perceived heightened risk of Kaspersky, now war has broken out, essentially stems from the legal obligation for Russian-based businesses to comply with requests from the Russian Federal Security Service (FSB). A similar law exists in China and has largely underpinned the West’s discomfort around companies like Huawei.

Such highly official and serious stances, adopted by several governments in a coordinated manner, are rare, and send an explicit message. Germany was the first to go public with its concerns that Kaspersky could be compelled into carrying out cyber attacks against Russia’s enemies, at the behest of the Kremlin. Within days, both the US and UK also released their own statements suggesting similar scenarios and warning businesses against using the company’s products. The US went a step further, though, by making Kaspersky the first Russian addition to the FCC’s blacklist, joining the likes of Huawei and ZTE, officially branding it a threat to US national security.

What Kaspersky is most aggrieved with is the lack of evidence each government has presented in its respective advisories. A Kaspersky spokesperson, indeed, told IT Pro in March these advisories were “not based on any technical assessment of Kaspersky products” and “made on political grounds” – a statement the firm has reiterated since.

A history of alleged Russian ties

To suggest Kaspersky has been viewed with suspicion in recent years would be an understatement. Despite analyst house Gartner saying in 2012 there’s no material evidence to suggest Kaspersky is malicious in its products or behaviours, or has ties to the Russian government, that did little to quell a wave of allegations against the company since.

The US has been particularly persistent in scrutinising Kaspersky, across several administrations, but it arguably all came to a head in 2017. High-profile US media organisations made a number of serious allegations against the company at the time which set in motion a catastrophic chain of events for Kaspersky.

Chief among them was the Wall Street Journal alleging in October 2017 the company’s products were used by Russian state-affiliated hackers to steal hacking tools used by an NSA contractor. Kaspersky vehemently denied these allegations, countering with the assertion the NSA contractor in question accidentally leaked their tools to Kaspersky during the course of normal use of its antivirus product.

Weeks later, the UK’s MI6 expressed concern over Barclays distributing Kaspersky software to more than two million of its online banking customers free of charge. These concerns soon led to Barclays halting its free software initiative, and prompted the NCSC to issue a warning against using Kasperky products at the government level.

Before the year was out, the Trump administration later approved a law banning Kaspersky products across federal and military systems – an order over which Kaspersky unsuccessfully tried to sue the US government.

The move catalysed a global shift in attitude towards the cyber security company. Following the announcement, Lithuania announced a similar ban, as did the Dutch government six months later. The EU officially branded Kaspersky “malicious” and the company, arguably, has since never managed to shake this onslaught of negative PR.

Its tainted image also hasn’t been helped by the fact that its CEO, Eugene Kaspersky, was a former member of the Russian military and was also educated by a KGB-sponsored school through which he earned a technical degree.

What does this mean for Kaspersky products?

With numerous strands to this tale, there’s a lot to unpack. What’s notable is the lack of evidence made public supporting the recent allegations against Kaspersky. Although the claims haven’t been substantiated publicly, governments often withhold such information on national security grounds.

It might also be argued this situation has been fuelled by longstanding geopolitical tensions between the US and its allies, and the Russian and Chinese governments. Both Kaspersky and Huawei were banned by the Trump administration on the basis of alleged ties to the Kremlin and the Chinese state respectively. The principles of these bans were eventually mirrored in domestic laws and initiatives elsewhere. Both the UK and US said Huawei’s infrastructure needed to be ripped out to preserve national security, while concerns around Kaspersky, as we’ve mentioned, go back to 2017 when the NCSC warned against using Kaspersky products at the government level – something it recently repeated in March 2022.

Kaspersky defended itself when the US initially banned it in 2017, but it’s curious it didn’t launch legal action against the Wall Street Journal after the newspaper alleged it stole NSA hacking tools. You could argue that Kaspersky didn’t want to damage its reputation by taking on a well-respected member of the free press, but if the claims were wholly untrue, then you would expect it to follow up in some way on the grounds of defamation.

Without access to information or intelligence likely held back from the public, it’s difficult to say with certainty if Kaspersky products are safe to use, just as we cannot definitively say Huawei is trustworthy either. Governments, when pressed for proof, have been unwilling to provide it in either case. All we can say is it’s notable many Western governments have united in the calls against using Kaspersky products, although the firm has consistently denied any explicit links to the Russian state.

The legal obligation to comply with Russian government orders, though, is true – and a significant reason why cyber security agencies are, only now, warning businesses against using it. With more than 400 million users and 240,000 corporate clients, the legal requirement for a cyber security company as prevalent as Kaspersky to comply with Kremlin orders is, indeed, troubling, even if hypothetical or unlikely. Because of this, it might be wise to err on the side of caution.

Germany’s Federal Office for Information Security (BSI) has warned against using Kaspersky antivirus security products due to the company being headquartered in Russia.

The BSI said it recommends switching away from any Kaspersky product to another vendor because the company could be forced by the Russian state to carry out offensive cyber operations.

It also said Kaspersky could carry out such offensive operations in cyber space through its own will, can use its own products as a tool in attacks on its own customers, or be spied on without its knowledge.

Because of these factors, the BSI said there is a “considerable risk of a successful IT attack” as a result of current conflicts between Russia, the EU, NATO, and Germany.

It believes organisations that are tied to critical infrastructure or have other special security interests are particularly at risk of attacks linked to Kaspersky’s antivirus software and the BSI will advise any organisation that believes it may be affected.

“Antivirus software, including the associated real-time capable cloud services, has extensive system authorisations and, due to the system (at least for updates), must maintain a permanent, encrypted, and non-verifiable connection to the manufacturer's servers,” the BSI said in a statement.

“Therefore, trust in the reliability and self-protection of a manufacturer as well as his authentic ability to act is crucial for the safe use of such systems. If there are doubts about the reliability of the manufacturer, virus protection software poses a particular risk for the IT infrastructure to be protected.”

Kaspersky has denied any allegations that it is linked to the Russian state, or any other government across the globe, saying the BSI’s decision has not been made on the basis of technical analysis of its products.

“We believe this decision is not based on a technical assessment of Kaspersky products – that we continuously advocated for with the BSI and across Europe – but instead is being made on political grounds,” a Kaspersky spokesperson told IT Pro. “We will continue to assure our partners and customers in the quality and integrity of our products, and we will be working with the BSI for clarification on its decision and for the means to address its and other regulators’ concerns.

“At Kaspersky, we believe that transparency and the continued implementation of concrete measures to demonstrate our enduring commitment to integrity and trustworthiness to our customers is paramount. Kaspersky is a private global cybersecurity company and, as a private company, does not have any ties to the Russian or any other government.

“We believe that peaceful dialogue is the only possible instrument for resolving conflicts. War isn’t good for anyone.”

History of persecution

This isn’t the first time Kaspersky has been targeted by a country based on its alleged links to the Russian government, claiming that said links compromise its ability to safeguard the national security of countries other than Russia.

In 2017, the US accused Kaspersky of being able to surveil its customers, of which the US government was one, leading to its products being banned from use in federal government departments that year.

Kaspersky said at the time that it believed the decision was not being made on the basis of facts and had its appeals to overturn the ban thrown out of court. The cyber security company also launched a lawsuit against the Trump administration a week after the ban was imposed.

The UK’s National Cyber Security Centre (NCSC) also followed the US in advising all UK government departments against using Kaspersky security products. The EU labelled the company’s software products as “malicious”, leading to an EU-wide ban.

Following the wave of government bans, Twitter also prevented Kaspersky from placing ads on the social media platform, claiming its business model conflicts with its Twitter Ads business practices.

The past twelve months have brought challenges for almost all businesses, but they’ve also brought some terrific products. New generations of servers and appliances have arrived, offering levels of horsepower and capacity that would have seemed outlandish just a few years ago. At the same time, value has continued to climb, bringing new possibilities within reach of an SMB budget.

There’s been plenty of exciting developments for end users too. Stunning laptops, tablets and phones have turned our heads, along with powerful printers, scanners and screens. And while threats like phishing and ransomware haven’t gone away, the latest generation of security software is here to keep us safe.

As always, there’s no such thing as a perfect product – every business and every individual will have their own needs and preferences. But we’ve put together our selection of the greatest releases of the past twelve months, to reveal the standout products across a wide range of categories, and to celebrate the manufacturers who’ve driven innovation forward in 2021.

Best laptop 2021

WINNER: LG Gram 17

Weighing just 1.35kg, the Gram 17 is barely heavier than many 14in laptops – yet it has a huge, bright 17in display that’s fantastic for productivity and on-the-go presentations.

There’s plenty of horsepower here too, with an 11th-generation Intel Core i7 processor and 16GB of RAM on board. With nearly 13 hours of battery life it won’t conk out half-way through the day, and a spacious keyboard and trackpad mean it’s also a pleasure to work on for extended periods. Throw in Thunderbolt 4 and Wi-Fi 6 and you have an excellent do-it-all, go-anywhere computer for a very reasonable £1,599 exc VAT.

Read our full LG Gram 17 review

HIGHLY COMMENDED: Razer Book 13

Razer made its name with gaming laptops, but the company’s first business-friendly model is a big hit. It looks stylish yet serious, with a superb screen that challenges the MacBook Pro for brightness and colour quality. Performance is top-notch too, thanks to an Intel Core i7-1165G7 processor, and there’s a great selection of ports, including full-sized USB and HDMI connectors. At 1.4kg it’s a little weighty for a 13in laptop, but overall it’s a great, capable choice for an everyday working companion.

Read our full Razer Book 13 review

Best Chromebook 2021

WINNER: Acer Chromebook Spin 713

There are plenty of sub-£500 Chromebooks on the market, but Acer’s Chromebook Spin 713 feels like something much more expensive. Its 13.5in QHD screen has a comfortable 3:2 aspect ratio, and it flips all the way around so you can work in laptop, stand or tablet mode. Unusually, there’s an HDMI output too, giving you additional working options.

Wi-Fi 6 and Bluetooth 5 round out the feature set, and with a total weight of just 1.2kg the Spin 713 is deliciously portable too. It would have been nice if Acer had given that beautiful screen an anti-glare coating, but when the rest of the package is this good we can live with a few reflections.

Read our full Acer Chromebook Spin review

HIGHLY COMMENDED: Lenovo IdeaPad Flex 5

The Flex 5 is another Chromebook with a 360º-rotating screen, though its 16:9 aspect ratio is best suited to conventional laptop-style usage. It’s slimmer and lighter than the Acer Spin 713, and its bright display is less reflective. Connectivity is well covered with both USB Type-A and Type-C ports, along with Wi-Fi 6; if you’re looking for a no-nonsense Chrome OS workhorse, you won’t be disappointed.

Read our full Lenovo IdeaPad Flex 5 review

Best tablet 2021

WINNER: Apple iPad Pro 12.9in

With Apple’s mighty M1 processor, the iPad Pro is fully as powerful as a MacBook Pro. And it has several advantages over the laptop: at 680g it’s less than half the weight, and the touchscreen makes for a slick, tactile experience. The 120Hz mini-LED display is stunning, and a battery life of around 13 and a half hours means you can keep working all through the day and beyond.

No doubt, the 12.9in format is bulky for a tablet, while the optional keyboard pushes up the weight – and the price, which is already steep at £916 exc VAT for the base model. Even so, this is unquestionably the best tablet on the market: it doesn’t just excel at tablet tasks, it redefines what a tablet can do.

Read our full Apple iPad Pro 12.9in review

HIGHLY COMMENDED: Nokia T20

It’s short on flashy gimmicks, but Nokia’s T20 feels like a professional tablet. The aluminium build is strong and sturdy, performance and features are up to par, and while we felt the 10.4in screen looked a little cold, its 5:3 aspect ratio is very comfortable to work on. The most impressive part is the price – just £150 exc VAT for the Wi-Fi 5 edition, or £167 exc VAT for the LTE model.

Read our full Nokia T20 review

Best smartphone 2021

WINNER: Apple iPhone 13

The iPhone 13 improves on last year’s iPhone 12 models with better cameras and a bigger battery, adding nearly two hours of daily performance in our tests. You get more storage in the standard model too, up from 64GB to 128GB, and the latest Apple A15 Bionic CPU for true Android-smashing performance.

All the usual iPhone strengths are here, including an excellent screen and a vast library of high-quality apps for work or play. It’s hardly an adventurous update from the iPhone 12, but if you’re choosing a new smartphone today – and aren’t already enmeshed in the Android ecosystem – then the iPhone 13 is the obvious choice.

Read our full Apple iPhone 13 review

HIGHLY COMMENDED: OnePlus 9 Pro

Standing 163mm tall, the OnePlus 9 Pro is large, but it’s perhaps the most beautiful Android smartphone we’ve seen, with a tiny bezel and beautifully textured case. Its 120Hz AMOLED display is a joy to behold, and a collaboration with Hasselblad ensures excellent photo and video quality. Performance is very strong too, courtesy of a top-tier Snapdragon 888 processor; at £829 exc VAT it’s not a budget option, but you get what you pay for.

Read our full OnePlus 9 Pro review

Best desktop server 2021

WINNER: HPE ProLiant MicroServer Gen10 Plus

The MicroServer Gen10 Plus really can fit happily on a desktop, as its square chassis measures a mere 245mm along each side. Yet it’s powerful enough to run a wide range of business services, with your choice of a dual-core 3.8GHz Pentium Gold G5420 CPU or a quad-core 3.4GHz Xeon E-2224. Four integrated LFF SATA drive bays allow for plenty of storage.

The small size means there’s not much scope for internal expansion, but you do get a single PCI-E x16 slot, and remote management can be added via the cheap iLO5 enablement kit. With the entry-level diskless system starting at just £395 exc VAT, it’s an excellent SMB-friendly deal.

Read our full HPE ProLiant MicroServer Gen10 Plus review

HIGHLY COMMENDED: Dell EMC PowerEdge T550

The T550 is a real “tower of power” – we tested it with a 12-core 2.1GHz Xeon Silver 4310 CPU, but if you need more grunt it can handle twin CPUs with up to 32 cores each. It also supports up to 24 SFF or eight LFF drives, and a maximum of 1TB of DDR4 RAM. Dell’s comprehensive iDRAC9 remote management platform comes as standard, making this an ideal answer to demanding workloads.

Read our full Dell EMC PowerEdge T550 review

Best 1U server 2021

WINNER: Dell EMC PowerEdge R650

Dell’s latest PowerEdge R650 design crams an amazing amount of potential into a 1U chassis. It supports Xeon Scalable CPUs with up to 40 cores and a massive 4TB of memory, with space inside for up to ten SFF drives and 16 Intel Optane modules to accelerate performance.

If that’s not enough, you also get three PCI-E Gen4 x16 slots and an OCP 3.0 edge slot, plus Dell’s BOSS card for fast booting from SSD media. And as usual with Dell, the iDRAC9 controller provides terrific remote management. It’s not a budget option – our review unit came to £15,417 exc VAT – but the PowerEdge R650 is an incredibly powerful and space-efficient server.

Read our full Dell EMC PowerEdge R650 review

HIGHLY COMMENDED: Broadberry CyberServe Xeon

This low-profile server offers a solid chunk of power for just under £1,000. That gets you a quad-core Intel Xeon E-2224 CPU with 16GB of RAM – upgradeable to 128GB – and you’re free to fit your own drives in the four SFF bays and twin M.2 SSD slots. The single PCI-E Gen3 x16 slot can be used to add 10GbE networking, and the Asus motherboard supports web-based management, including full OS remote control and virtual media services as standard.

Read our full Broadberry CyberServe Xeon E-RS100-E10 review

Best 2U server 2021

WINNER: Broadberry CyberServe SP2 208-8I G3

The CyberServe SP2 208-8I G3 is designed for a hardcore server role. The system we tested came with a pair of 36-core Xeon Scalable Platinum CPUs, 512GB of DDR4 RAM, five 960GB SATA SSDs and eight 128GB Intel Optane PMEM 200 modules. This allows for insanely fast storage access – and to help you make the most of it, the system comes with not one but two dual-port Intel 100GbE network cards.

You can upgrade even further by going up to 26 SFF drives in total, plus eight NVMe drives, and the spacious 2U design allows for six free PCI-E Gen4 slots. It’s a magnificent hardware package, and while the £21,895 price tag won’t be within everyone’s budget, it’s superb value for what you get.

Read our full Broadberry CyberServe SP2 208-8I G3 review

HIGHLY COMMENDED: Dell EMC PowerEdge R750

Dell’s PowerEdge R750 comes in three versions – the R750xa is built for GPU-based workloads, while the R750xs is a cost-optimised version aimed at specific roles. The standard R750 is a great all-rounder though: the configuration we tested offered two 28-core 2GHz Xeon Scalable Gold 6330 CPUs and 1TB of RAM, upgradeable to a whopping 8TB using 256GB DIMMs. For storage you can choose between a 12-bay LFF backplane or a 16-bay SFF one, and add up to 24 NVMe SSDs. In short, there’s enough power and flexibility here for any business.

Read our full Dell EMC PowerEdge R750 review

Best storage array 2021

WINNER: HPE MSA 2060 Storage

With numerous hardware upgrades over the last generation, this is HPE’s fastest dedicated storage array ever. It’s also laden with powerful features: thin provisioning, snapshots and volume copies are all supported, along with striped SSD caches, RAID10, 5 and 6 options and HPE’s own MSA-DP+ array format, designed for improved performance and faster rebuild times.

The MSA 2060 even offers zero-configuration data tiering, automatically shunting data between regular SAS drives, fast solid-state storage and low-priority ML-SAS volumes according to usage. And it’s all configured and managed from a simple web portal, so there’s no need to be a storage expert to get the best from it.

Read our full HPE MSA 2060 Storage review

HIGHLY COMMENDED: Qnap TS-h2490FU QuTS Hero Edition

When performance is a priority, pure NVMe storage is the way to go. This impressive appliance can take up to 24 hot-plug U.2 drives, while Qnap’s 128-bit ZFS-based OS provides enterprise-class data integrity, with compression and deduplication options provided as standard. It’s all based on a powerful AMD EPYC processor, and it comes with a pair of dual-port 25GbE network cards, to ensure you can get the full performance from your storage.

Read our full Qnap TS-h2490FU QuTS Hero Edition review

Best NAS drive 2021

WINNER: Qnap TS-h973AX

Though it looks unassuming, Qnap’s TS-h973AX runs the company’s advanced QuTS hero OS, which offers an impressive range of native storage features. Those include fast, near-unlimited snapshots, transparent self-healing of data corruption and inline data deduplication and compression to make the most efficient use of your storage. Five LFF SATA bays plus four SFF bays provide plenty of room for expansion, while 10GbE and twin 2.5GbE network ports provide high-speed connections to the outside world.

In our tests the TS-h973AX provided fast read and write speeds, and there’s a whole library of apps to expand its capabilities, including backup and virtualisation tools. Costing just over £1,000 exc VAT for the diskless enclosure, it’s well within reach of smaller businesses.

Read our full Qnap TS-h973AX review

HIGHLY COMMENDED: Qnap TS-873A

Looking for a simple storage solution? The eight-bay TS-873A makes a great platform for Qnap’s lightweight, simple to manage QTS OS. Alternatively, for more advanced data-protection functions you can install the full QuTS hero OS and make use of all the same features as the TS-h973AX, above. Either way, it’ll run the full range of Qnap apps, and dual 2.5GbE ports help keep data flowing swiftly in and out.

Read our full Qnap TS-873A review

Best printer 2021

WINNER: Epson EcoTank ET-5880

Forget about overpriced cartridges – this A4 MFP uses bottled ink that works out to just 0.2p per mono page and 0.8p for colour. That alone will make it attractive to busy offices, but the ET-5880 has other strengths too, including a swish 10.9cm touchscreen, 802.11n wireless connectivity and excellent colour output. It comes with a pair of 250-sheet paper cassettes, so you won’t be continually restocking it, and the integrated scanner has its own 50-page duplex ADF.

The one caveat is a print speed of 25ppm in standard quality mode: that’s not exactly slow, but it’s unexceptional for a modern office printer. Even so, the Epson’s user-friendliness and phenomenally low running costs make it our top choice for 2021.

Read our full Epson EcoTank ET-5880 review

HIGHLY COMMENDED: Kyocera Ecosys

This freestanding laser MFP won’t suit the smallest offices, but it offers a 35ppm print speed and a wide range of downloadable apps to extend its printing and scanning functions. It’s easy to operate, with a big 7in touchscreen, a range of mobile apps and a clear web-based management console. The clincher is the price: the basic model with wired networking and a single 250-page sheet feeder costs just £696 exc VAT, and low-cost consumables work out to a very reasonable 1p per mono page.

Read our full Kyocera Ecosys M6235cidn review

Best scanner 2021

WINNER: Fujitsu ScanSnap iX1600

This desktop scanner has a great set of features, including integrated Wi-Fi, a 50-sheet ADF, double-sided scanning and a 4.3in colour touchscreen. It’s fast too: we were impressed to see it rip through our pile of test documents at 43ppm, creating 200dpi scans that were perfectly clear and clean enough for OCR and archival.

Even better, this hardware is partnered by one of the best software suites around. You can scan to a huge range of applications and cloud services, send scans directly to an email address or beam them to a mobile device. For anyone who needs to scan and share documents in a digital or cloud-first environment, the Fujitsu ScanSnap iX1600 is a terrific choice.

Read our full Fujitsu ScanSnap iX1600 review

HIGHLY COMMENDED: Canon imageFormula DR-S130

With its output tray folded away the DR-S130 takes up barely any more desk space than a sheet of A4. Yet it scans at a swift 30ppm, and thanks to Canon’s CaptureOnTouch V4 Pro software it can perform all the same scan functions as much pricier, bulkier models. You can set up profiles for different job types, run single- and double-sided scans, perform OCR and save the output in your choice of format and location. The only thing it can’t do is scan directly to cloud services, but for most individuals and SMBs it’ll fit the bill admirably.

Read our full Canon imageFormula DR-S130 review

Best monitor 2021

WINNER: Dell UltraSharp 25 USB-C

We don’t see a lot of 25in monitors, but the format works well for desktop productivity, and the Dell UltraSharp lives up to its name with a crisp 2,560 x 1,440 resolution. It also delivers excellent coverage of both the sRGB and DCI-P3 colour spaces, with an HDR400 certification for extended-range colour.

The final trump card is connectivity: the USB Type-C connector can handle both incoming video and outgoing power, so you can hook your laptop up to the big screen and charge it at the same time. It’s also possible to daisy-chain a second display via the DisplayPort connector, or to swivel the panel round through 90º and work in portrait mode. In short, it’s one of the cleverest monitors we’ve seen.

Read our full Dell UltraSharp 25 USB-C review

HIGHLY COMMENDED: Acer ConceptD CP5271UV

The CP5271UV is an exceptionally versatile monitor. It offers custom display modes for print editing, video and games, and also supports high-end features including HDR600 for deep-colour content, dynamic refresh rates up to 170Hz and an incandescent peak brightness of 480cd/m2. It makes a great office monitor too, with integrated gigabit Ethernet and four USB 3.1 ports. At £667 exc VAT it’s considerably more expensive than your typical desktop display, but if you're in the market for a high-end screen it’s a steal.

Read our full Acer ConceptD CP5271UV review

Best endpoint security suite 2021

WINNER: Sophos Intercept X Advanced

There’s a lot of hype around artificial intelligence, but it does have real applications: Sophos’ Intercept X suite uses machine-learning techniques to recognise malware and neutralise zero-day threats. It also includes a full range of traditional protections, defeating ransomware by intercepting encryption attacks and silently restoring the original file, and preventing data leaks by blocking the transmission of certain types of information.

The Advanced subscription adds an analysis centre, where you can forensically review attempted attacks, allowing you to identify and plug the gaps in your armour. It’s easy to deploy and manage too: a central web console lets you email out installer links to all clients, and then administer policies and settings for the whole site.

Read our full Sophos Intercept X Advanced review

HIGHLY COMMENDED: Kaspersky Endpoint Security Cloud Plus

Kaspersky’s highly flexible licensing lets you protect workstations, laptops, servers and mobile devices all within a single subscription. As well as blocking viruses and intrusion attempts, the software can watch over your network for suspicious activity, and manage Windows Updates from a central portal. The premium Plus subscription adds the Security for Microsoft 365 component, which integrates into Exchange Online, OneDrive, SharePoint Online and Teams, providing monitoring and protection for your services as well as your endpoints.

Read our full Kaspersky Endpoint Security Cloud Plus review

Best antivirus suite 2021

WINNER: Kaspersky Internet Security

Kaspersky is no stranger to our awards, and this latest version of its security suite shows why – in multiple independent tests it scored perfect 100% protection scores without a single false positive. Other notable features include browser protection, ransomware blocking, defences against webcam hijacking and even a fully featured firewall.

Do you need to pay for this type of protection? It’s true that Windows’ built-in security modules are nowadays very effective on their own. However, Kaspersky is much easier to configure, especially when it comes to customising firewall rules. It also has less of an impact on system performance, which makes the modest £15/yr subscription fee easy to swallow.

Read our full Kaspersky Internet Security review

HIGHLY COMMENDED: Avast Antivirus Free

Avast is our favourite free antivirus solution for several reasons. First, it does a great job of blocking malware: independent labs have found its protection on par with Microsoft Defender and ahead of several paid-for suites. What’s more, it’ll run on older editions of Windows – which is ideal if you still have legacy machines running Windows 7 or 8.1 that can’t be upgraded. You do have to put up with a few in-application adverts for Avast’s paid-for products, but if you can’t use Windows’ built-in protections – or just don’t want to – then Avast Antivirus Free makes a lightweight and effective alternative.

Read our full Avast Antivirus Free review

Kaspersky’s Endpoint Security Cloud Plus (ESCP) offers some of the most flexible licensing terms in the business. While some vendors expect you to purchase separate licence packs for different types of devices, each Kaspersky user licence covers one workstation, laptop or server, plus two iOS or Android mobile devices.

The service is designed to protect up to 1,000 Windows and Mac workstations and Windows servers, and is managed entirely in the cloud. The extensive roster of security features includes anti-malware, threat and ransomware protection, a client firewall, network vulnerability scanning and an attack blocker.

On top of all this, the Plus subscription we tested adds endpoint device controls, URL-based web filtering, vulnerability assessments, patch management and encryption. It also adds the ability to block any email, file-sharing, messaging or social networking cloud services in use by your clients, while the standard licence only lets you monitor activity.

A final benefit of the Plus licence is the Security for Microsoft 365 component. This provides dedicated security services for Exchange Online, OneDrive, SharePoint Online and Teams, with its data discovery tool highlighting files identified as containing sensitive information.

Deployment starts with creating a Business Hub account and defining your company. You’re then taken to the ESCP web portal, where wizards guide you through adding users, enabling cloud discovery and scheduling updates and scans.

Then you just need to get the software onto clients – and this too is painless, as you can email invitations to users directly from the cloud portal. We found the client software took around five minutes to install, then a further 15 minutes to fully register itself with the portal and update its signature database.

A default security profile is applied to each new device so full protection starts immediately, but it’s easy enough to create custom ones. There’s a huge range of options on offer, with clearly distinguished settings for Windows, Mac, Android and iOS devices.

For example, file, web and network threat protection are available for Windows and Mac devices, while Android users get standard antivirus measures. Since iOS is so locked down, the only options available here are access controls, which let you choose what mobile features are accessible, set screen lock and password policies and specify which networks can be connected to.

It’s also worth noting that cloud discovery is only available for Windows devices. It works well, though: after you’ve given it a few hours to build up a picture of your network traffic, the portal shows a handy readout of the top five services and the devices using them.

Another Windows-centric feature is patch management. All available updates are displayed in the portal, and you can set a daily or weekly schedule to apply them all, or only those you’ve approved.

To make use of the Security for Microsoft 365 component you need to create a new workspace in your cloud account, which presents a separate portal. After granting access to our account, we were able to create profiles to protect our Exchange Online mailboxes from spam, phishing and malicious attachments, and apply anti-malware policies to our files in OneDrive and SharePoint Online.

The data discovery service, meanwhile, works with Exchange, OneDrive and SharePoint data, sending an alert to selected users if it finds confidential information. As with the ESCP portal, plenty of information is presented, with detection statistics for Exchange mailboxes, OneDrive files and SharePoint data.

Businesses seeking both device security and protection within Microsoft 365 will find Kaspersky Endpoint Security Cloud Plus has all the angles covered. You do need to use separate portals to manage everything, but there’s a huge range of security features on offer, and Kaspersky’s licensing scheme makes it very affordable.

IT security firm Kaspersky has warned users that a new phishing campaign is using one of its stolen Amazon Simple Email Service (SES) tokens to make emails appear legitimate.

In an advisory issued on Monday, the firm said it saw a huge increase in spear-phishing emails designed to steal Office 365 credentials. The advisory added that this campaign relies on a phishing kit researchers named “Iamtheboss” used in conjunction with another phishing kit known as “MIRCBOOT.”

“The activity may be associated with multiple cybercriminals. The phishing e-mails are usually arriving in the form of “Fax notifications” and lure users to fake websites collecting credentials for Microsoft online services,” the advisory stated. “These emails have various sender addresses, including but not limited to noreply@sm.kaspersky.com. They are sent from multiple websites including Amazon Web Services infrastructure.”

In investigations, Kaspersky researchers determined some emails were sent using Amazon’s Simple Email Service (SES) and legitimate SES token. Amazon Simple Email Service (SES) is an email service that enables developers to send mail from within any application.

They said that this access token was issued to a third-party contractor during the testing of the website 2050.earth. The site is also hosted in Amazon infrastructure.

“Upon discovery of these phishing attacks, the SES token was immediately revoked. No server compromise, unauthorized database access, or any other malicious activity was found at 2050.earth and associated services,” said the advisory.

The advisory encouraged users to execute caution and be vigilant even if the email seems to come from a familiar brand or email address.

MIRCBOOT is a phishing kit recently discovered by researchers at Microsoft as part of a large-scale phishing-as-a-service operation known as BulletProofLink. This follows the software-as-a-service model, which requires attackers to pay an operator to wholly develop and deploy large portions or complete phishing campaigns from false sign-in page development, website hosting, and credential parsing and redistribution.

Earlier this month, a Russian cyber crime group was targeting the financial sector with malware delivered by Microsoft Office macros. The attack used phishing emails to mount the first phase of its attack, using an Excel document that uses a macro.

Last month, hackers spoofed Zix to steal Office 365, Google Workspace, and Microsoft Exchange data. Security researchers from Armorblox said the attack affected around 75,000 users, with small groups of cross-departmental employees targeted in each customer environment.

Kaspersky Internet Security is a long-standing entry in our antivirus awards list, and its performance this time around hasn’t disappointed. We’ve reviewed the Windows version, running under Windows 10, but you can use your Kaspersky licenses to protect any combination of Windows, macOS, Android and iOS devices.

As well as the expected real-time malware detection and schedule scans, KIS provides a useful selection of features. There’s a browser protection module, ransomware defense that prevents unauthorized changes from being made to selected directories, private browsing and ad blocking, webcam protection, an interruption-free gaming mode, and online monitoring to check the protection status of all devices associated with your Kaserpersky account. Unusually for an antivirus suite in this price range, Kaspersky Internet Security also includes a fully-featured firewall.

You also get the free version of Kaspersky’s Secure Connection VPN, with a 300MB per day bandwidth cap, installed as a standalone utility. The other standalone components are an optional free subscription to Kaspersky Password Manager, and the free Safe Kids parental controls. None of these stand out against the market leaders in their sectors, however. As they aren’t really integrated into the KIS client, you won’t feel their absence if you do away with them.

When it comes to the protection afforded by its anti-malware engine, you can’t go wrong with Kaspersky’s products. KIS netted perfect protection scores without a single false positive in the most recent tests by AV-Test and SE Labs. AV Comparatives’ July/August 2021 data shows that it blocked an impressive 99.70% of malware in real-world exposure tests, once again without any false positives. Not quite perfect, but an impressive performance however you cut it, matching that of Microsoft’s impressive integrated Defender.

Where Kaspersky provides a real advantage is in its interface and performance. KIS has been a great choice for minimal impact on system resources for years, and currently out-performs built-in Microsoft Defender Antivirus on Windows 10 PCs, notably when it comes to how long it takes to install software, although Kaspersky had a greater impact on website opening times.

Perhaps the best feature of Kaspersky Internet Security is the fantastic interface it provides for actually controlling it. While in practice, most of the same things KIS does can be achieved using Windows’ integrated tools, it’s just easier to do with Kaspersky.

Its firewall in particular is designed to be lived with and used, making it easy to add and edit rules, while the Microsoft Defender firewall remains comparatively unfriendly to work with. Application controls are also a welcome addition, although they tend to block unsigned software by default, requiring an exception to run.

Kaspersky Internet Security is pretty cost-effective, starting at £14.58 exc VAT for a one year, one device subscription from Kaspersky’s website. Further discounts are sometimes available, and you can buy packaged codes at physical and online shops at prices as low as £11 inc VAT.

Watch out for renewals, though - that single-user subscription goes up to £29.16 exc VAT on the second year, and your auto-renewing subscription is set up automatically if you buy your license via the official Kaspersky site. That’s still a decent price for 12 months of malware protection, but you should make sure you’re aware of it and that you want to renew automatically rather than buying codes elsewhere.

It’s also worth noting that, since 2017, some US businesses and both UK and UK government departments won’t allow their colleagues or contractors to run Kaspersky software on devices used for work. Kaspersky subsequently moved significant parts of its operation from Russia to Switzerland.

We’d prefer it if KIS put a little less emphasis on promoting Kaspersky’s other products after we’d already paid for this one, but that’s a minor complaint about an otherwise outstanding antivirus suite.

Kaspersky Internet Security is our favourite paid-for anti-malware solution, providing a great user interface and outstanding protection against malware and minimal impact on performance, improving even on Windows’ very credible integrated malware defence.

Kaspersky offers an endpoint protection answer for every business. Large firms that want total control can choose its on-site Endpoint Security for Business products, while smaller companies that don’t want to run their own host server have two cloud-managed solutions to choose from.

We tested Kaspersky’s Endpoint Security Cloud, which is managed entirely from a cloud portal and protects ten to 150 Windows systems and Macs. Licensing is flexible, with each user licence supporting one workstation, laptop or server, plus two iOS or Android mobile devices.

The standard service includes protection against all types of malware and ransomware, a client firewall, a network attack blocker and vulnerability scanning. There’s also a new cloud discovery feature that lets you keep an eye on email, file-sharing, messaging and social networking services being accessed by users.

If you need more, you can move up to the Plus version, which adds Office 365 protection, URL-based web filtering, endpoint device controls, encryption and patch management. The Plus service lets you block specific cloud services too, while the regular tier only monitors them.

We found deployment pleasingly simple: the agent can be downloaded and installed directly from the web portal, or you can email a download link to users. Either way, it takes around five minutes to set up, with a further 15-minute wait while the client registers its licence.

Once that’s done, protection starts immediately with a default security policy that enables everything Kaspersky has to offer. If you want to customise your coverage, it’s easy to create your own policies, organise clients into groups and grant admin rights to specific users. For Windows systems there are three levels of file and web threat protection on offer, and you can choose whether to scan emails for dodgy content and enable network threat protection. If you have the Plus version, you can browse all detected cloud services and decide whether to block any. Macs get file, web and network threat protection, but mail and cloud discovery are off the menu.

It’s a varied offering for mobile users too. Android devices benefit from antivirus protection plus web and app controls, while for iOS it’s more about access security: the portal lets you create APNs certificates, allowing you to choose what device features are accessible, set a screen lock and password policy, apply simple website keyword blocking and restrict which networks can be joined.

As you’d hope, the whole system is highly responsive to threats. When we tried introducing malware to some of our test Windows 10 systems, the local client blocked them immediately, with email alerts landing in our administrative mailbox barely ten seconds later.

The web portal is very informative. A graph displays the top five categories of cloud services in use and lets you drill down to see exactly who’s using what; our only slight niggle is that this took several hours to populate with details on detected services. Below, more graphs show device protection status, the OS spread, detected threats and the results of daily vulnerability scans. There’s a good set of predefined reports too, covering protection status, threats, database updates and cloud discovery, which can be exported in CSV and PDF formats.

If your business is of a suitable size, Kaspersky Endpoint Security Cloud is great value, especially since each licence includes protection for two mobile devices. The cloud discovery component can be a little slow, but endpoint protection doesn’t get any stronger than this and the cloud portal is very easy to work with.

Kaspersky has offered medical organisations free enterprise security software for six months to stay protected from cyber security threats as they begin to grapple with the brunt of the coronavirus outbreak.

The full product licenses span a host of B2B products, including endpoint and cloud infrastructure protection platforms such as Kaspersky Endpoint Security for Business Advanced, and Kaspersky Hybrid Cloud Security.

Healthcare bodies can also take advantage of six months’ usage of the firm’s software as a service (SaaS) endpoint protection product, dubbed Endpoint Security Cloud Plus, as well as its Microsoft Office 365 protection suite.

The Russian firm has extended the offer just as healthcare organisations, and wider businesses, face a wave of threats tied with the global pandemic.

Hackers, for example, are exploiting the general confusion around the outbreak to launch phishing attacks by posing as bodies like the Centre for Disease Control (CDC) and the World Health Organisation (WHO). These are similar to the kinds of attacks that were launched during the Ebola outbreak.

Healthcare systems have also been facing a wave of serious threats, including the NHS in Cumbria, which alone has been hit by more than 150 cyber attacks in the last five years.

“In this critical situation, healthcare institutions are under immense pressure and carry huge responsibility while saving people’s lives and fighting against the infection,” said VP of Kaspersky’s global sales network Evgeniya Naumova.

“Doctors, nurses and all medical staff take on most of the load and therefore need any support possible. We feel that it is our duty to support the medical community.”

The offer has been made so these organisations can channel their efforts into fighting the pandemic instead of worrying about their security setup over the next six months. Hospitals and medical institutions, in particular, will need to ensure the stability of equipment, and that data is freely flowing from system to system, and that staff can access it.

Kaspersky has also outlined a set of measures that healthcare organisations can take to raise their cyber resilience, including implementing awareness training for both medical and administrative staff.

The company has also recommended that hospitals re-examine their security systems to ensure they’re updated and configured properly, which includes turning on any firewalls and ransomware protection.

Hospitals urgently hiring more staff, meanwhile, including nurses and doctors, are also being advised to keep a handle on the growing number of endpoints that will come as a result.

In the same vein, medical devices should be properly configured and updated, including crucial equipment like ventilators, with the supply of these critical devices likely to ramp up significantly in the coming weeks and months.

Organisations around the world are taking measures to refocus their energy and efforts into frontline healthcare. NHS Trusts, for instance, have been granted a six-month delay to complete critical cyber security checks in order to focus their efforts on treating patients.

Kaspersky's Endpoint Security for Business (ESB) has been the foundation of its on-premises solutions for many years and the latest version introduces tougher security measures than ever before. The new intelligent adaptive anomaly control component watches out for abnormal user behavior and along with the ability to scan inbound and outbound HTTPS traffic, the web protection components have a keen nose for sniffing out mining malware.

ESB comes in three flavours with the Select edition including the Security Center management console, anti-malware, file server and mobile protection as well as device, web and application controls. The Advanced edition on review adds the adaptive anomaly control, encryption and patch management plus remote software installation, while the Total edition bolsters this with mail server, gateway and collaboration security.

Prices for the Advanced version on review start at 760 per year for 10 seats. Platform support is extensive as ESB can protect Windows, Mac and Linux workstations and servers and includes iOS and Android mobile device management (MDM) services using Exchange ActiveSync or its own iOS MDM server.

Kaspersky Endpoint Security for Business Advanced review: Management and deployment

ESB deployment starts by installing the Security Center 11 component on the designated host Windows workstation or server. It expects to have a SQL database made available and for testing, we installed Microsoft's SQL Server 2014 Express SP2.

Functioning as an MMC (Microsoft Management Console) snap-in, the Security Center 11 console receives a fresh lick of paint but retains the same intuitive format as previous versions. The ESB web console, on the other hand, sees a complete redesign and, along with vastly improved status dashboards and reporting, now provides full access to ESB's settings allowing it to be used instead of the Security Center if required.

You're spoilt for workstation deployment choices; ESB can search network subnets, workgroups and Active Directory (AD) domains. The ESB console places all discovered systems in an 'unassigned' list where we selected our Windows test workstations, pushed the Network Agent and Endpoint Security components to them with one job and watched ESB move them to the default managed group.

The automatic installation option is even faster. All unassigned systems can be added to a console group with this feature enabled and ESB will do all the hard work for you. Group structures based on selected workgroups or AD domains can be created where you leave the discovery routine to populate them and then run the entire deployment.

Kaspersky Endpoint Security for Business Advanced review: Group policies

The System Center creates a base set of security policies for the default group so all our test clients were protected immediately. You can create custom groups and apply new policies to define how a client's Network Agent and Endpoint Security components behave when they join a group.

ESB's group policies are a powerful feature as they allow you to centrally manage all endpoint security and threat protection features and stop end users fiddling with the client settings or uninstalling them. Policies can be modified from the System Center or web console and we found changes took around 10 seconds to be pushed out to our clients.

Choosing a group reveals all member systems, with each assigned colour-coded icons for at-a-glance status indicators. Selecting a client shows their properties in a right-hand pane while a drop down menu provides access to options such as running tasks, forcing synchronizations and viewing hardware and software inventories.

A useful support feature is the ability to fire up a remote control session with a selected client using RDP or Windows desktop sharing. Another valuable feature is ESB's integral vulnerability and patch management component which checked our clients, showed all required updates and offered to automatically deploy them.

Kaspersky Endpoint Security for Business Advanced review: Threat protection features

Policies provide easy access to all security features and we found it simple to customize the various components. Advanced threat protection includes access to Kaspersky's Security Network for reputation-based scanning, behavioral detection for ransomware protection and exploit protection.

Essential threat protection features include a memory resident file scanner, transparent scanning of email and web traffic, a client firewall and network attack detection. Many components can be modified easily just by using a slider bar to choose from three levels.

Policy security controls go even further as these allow you to enforce black and white application lists and decide what hardware devices can be used on client systems. The web content filtering component can't match the efficacy of UTM hardware appliances but Kaspersky has increased the number of available URL categories from 15 to 28.

Adaptive anomaly control is also enabled in this policy section and can be applied to Office app, WMI, script and PowerShell activities. We found it initially spends a few days in training mode after which it creates smart rules based on its findings, and you can quickly load reports to see training progress and whether any rules have been triggered.

Reporting is a real strength, too. ESB comes with a wide choice of predefined reports for viewing anything from infected computers and endpoint inventory to detected threats and web browsing behavior. We could easily create custom reports using these as templates, schedule them to run regularly and create tasks to have them emailed to us.

Kaspersky Endpoint Security for Business Advanced review: Verdict

Kaspersky's Endpoint Security for Business is a great choice for companies that prefer on-premises to cloud management. It's easy to deploy, offers a choice of MMC snap-in or web browser management access and delivers an unbeatable range of security measures for hardening your endpoints against malware.

Verdict

An on-premises endpoint protection solution suitable for a wide range of businesses that’s good value, easy to manage and packed to the rafters with tough security measures

Security Center 11: Windows 7/Server 2012 upwards

After a lengthy battle with the US government spanning over a year, Kaspersky Lab has lost its battle at the Washington DC Court of Appeals over the government's decision to ban its software from all federal government computers.

The court upheld the initial ruling made by a district court forbidding Kaspersky to bring a lawsuit against the US government following its "unconstitutional" claims which "relied on subjective, non-technical public sources such as uncorroborated and often anonymously sourced media reports, related claims and rumours", Kaspersky said in 2017.

The judges who upheld the district court's decision cited Congress's right to block the purchase of software provided by a specific vendor providing there is a genuine security risk associated with it.

"With or without Kaspersky's willing cooperation, explained the experts, the Russian government could use Kaspersky products as a backdoor into federal information systems," the court stated. "Then, having gained privileged and undetected access, Russia could make all manner of mischief."

Kaspersky's main argument centred around the punitive nature of the ban, claiming that the court's decision was less about protecting the government's safety, but punishing a firm with alleged ties with Russia's FSB.

"Since the company's inception over 21 years ago, it has always abided by the highest ethical business practices, and through our recently launched Global Transparency Initiative, Kaspersky Lab is exemplifying its ongoing commitment to assuring the integrity and trustworthiness of its products. Kaspersky Lab reaffirms that it has never, nor will ever, engage in cyber offensive activities, and the Court's decision does not conclude otherwise," the company said in a follow-up statement.

The order to ban Kaspersky from US government computers was originally made in 2017 by the Department of Homeland Security. All government departments and agencies were to develop plans to discontinue present and future use of Kaspersky's software from their computers within 90 days of the directive being issued.

"This action is based on the information security risks presented by the use of Kaspersky products on federal information systems," said the DHS in a statement. "Kaspersky anti-virus products and solutions provide broad access to files and elevated privileges on the computers on which the software is installed, which can be exploited by malicious cyber actors to compromise those information systems.

"The Department is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks."

The ban wasn't just an explosive response to Russia's influence on the 2016 presidential election, back in 2014 the anti-malware software company was accused of providing a backdoor into federal departments' systems after a top-secret exploit code was stolen in an NSA leak.

The software is also used by Russia's FSB and allegations were immediately pointed at them but Kaspersky refuted these claims, citing pirated Microsoft Office software installed by an employee as the cause.

The keygen used to create a counterfeit Office key was, in fact, a trojan which dropped a backdoor in the system; Kaspersky was turned off in order to illegally install the software thus allowing the FSB to access the system via the backdoor.

Most recently, the EU published a cyber security report in June 2018, calling for a comprehensive review of all IT software and equipment used by all member states in an attempt to stop "an unprecedented threat" of "politically motivated, state-sponsored cyber attacks". It labelled Kaspersky as software that had "been confirmed as malicious".

Earlier on in the year, Kaspersky attempted to make amends and rebuild a strong reputation for themselves, increasing the reward for its bug bounty program to $100,000 per critical vulnerability found in its own systems. Despite this peace offering, the EU remained unconvinced and labelled the Moscow-based company's software as 'malicious' anyway later in the year.

Kaspersky Lab founder Eugene Kaspersky has responded to Twitter's advertising ban on his company with an open letter invoking Game of Thrones that accuses the social network of "playing into the hands of cybercriminals".

Twitter alerted the company in January to the fact that it would "off-board advertising from all accounts owned by Kaspersky Lab", with the stated reason for the ban being that Kaspersky Lab's business model "inherently conflicts with acceptable Twitter Ads business practices" - a possible reference to accusations that Kaspersky has helped Russian spying efforts, which Kaspersky has robustly denied.

After asking Twitter for its reasoning around the ban back in February, founder and CEO Eugene Kaspersky published an open letter to Twitter chief Jack Dorsey and the rest of Twitter's leadership team last week, asking the company to explain why the ban has been enacted and what other security companies can do to prevent suffering similar bans.

"Understandably, you've been busy dealing with public and political pressure. As a response to all this pressure, social media platforms - Twitter in particular - need to somehow adapt their rules and policies," Kaspersky wrote. "But please, dear Twitter managers, I think it's of the utmost importance that any and all changes you do introduce in response to existing challenges are divulged in full and applied in a transparent manner."

Kaspersky argued that the majority of the company's promoted tweets are informative, educational posts about cyber security awareness, tips and research, and that even the purely marketing tweets it promotes are still in line with the behaviour of the rest of the IT industry, as is its business model.Kaspersky's letter - as well as several of the executive's tweets - implied that Twitter's actions amount to censorship.

In fact, he headed his letter with a quote from Game of Thrones character Tyrion Lannister: "When you tear out a man's tongue, you are not proving him a liar, you're only telling the world that you fear what he might say." Elsewhere he wrote: "Twitter is playing into the hands of cybercriminals when it hinders the delivery of important information on protection from cyberthreats."

Kaspersky is fighting back on multiple fronts against bans and blocks enforced by governments, filing a lawsuit against the Trump administration after mounting US pressure saw it prohibit public sector bodies from using Kaspersky Lab software,while in the UK, the National Cyber Security Centre issued guidance advising all government departments to avoid Russian antivirus firms.

Despite the ongoing furore though, figures from market research firm B2B International showed that the majority of businesses have not been put off using Kaspersky Lab's products, and the company last year maintained an average Net Promoter Score (which measures how likely customers are to recommend your company) of 49, in line with the upper echelons of the software market. More customers are also using Kaspersky as their main security provider compared to 2016.

Kaspersky said that the company will be donating all the money it had planned to spend on Twitter advertising over the course of 2018 (which amounted to more than 75,700 in 2017) to the Electronic Frontier Foundation, noting pointedly that the organisation does "a lot to fight censorship online".

IT Pro has contacted Twitter to try and find out the reasons behind Kaspersky's ban, but did not receive a response in time for publication.

Picture: Shutterstock

Kaspersky has upped its bug bounty programme to $100,000 for the discovery and disclosure of critical vulnerabilities in its applications, as part of its efforts to rebuild trust following allegations of spying.

The move comes at a time when the Moscow-based antivirus company faces international pressure over its alleged connections with the Russian government, leading to many high profile boycotts of its products, including by the US government, while the UK's national infosecurity authority has recommended government bodies avoid using Russian antivirus tools.

Kaspersky's top prize reward those finding 'remote code execution' bugs that allow malware to take over a user's system by using Kaspersky's automatic database update channel. The discovery of any other remote execution bugs will be eligible for rewards between $5,000 and $20,000 depending on their severity, while bugs allowing for elevation of privileges, or the leak of sensitive data, can be worth up to $5,000.

The new scheme is applicable to any vulnerabilities found in Kaspersky Internet Security 2019 and Kaspersky Endpoint Security 11, running on the desktop version of Windows 8.1 or later.

CEO Eugene Kaspersky said: "Finding and fixing bugs is a priority for us as a software company. We invite security researchers to make sure there are no vulnerabilities in our products. The immunity of our code and highest levels of protection that we offer customers is a core principal of our business - and a fundamental pillar of our Global Transparency Initiative."

Kaspersky has worked alongside bug bounty coordination platform Hackerone since the launch of the scheme in 2016, resulting in 70 bug reports qualifying for rewards.

The company's Global Transparency Initiative, announced in October last year, was an attempt to prove to the international security community that it was working to maintain the integrity of its software and rebuke claims that its tools could be unwittingly exploited by the Russian government to target foreign states.

As part of that initiatives launch, Kaspersky invited independent security analysts to review the source code in its products, and upped its bug bounty to $75,000. The results of that review have yet to be released, but the company has said it will share those with IT Pro when they are available.

Since then, the US government has moved to make it illegal to use Kaspersky software in any department or agency of the federal government, prompting a legal challenge from the antivirus firm after it claimed the decision harmed its reputation and commercial operations.

The UK's National Cyber Security Centre issued warnings to government departments in December advising they ditch Kaspersky products, as well as other Russian antivirus tools, as they pose a potential risk to national security.

Kaspersky has always maintained its innocence and independence from the Russian government.

Picture: Bigstock

04/12/2017:NCSC: Kaspersky antivirus could risk national security

The UK's National Cyber Security Centre (NCSC) has issued fresh warnings to all government departments against using Russian-based antivirus software, as fears mount that they could pose a risk to national security.

Official NCSC advice, updated over the weekend, claims that software such as Kaspersky Lab's antivirus suite could be exploited by the Russian government, at a time when the company is being investigated in the US.

Although the company denies any wrongdoing or any ties with Moscow, and planned to open up its source code for independent review, the US has since moved to ban the software from all government departments.

The source code review is currently ongoing, although the company has stated it would updateIT Prowith the findings when they are available.

Until now, the UK government has been quiet about its use of Russian-based products, however, in a letter addressed to department secretaries last Friday, NCSC CEO Ciaran Martin said that Russian products "should not be chosen".

"The NCSC advises that Russia is a highly capable cyber threat actor which uses cyber as a tool of statecraft," he wrote. "This includes espionage, disruption and influence operations. Russia has the intent to target UK central government and the UK's critical national infrastructure."

The advice, which also provides guidance for best security practices with cloud services, suggests that the government is willing to work alongside the likes of Kaspersky rather than seek an outright ban.

"We are in discussions with Kaspersky Lab, by far the largest Russian player in the UK, about whether we can develop a framework that we and others can independently verify, which would give the government assurance about the security of their involvement in the wider UK market," the letter added.

It added that the initial guidance was only aimed at central government departments, and it doesn't recommend any action in by public bodies outside of Westminster, nor does it suggest companies or the public stop using Kaspersky products.

However, as a result of the updated guidelines, Barclays has stopped offering the option of free Kaspersky software to its new customers as a "precautionary decision", and has advised those who have yet to install the suite to look for an alternative provider.

"Even though this new guidance isn't directed at members of the public, we have taken the decision to withdraw the offer," said a Barclays spokesperson, speaking to the BBC.

A spokesperson for Kaspersky Lab told IT Pro that the company was "disappointed" by Barclay's decision to discontinue giving free versions of its software to new customers, although was keen to reiterate that the NCSC is not discouraging people from using its products.

Simon Edwards, European cyber security architect at Trend Micro, said that any vulnerability in antivirus products is likely to be targeted at government, rather than the public.

"Reading into the research carried out by the US, it would seem that the vulnerability posed by Kaspersky was one that could only be used by the most sophisticated of attackers (i.e. state-sponsored)," said Edwards, speaking to IT Pro. "Therefore, if the organisation feels that they could be targeted by such a threat actor (i.e. government agencies), then there is a potential risk that should be addressed."

The NCSC's new stance comes a week after the newly formed Intelligence and Security Committee announced it was considering launching an investigation into Russian meddling against the UK.

Many MPs, including Labour's Mary Creagh, have suggested that Russia was behind a series of fake social media accounts created to try and influence the Brexit referendum result by spreading fake news.

CEO Eugene Kaspersky said in a tweet: "Let me stress: there is *no* ban for KL products in the UK. We are in touch with @NCSC regarding our Transparency Initiative and I am sure we will find the way to work together."

This initiative involves openingthree "Transparency Centres" in Asia, Europe and the US by 2020.

Picture: Bigstock

Security researchers have discovered a zero-day flaw in the Telegram desktop app that could enable hackers to infect systems with malware that can be used either as a backdoor or to mine cryptocurrency.

According to researchers at Kaspersky Labs, the vulnerability has been actively exploited since March 2017 for the cryptocurrency mining functionality, mining currencies such as Monero and Zcash.

Researchers said that the Telegram zero-day vulnerability was based on the RLO (right-to-left override) unicode method. It is generally used for coding languages that are written from right to left, like Arabic or Hebrew. Besides that, however, it can also be used by malware creators to mislead users into downloading malicious files disguised, for example, as images.

Hackers used a hidden unicode character in the file name that reversed the order of the characters, thus renaming the file itself. As a result, users downloaded hidden malware which was then installed on their systems. Kaspersky Lab said it had reported the vulnerability to Telegram and, at the time of publication, the zero-day flaw has not since been observed in the products.

Researchers also found several scenarios of zero-day exploitation in the wild by threat actors. The vulnerability was exploited to deliver cryptocurrency mining malware to mine several types of cryptocurrency including Monero, Zcash, Fantomcoin and others. While analysing criminals' servers, researchers found archives containing a Telegram local cache that had been stolen from victims.

Kaspersky also said that upon successful exploitation of the vulnerability, a backdoor that used the Telegram API as a command and control protocol was installed, resulting in criminals gaining remote access to the victim's computer. After installation, it started to operate in a silent mode, which allowed hackers to remain unnoticed in the network and execute different commands including the further installation of spyware tools.

Researchers said that artefacts discovered during the research indicate that the malware is Russian in origin.

"The popularity of instant messenger services is incredibly high, and it's extremely important that developers provide proper protection for their users so that they don't become easy targets for criminals," said Alexey Firsh, malware analyst, Targeted Attacks Research at Kaspersky Lab.

"We have found several scenarios of this zero-day exploitation that, besides general malware and spyware, was used to deliver mining software such infections have become a global trend that we have seen throughout the last year. Furthermore, we believe there were other ways to abuse this zero-day vulnerability."

Security firm Kaspersky Lab has warned that cyber attacks against third-party IT services suppliers are costing enterprises 1.3 million a year.

The issues stems from vulnerabilities or poor cyber security in third-parties' infrastructure and the services they provide, which when breached affects both the supplier and their customers.

Security breaches in third-party infrastructure alone cost enterprises around 1.2 million, Kaspersky said.

"Raising IT security budgets is only part of the solution, as the most staggering losses stem from the incidents involving third parties and their cyber-failures," said Alessio Aceti, head of the enterprise business division at Kaspersky Lab.

"While cyber security incidents involving third parties prove to be harmful to businesses of all sizes, their financial impact on a company has the potential to result in twice as much damage.

"This is because of a wider global challenge with threats moving fast, but businesses and legislation changing slowly. When regulations like GDPR become enforceable and catch up with businesses before they manage to update their policies, the fines for non-compliance will further add to the bill."

And the situation is potentially set to get more complex as governments across the globe push to introduce new legislation on data regulation and cyber security.

Kaspersky also pointed out that despite cyber security receiving a higher proportion of IT budgets, overall budgets for technology have come down, which could mean that investment in cyber security software and services is actually being reduced.

This can be seen as concerning given the cost of security and data breaches to an enterprise has gone up, according to Kaspersky.

All this suggests that companies investing in security should proceed with caution, making sure the services they procure and use are robust enough to resist and recover from cyber attacks. And they should remember that investment in security services is far less costly than dealing with the consequences of a cyber attack or data breach.

Picture: Bigstock