Kaspersky Assessment Report Finds Long-Undetected Intrusions and Response Gaps
Summary
Kaspersky’s 2025 compromise assessments found that 30.8% of discovered incidents had activity older than three months. The report highlights missed alerts, web shells in backups and gaps in monitoring and incident response.
Key points
- Kaspersky analyzed its 2025 compromise-assessment engagements using endpoint scans, logs, network traffic and, where necessary, forensic investigation.
- The oldest missed incident had persisted for nearly four years; 52% of high-severity compromises had historical activity spanning more than three months.
- Of discovered incidents, 20% were found manually, while 60% had been missed because existing tools produced no high-confidence alerts.
- Forty percent of discovered web shells were in backups, creating a risk of reinfection when files were restored.
- Post-incident checkups had the highest share of high-severity findings at 40.7%, compared with 27.7% for general audits.
- Case studies included NSABuffMiner on domain controllers, PurpleFox missed by disabled memory inspection, and LionTail detected through memory signatures.
- The report recommends continuous monitoring, validation of low-confidence alerts, asset and backup reviews, and updated response playbooks.
Article Details
- Publisher
- Kaspersky
- Report Period
- 2025
- Scope
- Missed incidents and response gaps identified in global compromise assessment engagements.
- Key Statistics
- Of discovered incidents, 20% were found manually and 60% had been missed because existing tools generated no high-confidence alerts.
- Historical activity spanned more than three months in 30.8% of all discovered incidents and 52% of high-severity compromises; the oldest missed incident was four years old.
- Of discovered web shells, 40% were stored in backups and 60% were on active systems.
- Post-incident checkups had the highest proportion of high-severity findings, at 40.7%.
- Internal communication issues materially affected response execution in 32% of projects.
- Recommendations
- Conduct regular compromise assessments and maintain continuous monitoring and threat hunting.
- Validate detection-engine health, telemetry and rule relevance, and have analysts review low-confidence alerts.
- Maintain a complete asset inventory, apply patches and audit logging, and audit GPO and shared-folder permissions.
- Establish authorized remote-management baselines, centralize operational logs, and monitor for deviations and LoLBin abuse.
- Update incident response plans as evidence emerges and conduct tabletop exercises that test technical and communication workflows.
MITRE ATT&CK
T1003 · OS Credential DumpingA Mimikatz binary and associated memory dump confirmed a credential theft operation.T1021.002 · SMB/Windows Admin SharesThe NSABuffMiner campaign spread via SMB, and a separate intrusion used PsExec to run a script across servers.T1053.003 · CronA cron job repeatedly downloaded and restored a PHP web shell.T1053.005 · Scheduled TaskAttackers used scheduled tasks to execute propagation scripts and a downloaded executable.T1055 · Process InjectionNSABuffMiner-related files injected malicious DLLs into lsass.exe and explorer.exe.T1059.001 · PowerShellPowerShell was used to download and execute malicious payloads.T1059.004 · Unix ShellInvestigators found a bash reverse shell running under the web application account.T1105 · Ingress Tool TransferAttackers downloaded a web shell and other payloads to compromised hosts.T1546.003 · Windows Management Instrumentation Event SubscriptionA malicious WMI event consumer downloaded and executed a PowerShell script.T1547.001 · Registry Run Keys / Startup FolderClipBanker persisted through a Windows Run registry key.T1562.001 · Disable or Modify ToolsA ClipBanker variant added its folder to Windows Defender exclusions.
Threat Actors
Malware
ClipBankersuch as NSABuffMiner, PurpleFox, LionTail, Scarred Manticore, Impacket, Cobalt Strike, Mimikatz, and ClipBanker.LIONTAILLoLBins, remote management tools, and named campaigns and actors such as NSABuffMiner, PurpleFox, LionTail, Scarred Manticore, Impacket, Cobalt Strike, Mimikatz, and ClipBanker.PurpleFoxof web shells, LoLBins, remote management tools, and named campaigns and actors such as NSABuffMiner, PurpleFox, LionTail, Scarred Manticore, Impacket, Cobalt Strike, Mimikatz, and ClipBanker.XMRigThis results in the loading of the XMRig miner.
Vendors
Products
Tools
Cobalt Strikenamed campaigns and actors such as NSABuffMiner, PurpleFox, LionTail, Scarred Manticore, Impacket, Cobalt Strike, Mimikatz, and ClipBanker.Impackettools, and named campaigns and actors such as NSABuffMiner, PurpleFox, LionTail, Scarred Manticore, Impacket, Cobalt Strike, Mimikatz, and ClipBanker.Mimikatzand actors such as NSABuffMiner, PurpleFox, LionTail, Scarred Manticore, Impacket, Cobalt Strike, Mimikatz, and ClipBanker.PsExec[T1021.002 ] Remote Services: SMB/Windows Admin Shares – Lateral movement and propagation used SMB and PsExec-like administration (‘spreads via the SMB protocol’ / ‘used PsExec to execute a .cmd script across all the
Industries
EducationThe government sector accounted for around 29% of incidents, followed by the education (19%) and financial (17%) sectors.financialThe government sector accounted for around 29% of incidents, followed by the education (19%) and financial (17%) sectors.GovernmentThe government sector accounted for around 29% of incidents, followed by the education (19%) and financial (17%) sectors.