Kaspersky Lab's Global Research and Analysis Team (GReAT) was established in 2008. It investigates cybersecurity threats and other work by malware operations. IT security companies are often evaluated by their ability to uncover previously unknown viruses and vulnerabilities. Beginning around 2010, Kaspersky exposed a series of government-sponsored cyber-espionage and sabotage efforts. These include
Stuxnet,
Duqu,
Flame, Gauss,
Regin and the
Equation Group. and Flame."
Stuxnet In 2010, Kaspersky Lab worked with Microsoft to counteract the
Stuxnet worm, which had infected 14 industrial locations in
Iran using four zero-day vulnerabilities in Microsoft Windows. According to IEEE Spectrum, the circumstances "strongly suggest" the worm was developed by the
United States and
Israel to damage centrifuges in Iran's nuclear-enrichment program. It was the first discovery of a major government-sponsored cyber-attack.
Flame In May 2012, Kaspersky Lab identified the
malware Flame, which a researcher described as potentially "the most sophisticated cyber weapon yet unleashed". According to the researchers in Kaspersky Lab, the malware had infected an estimated 1,000 to 5,000 machines worldwide when asked by the United Nations
International Telecommunication Union to investigate reports of a virus affecting
Iranian Oil Ministry computers. As Kaspersky Lab investigated, it discovered an
MD5 hash and filename that appeared only on customer machines from Middle Eastern nations. After discovering more pieces, researchers dubbed the program "Flame" after the name of one of its modules.
Red October In January 2013, Kaspersky discovered the
Red October malware, which had been used for widespread cyber-espionage for five years. It targeted political targets like embassies, nuclear sites, mostly in Europe, Switzerland and North America. The malware was likely written by Russian-speaking hackers and the exploits by Chinese hackers. That June, Kaspersky discovered NetTraveler, which it said was obtaining data on emerging technology from government targets and oil companies. Kaspersky did not identify who was behind it, but it was similar to other cyber-espionage coming from Beijing, China. Later that same year, Kaspersky discovered a hacker group it called Icefog after investigating a cybersecurity attack on a Japanese television company. Kaspersky said the hacker group, possibly from China, was unique in that they targeted specific files they seemed to know about before planting malware to extract them.
Mask In February 2014, Kaspersky identified the malware Mask, which infected 380 organizations in 31 countries. Many organizations that were affected were in Morocco. Some of the files were in Spanish and the group is believed to be a state conducting espionage, but Kaspersky did not speculate on which country may have developed it.
Regin In November 2014, Symantec and Kaspersky authored papers that contained the first disclosure of malicious software named
Regin. According to Kaspersky, Regin is similar to QWERTY, a malware program discovered the next year. Regin was used to take remote control of a computer and is believed to have originated from the
Five Eyes alliance. That same month Kaspersky reported on the
Darkhotel attack, which targeted users of wireless networks at hotels in Asia. It asked users to update their software, and then download malware that gave up their passwords.
Equation Group In 2015, Kaspersky identified a highly sophisticated threat actor that it called "The Equation Group". The group incorporated sophisticated spying software into the firmware of hard drives at banks, government agencies, nuclear researchers and military facilities, in countries that are frequent targets of US intelligence efforts. It is suspected to have been developed by the National Security Agency (NSA) and included many unique technical achievements to better avoid detection. That same day, Kaspersky announced the discovery of a hacker group it called
Carbanak, which was targeting banks and moving millions of dollars into fake accounts. Carbanak was discovered when one bank asked Kaspersky to investigate suspicious behavior from its ATMs. A similar malware using some of the same techniques as Carbanak was discovered in 2016 and dubbed Carbanak 2.0.
Duqu In June 2015, Kaspersky reported that its own network had been infiltrated by government-sponsored malware. Evidence suggested the malware was created by the same developers as
Duqu and
Stuxnet, in order to get intelligence that would help them better avoid detection by Kaspersky in the future. Kaspersky called it Duqu 2.0. The malicious software resided in memory to avoid detection. The hack was believed to have been done by the same group that did
Duqu in 2011. It used exploits in Microsoft installer files.
Android cyber-espionage In June 2015, Kaspersky Lab and Citizen Lab both independently discovered software developed by
Hacking Team and used by 60 governments around the world to covertly record data from the mobile phones of their citizens. The software gave police enforcement a "menu of features" to access emails, text messages, keystrokes, call history and other data. Kaspersky also identified 37,000 attacks against banking companies that used modifications of the malware called Asacub and took control of Android devices. Asacub targeted mostly banking customers in the US, Russia and Ukraine using an SMS message that baited users into installing a Trojan.
Silverlight In 2016, Kaspersky discovered a zero day vulnerability in
Microsoft Silverlight.
Poseidon Group In 2016, Kaspersky uncovered the Poseidon Group, which would infiltrate corporations with malware using phishing emails, then get hired by the same company as a security firm to correct the problem. Once hired, Poseidon would install additional malware and backdoors. In June 2016 Kaspersky helped uncover a Russian hacking group, leading to 50 arrests.
Symantec confirmed Kaspersky's findings, reporting that at least 13,000 computers belonging to Symantec customers were infected with the malicious software update. About 18 percent of the infected systems belonging to Kaspersky customers were located in Russia, followed by fewer German and French computers. About 5 percent of infected Kaspersky customers were located in the US, while about 15 percent of Symantec's 13,000 infected systems were located in the US.
Titanium In 2019, Kaspersky uncovered Titanium, a very advanced and insidious
backdoor malware APT, developed by
PLATINUM, a
cybercrime collective. Kaspersky Lab reported the malware on November 8, 2019.
MATA Toolset Campaign In 2020, Kaspersky published research on the MATA Toolset Campaign, a sophisticated cyber-espionage framework targeting multiple operating systems, including
Windows,
macOS, and
Linux. The
malware, attributed to the
Lazarus Group, was used for stealing databases, distributing
ransomware, and installing
backdoors on infected systems. MATA's capabilities allowed attackers to execute a wide range of malicious activities, including exfiltrating sensitive data from corporate networks and compromising financial systems. The campaign highlighted the increasing cross-platform threat posed by state-sponsored actors. In September 2022 and October 2023, new malware samples linked to the MATA cluster were uncovered.
SparkCat In February 2025, Kaspersky discovered SparkCat, a first
OCR infostealer found on the iOS
App Store. On iOS and Android, SparkCat requests access to users' photo galleries when they attempt to use the support chat in an infected app. Once granted permission, the malware uses OCR technology to decipher text in photos and looks for screenshots of passwords or phrases to gain access to
cryptocurrency; it sends the gathered information to the attacker. By February10, 2025, Apple and Google had removed about 20apps from their app stores, but the malware persisted in unofficial stores and websites. ==Bans and allegations of Russian government ties==