Kaspersky Archives

Tech Optimizer

August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.

Tech Optimizer

August 29, 2026

90% of APAC Gen Z Experienced Cyber Incidents: Kaspersky Study

Recent research from Kaspersky highlights that 57% of Generation Z spends more time online than offline, with 75% of APAC Gen Zs using smartphones for daily internet access. Approximately two-thirds of Gen Zs in APAC feel comfortable navigating the digital environment, with confidence levels peaking at 77% in Indonesia and 71% in Vietnam. However, only 26% consider their knowledge of digital risks advanced, with India leading at 35%. Only 22% of Gen Zs in APAC use antivirus software, and 35% change their passwords regularly. Alarmingly, 90% have experienced at least one cyber incident in the past year. Smartphones are seen as critical for storing personal documents and passwords, yet only a third of Gen Zs back up important information regularly. Kaspersky emphasizes the need for cybersecurity measures to be integrated into daily routines and has introduced an interactive game to raise awareness among Gen Z users. The study surveyed 7,200 respondents across 18 countries in March 2026.

Tech Optimizer

August 26, 2026

AVG Antivirus Review 2026: Is the Free Version Enough?

AVG AntiVirus Free has an overall rating of 4.2 out of 5 stars, with specific scores of 4.7 for protection, 4.3 for performance and features, and 3.5 for customer support. The software is available for free or can be purchased starting at .88 for the first year, with pricing verified in August 2026. It achieved a 99.77% malware detection rate with only four false alarms and offers features such as real-time protection and Ransomware Protection. However, customer support is rated lower, and there are upselling prompts after scans. AVG is owned by Gen Digital and has been in operation for over 35 years, originally founded as Grisoft in the Czech Republic. The free version includes essential features like File Shield, Behavior Shield, Web Shield, Email Shield, and Ransomware Protection, while some features like Enhanced Firewall and Fake Website Shield are exclusive to paid versions. AVG's performance on Windows 11 has been validated by independent tests, scoring 6/6/6 in AV-TEST and achieving a 96.3% offline detection rate in AV-Comparatives. The software is available across multiple platforms, including Windows, Mac, Android, and iOS. AVG's customer support includes email and phone options, with a reasonable response time. The software is safe to install when downloaded from official sources, and it has been recognized for its effectiveness in malware detection.

Tech Optimizer

August 26, 2026

How to Protect Against Ransomware: 13 Steps [2026]

Global ransomware attacks increased by 0.8% quarter-over-quarter in Q2 2026. The group Qilin has 279 confirmed victims, maintaining its position as the leading threat actor for four consecutive quarters. The rival group The Gentlemen saw a 62% increase in victims, reaching 269. Checkpoint Research's report indicates a shift in the ransomware landscape, challenging the narrative of declining attacks. IBM's analysis shows breaches within supply chains and third-party vendors have quadrupled over the past five years. Effective ransomware protection requires administrative access to endpoints, firewalls, and backup systems, along with specific software versions and tools. The 3-2-1-1-0 backup strategy is recommended, emphasizing offline, immutable backups. Organizations should implement multi-factor authentication (MFA) across all access points and actively patch known vulnerabilities. Network segmentation is crucial to limit ransomware spread, and canary files can provide early warnings of attacks. Regular phishing simulations and a well-documented incident response plan are essential for preparedness.

Tech Optimizer

August 22, 2026

More Than Half of Gen Z Has Faced a Cyberattack

Generation Z spends more time online than offline, with 57% of participants indicating this trend, the highest among all generations surveyed. Smartphones are the primary means of internet access for 67% of Gen Z respondents. Despite 59% feeling confident in navigating the digital landscape, only 28% believe they have advanced digital skills. Only 27% use antivirus software on their smartphones, and they change passwords less frequently than older generations. Over half (52%) reported experiencing a cyberattack affecting a device, account, or personal information, with 17% indicating compromised social media accounts and 12% losing access to gaming accounts. A significant 38% value their photos and personal documents highly, and 30% consider passwords and account credentials extremely important. However, only 28% regularly back up important data on their devices, risking exposure of sensitive information if their phones are lost or compromised.

Tech Optimizer

August 22, 2026

Best Ransomware Protection 2026: Tested and Ranked

Ransomware protection is best approached as a layered strategy rather than relying on a single solution. The effectiveness of software is significantly enhanced by maintaining a well-managed backup that is disconnected during an attack. Five tools were evaluated based on their default settings, focusing on behavioral detection, protected folders, file rollback, and real-time protection. 1. Norton 360: Rated as the best overall ransomware protection, it offers comprehensive features including behavioral monitoring, protected folders with dual alert modes, and 50 GB of cloud backup within a single subscription. It has a perfect score in advanced threat assessments. 2. Bitdefender: Recognized for its file rollback and remediation capabilities, it provides an effective "undo" feature that restores files, although this feature is turned off by default. 3. Avast One Free: The best free ransomware protection option, it includes a dedicated shield on the free Windows tier and has achieved a perfect score in advanced threat assessments. 4. NordVPN Threat Protection Pro: Best for blocking the delivery route of ransomware, it prevents downloads before encryption starts but cannot stop the process once it has begun. 5. McAfee: Best for protecting multiple devices simultaneously, it offers unlimited device coverage on most plans with integrated ransomware defense in its scanning engine. Modern ransomware protection software has shifted from signature matching to focusing on monitoring the behavior of processes interacting with files. The four essential layers of protection include behavioral monitoring, protected folders, automatic file rollback, and backup. Most users do not need a separate anti-ransomware product, as these features are typically included in main antivirus suites, with the key consideration being whether these features are activated. The rankings of the tools were based on whether the ransomware protection layer is enabled by default, the extent of file recovery when intervention occurs, and the frequency of false positives during normal use. - Norton 360: Best overall, with protection enabled by default and a perfect score in advanced threat testing. - Bitdefender: Best for file rollback, but the rollback feature is disabled by default. - Avast One Free: Best free option, with a perfect score in advanced threat assessments but lacks rollback capabilities. - NordVPN Threat Protection Pro: Effective at blocking malware downloads but does not provide rollback or backup features. - McAfee: Suitable for families with multiple devices, offering automatic backup of flagged files but lacks user-configurable protected folder options. The effectiveness of ransomware protection tools is primarily assessed through behavioral responses rather than library matching. Backup remains a critical layer of defense, functioning even when other layers fail.

AppWizard

August 21, 2026

New Android Malware Spotted Infecting Cars Via Software Updates

A new strain of Android malware has emerged, targeting automotive head units responsible for infotainment, connectivity, and navigation in vehicles. Discovered by Kaspersky in June, this is the first documented instance of malware affecting car head units, specifically within the firmware updaters of Android-based software developed by DoFun, a Hong Kong company. The malware, disguised as an application called JarService, infiltrates devices without user awareness. It is delivered through a legitimate system application called TWCore, which collects analytics and updates software. The malware aims to convert the head unit into a botnet, equipped with commands to download and execute code and display advertisements, potentially for online ad fraud. Kaspersky notified DoFun, which addressed the vulnerabilities, and noted similarities between this malware and a previous threat called BadBox, which affected various Android devices.

Tech Optimizer

August 18, 2026

Avira Antivirus Review 2026: Plans, Test Results, and Alternatives

Avira has an overall rating of 4.2 out of 5 stars, with specific ratings as follows: Protection: 4.2/5, Performance: 3.9/5, Features: 4.6/5, Support: 4.0/5, and Value: 4.3/5. Pricing starts at .99 for the first year. Avira's detection rate is 99.96%, but it has a slower full scan time of 18 minutes and 14 seconds and flagged 12 false positives during testing. The software includes a free tier with a VPN, password manager, and software updater, while the paid version, Avira Prime, covers up to five devices for .99 in the first year. Avira Operations GmbH, based in Germany, was acquired by NortonLifeLock in 2021, forming Gen Digital. The software is considered safe and trustworthy, with a clean installation process and detailed privacy policy. Avira's free version offers real-time protection, web safety features, a firewall, and a limited VPN service, but lacks automatic patching and unlimited VPN data.

Tech Optimizer

August 18, 2026

The temporary download folder unleashes 35% of infostealers on Windows

Executing files directly from the temporary download folder is the primary gateway for infostealers targeting Windows systems, accounting for approximately 35% of analyzed infections. The second most common entry point is C:WindowsMicrosoft.NETFramework, appearing in 32% of cases and associated with advanced tactics like process injection. The findings are based on a report by Kaspersky, which analyzed five million records from the dark web. Malicious files often disguise themselves as legitimate software, such as fake codecs or program activators. Kaspersky recommends monitoring exposed assets and not disabling antivirus software during installations.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.