Stay ahead of your adversaries

Kaspersky
ThreatIntelligenceKaspersky Threat Intelligence
Threat Intelligence from Kaspersky gives you access to the intelligence you need to mitigate cyberthreats,
provided by our world-leading team of researchers and analysts.
Kaspersky’s knowledge, experience and deep intelligence of every aspect of cybersecurity has made us
the trusted partner of the world’s premier law enforcement and government agencies, including INTERPOL
and leading CERTs. Kaspersky Threat Intelligence gives you instant access to tactical, operational and strategic
Threat Intelligence.
Kaspersky Threat Intelligence delivers a comprehensive view of the global threat landscape, combining
intelligence sources, threat data feeds, and in-house research, all analyzed by our team of experts to deliveractionable insights to help organizations protect against cyber threats.

Kaspersky Threat Data Feeds

Kaspersky APT Intelligence Reporting

Kaspersky
ThreatIntelligence

Kaspersky CyberTrace

Kaspersky Threat Lookup

Kaspersky Threat Infrastructure Tracking

Kaspersky Crimeware Intelligence Reporting

Kaspersky ICS Reporting

Kaspersky Digital Footprint Intelligence

TacticalOperational
Strategic

Kaspersky Threat Analysis:
Sandbox

Attribution

Kaspersky Takedown Service

Similarity

Kaspersky Ask the Analyst
Available via Threat Intelligence Portal

TacticalOperational

Strategic

Low-level, highly perishable informationthat supports security operations andincident response. An example of tacticalintelligence is IOCs related to an conduct of
a newly discovered attack.

This level usually includes data on
campaigns and higher-order TTPs. It may
include information on specific actor
attribution as well as capabilities and intent
adversaries.

This level is supporting C-level executives
and boards of directors in making serious
decisions about risk assessments, resource
allocation, and organizational strategy. This
information includes trends, actor
motivations, and their classifications.

Roles:

Roles:

Roles:SOC Analyst

SOC L3 Analyst

DFIR Analyst

CISO

CTO

CIO

IR Analyst
Systems:
SIEM
IPS
SOAR

Processes:
NGFW

IDS

Threat Hunting
Monitoring

Processes:
Systems:
SIEM
EDR/XDR

NTA
TIP

Processes:

Building an IS strategy

Incident Response

Awareness raisingThreat Hunting

CEOKaspersky Threat Intelligence application scheme
Detection & Investigation

Investigation & Response

Vulnerability Management

Investigation & Response

52Prevention• Threat Intelligence Reporting6• Digital Footprint Intelligence• Ask the Analyst

SDL• Takedown Service• Threat Lookup• Threat Analysis

8

3

1

4

1

1

1

Strategic Planning
ICS
7• APT Intelligence
Reporting• Crimeware Intelligence
Reporting• ICS Intelligence
Reporting• DFI Analytical Report

Network traffic

Telemetry

Kaspersky Threat Intelligence empowers you
Proactively identify
and prevent threats

Gain visibility into yourdigital footprint

Enhance your threat
detection capabilities

Kaspersky Threat Intelligence keeps
you informed about the latest threats
and vulnerabilities, empowering you
to take proactive measures to protect
your systems before an attack occurs.

Kaspersky Threat Intelligence provides
a comprehensive view of your digital
footprint, including any assets that may
be vulnerable to attack or compromise.

Kaspersky Threat Intelligence helps you
augment your existing security solutions
with the latest threat intelligence,
improving your ability to detect and blockadvanced threats.

Improve your incident
response

Comply with regulations
and standards

Enrich your in-house
expertise

Kaspersky Threat Intelligence delivers
real-time information about emerging
threats and indicators of compromise, so
you can respond quickly and effectively
to incidents.

All companies are subject to various
regulations and standards within theirindustry. Kaspersky Threat Intelligencesupports compliance by helping you
meet these requirements.

Kaspersky's team of experts are among
the most experienced and respected
researchers in the industry, bringing a
wealth of knowledge and expertise to
your Information Security teams.

Kaspersky Threat Data Feeds
Cyberattacks happen every day. Cyberthreats are constantly growing in frequency, complexity
and obfuscation, as they try to compromise your defenses. Adversaries use complicated intrusion kill chains,
campaigns and customized Tactics, Techniques and Procedures (TTPs) to disrupt your business or damage
your customers. Effective protection requires new methods, based on threat intelligence.
By integrating up-to-the-minute threat intelligence feeds containing information on suspicious and dangerous
IPs, URLs and file hashes into existing security systems like SIEM, SOAR and Threat Intelligence Platforms,
security teams can automate the initial alert triage process while providing their triage specialists with enoughcontext to immediately identify alerts that need to be investigated or escalated to incident response teams
for further investigation and response.
Kaspersky Threat Data Feed delivers real-time threat intelligence information to help you protect yournetworks and systems from cyberthreats. Data feeds include information on known malware, phishingwebsites, the latest vulnerabilities and exploits, and other types of cyberthreats - information to help you block
malicious traffic, update your security software, and take other measures to protect against cyberattacks.

TI reinforced security controls
Sandboxing
KSN telemetry

Sensors

Web crawlers

Passive DNS

Bot Farms

Pa ners

Spam / IoT traps

OSINT

1
Data is collected from a wide varietyof trusted sources, including the
Kaspersky Security Network and ourown crawlers, botnet threat monitoring
service (tracks botnets and their targets
24/7), spam traps, data from researchgroups, partners and much more.

Human research

Reputation analysis

Kaspersky
Threat Intelligence2
All collected information is carefully
checked and cleaned in real time using
various pre-processing methods:
sandboxing, statistical and heuristic
analysis, similarity tools, behavioral
profiling and expert analysis.

ML / AI

Kaspersky
Threat Data
Feeds

SIEM

SOAR

IRP

TIP

EDR

XDR

NGFW

IDS

IPS

Proxy

and others

3
Data Feeds help to collect threat
information about an alert or incident,
and to dig into details. It also helps
answer the questions ‘Who? What?
Where? Why?’ and identify the sourceof an attack, enabling quick decisionmaking to protect your company fromthreats of any complexity.

Contextual data
Contextual data helps reveal the ‘bigger picture’, further validating and supporting the wide-ranging use of
the data. Entries in feeds provided by Kaspersky contain the following contextual data that help you to quickly
confirm and prioritize threats:

1

2

3

Threat names

IP addresses and domainnames of malicious web
resources

Hashes of malicious files

4

5

6

Vulnerable
and compromised objects

Tactics, techniques
and procedures of attacks
according to MITRE
ATT&CK classification

Timestamps

7

8

Geolocation

Popularity, and so on

Kaspersky Threat Data Feeds benefits

Improve and accelerate your incident
response and forensic capabilities
by automating the initial triage process while providing yoursecurity analysts with enough context to immediately identify
alerts that need to be investigated or escalated to incident
response teams for further investigation and response.

Prevent the exfiltration of sensitive
assets and intellectual property
from infected machines to outside your organization. Detect
infected assets fast to protect your brand reputation, maintainyour competitive advantage and secure business opportunities.

Reinforce your security solutions
including SIEMs, Firewalls, IPS/IDS, Security Proxy, DNS
solutions, Anti-APT, with continuously updated Indicatorsof Compromise (IOCs) and actionable context to get insights
into cyberattacks and a greater understanding of the intent,
capabilities and targets of your adversaries. Leading SIEMs(including ArcSight, IBM QRadar, MS Sentinel, Splunk, etc.) and TI
Platforms are fully supported.

Grow your MSSP businessby providing industry-leading threat intelligence as a premium
service to your customers. As a CERT, enhance and extend yourcyberthreat detection and identification capabilities.

Kaspersky CyberTrace
The ongoing growth in the number of threat data feeds and available threat intelligence sources makes it difficult
for companies to determine what information is relevant for them. At the same time, threat intelligence comesin many different formats and includes a huge number of Indicators of Compromise (IoCs), making it hard for
SIEMs and other network security controls to digest them.
By integrating up-to-the-minute machine-readable threat intelligence into existing security controls like SIEM
systems, Security Operation Centers can automate the initial triage process while providing their security
analysts with enough context to immediately identify alerts that need to be investigated or escalated to incident
response teams for further investigation and response.
Kaspersky CyberTrace is a threat intelligence platform enabling seamless integration of threat data feeds
with SIEM solutions to help analysts leverage threat intelligence in their existing security operations workflow
more effectively. It integrates with any threat intelligence feed (from Kaspersky, other vendors, OSINT or yourown customer feeds) in JSON, STIX, XML and CSV formats, and supports out-of-the-box integration withnumerous SIEM solutions and log sources.

Highlights

Detailed information about eachindicator to provide even deeper analysis.
Each page presents all information about
an indicator from all threat intelligence
suppliers (deduplication) so analysts candiscuss threats in the comments andadd internal threat intelligence about
each indicator

Feed usage statistics for measuring
the effectiveness of the integrated
feeds and the feeds intersection matrix
help choose the most valuable threat
intelligence suppliers

Tagging IoCs simplifies IoC management.
Create any tag and specify its weight(importance) and use it to tag IoCs
manually. You can also sort and filter IoCs
based on these tags and their weights

A Research Graph lets you visually
explore data and detections stored
in CyberTrace and discover threat
commonalities

The indicators export feature lets you
export indicator sets to security controls
such as policy lists (block lists) and sharethreat data between Kaspersky
CyberTrace instances or with other TI
platforms

The historical correlation feature(retroscan) lets you analyze observablesfrom previously checked events using
the latest feeds to find previously
discovered threats

Multitenancy supports MSSPs and large
enterprise use cases

Sends detection events to SIEM
solutions, reducing the load on SIEM
as well as analysts

HTTP RestAPI lets you look up
and manage threat intelligenceHow it works
SIEM aggregates event logs from different network
devices and IT systems

Logs with URLs, hashes and
IPs are sent to CyberTracefor additional analysis

CyberTrace rapidly matches incoming
events with feeds and sends detected
events to SIEM and CyberTrace Web

Forwarded
eventsLog sources

2

1

3

SIEM
Raw logs

Cyber
Trace

Detection
eventsSecurity
Officer

4
Dashboards

CyberTrace
Web

Internal feed sources

Corporate network• Views events with security context and receives alerts• Investigates security incidents based on context

Kaspersky Threat Data Feeds,
commercial feeds, OSINT feeds,
custom feeds

Kaspersky CyberTrace parses incoming logs and events, rapidly matches the resulting data to feeds, and generates its own threat
detection alerts, significantly reducing the SIEM workload.

Benefits of using CyberTrace with Kaspersky Threat Data Feeds

Effectively distill and prioritize
huge amounts of security alerts

Improve and accelerate triage
and initial response processes

Immediately identify alerts critical for your business and escalate to IR teams

Build a proactive
and intelligence-driven defenseKaspersky Threat Lookup
Cybercrime knows no borders, and technical capabilities are improving fast: we’re seeing attacks becoming
increasingly sophisticated as cybercriminals use dark web resources to threaten their targets. Cyberthreats
are constantly growing in frequency, complexity and obfuscation, as new attempts are made to compromise
your defenses. Attackers are using complicated kill chains, and customized Tactics, Techniques and Procedures(TTPs) in their campaigns to disrupt your business, steal your assets or damage your clients.
Kaspersky Threat Lookup delivers all the knowledge acquired by Kaspersky about cyberthreats and theirrelationships, brought together into single, powerful web service. The goal is to provide your security teams withas much data as possible, preventing cyberattacks before they impact your organization. The platform retrieves
the latest detailed threat intelligence about URLs, domains, IP addresses, file hashes, threat names, statistical /behavior data, WHOIS/DNS data, file attributes, geolocation data, download chains, timestamps etc. The result
is global visibility of new and emerging threats, helping you secure your organization and boosting incident
response.

How it works

Objects to analyze

Files

URLs

Domains

IP addresses

HashesLookup

Kaspersky
ThreatIntelligence

Contextual
Intelligence• Is it malicious?
• Are we under threat?
• What is it designed to do?
• What relationships does it have?

Alert & incident
prioritization

Highlights
Trusted Intelligence

Threat Hunting

Easy-to-use

A key attribute of Kaspersky Threat
Lookup is the reliability of ourthreat intelligence data, enrichedwith actionable context. Kaspersky
leads the field in anti-malware tests,
demonstrating the unequalled qualityof our security intelligence by delivering
the highest detection rates, with nearzero false positives.

Be proactive in preventing, detecting
and responding to attacks, to minimize
their impact and frequency. Trackand aggressively eliminate attacks
as early as possible. The earlier you
discover a threat, the less damage it
can cause, the faster repairs take place
and the sooner network operations canget back to normal.

Web interface or RESTful API. Use
the service in manual mode througha web interface (via a web browser)
or access it via a simple RESTful API —whichever you prefer

Wide range of export formats
Export IOCs (Indicators of Compromise) or actionable context into widely used, more organized machine-readable sharing formats, suchas STIX, OpenIOC, JSON, Yara, Snort or even CSV, to extract the maximum benefit of threat intelligence, automate operational workflow,
or integrate with security controls such as SIEMs.

Kaspersky Threat Lookup benefits
1
Conduct deep searches into threat
indicators with highly-validated threat
context that lets you prioritize attacks
and focus on mitigating the threats thatpose the most risk to your business

4
Look up threat indicators from a webbased interface or via the RESTful API

2
Diagnose and analyze security
incidents on hosts and the network
more efficiently and prioritize signals
from internal systems against unknown
threats

5
Examine advanced details including
certificates, commonly used names, filepaths, or related URLs to discover new
suspicious objects

3
Boost your incident response
and threat hunting capabilities
to disrupt the kill chain before criticalsystems and data are compromised

6
Check whether the discovered object iswidespread or unique and understand
why an object should be treatedas maliciousKaspersky Threat Analysis
Faced with a potential cyberthreat, the decisions you make, and how well you can make them, can both provecritical. It is impossible to prevent today’s targeted attacks solely with traditional anti-virus tools. Anti-virus
engines are capable of stopping only known threats and their variations, while sophisticated threat actors use
all means at their disposal to evade automatic detection. The number of security alerts processed by SOCs
every day is growing exponentially. With the amount of malware samples generated every day, effective alertprioritization, triage, and validation becomes nearly unfeasible.
To help security researchers stay informed about existing and emerging threats, Kaspersky provides a single
resilient framework to automate routine analysis of suspicious files. In addition to traditional threat analysis
technologies like sandboxing, Kaspersky Threat Analysis arms you with state-of-the-art attribution and related
similarity technologies — a hybrid approach that delivers efficient threat analysis, so you can make fully informed
decisions and keep your infrastructure secure. Kaspersky Threat Analysis is provided via both a united web and
RESTful interfaces.

Kaspersky Threat Analysis components

Suspicious
file

•
•
•
•

Dynamic/static analysis
YARA, IDS rules scanning
TTPs details
AV classification••

Kaspersky Expertise (APT & Crimeware)
Attribution Engine••

Kaspersky Threat Database
Similarity Engine

Manually
or by REST API

Security
ExpertMonitoring
AlertsCommands

AnalysisreportREST API

Security Platforms
XDR / SOAR / SIEM

Kaspersky Research Sandbox
Kaspersky Research Sandbox has been developed directly out of our in-lab sandboxing complex, a technology
that’s been evolving for over two decades. It incorporates all the knowledge about malware behaviors we haveacquired throughout our continuous threat research, allowing us to detect 420 000+ new malicious objects
every day.
Kaspersky Research Sandbox enables to investigate the origins of file samples, collect IOCs based on
behavioral analysis, and detect malicious objects not previously seen. It offers a hybrid approach, combining
behavioral analysis and rock- solid anti-evasion techniques, with human-simulating technologies, such as auto
clicker, document scrolling, and dummy processes.
Deployed on-premise, the technology prevents exposure of data outside the organization. Kaspersky Research
Sandbox on-premise also allows to create custom execution environments for analysis tailoring them to realenvironments, which increases the accuracy of threat detection and the speed of investigation.

How it works
Kaspersky Security Network
Kaspersky Private Security Network

File

Advanced detection of APTs,
targeted and complex threats

File / URL reputation

Advanced analysis of files
in various formats

A workflow that enables highly
effective and complex incident
investigation

Default and advanced
settings for optimized
performance
ReportVisualization and intuitive
reporting

Scalability with no need to buy
expensive appliances

Advanced anti-evasionand human simulation
techniques
Seamless integration andautomation of your security
operations

Product highlights• Patented technology• Automated object analysis in Windows, Linux andAndroid environments• Support analysis of 200+ file types with detailed
analysis reports• 1000+ unique hunts for extracting TTPs by MITRE
ATT&CK• Advanced anti-evasion techniques and humansimulating technologies• The threat score based on metrics and dataobtained during file execution shows the danger
level of analyzed object• Preconfigured Suricata rules to inspect the
network traffic generated during file execution• Manual sample upload and an enhanced REST API
for integration with automated workflows

Kaspersky Threat Attribution Engine
Kaspersky Threat Attribution Engine is a unique threat analysis tool providing insights into the origin of highprofile malware and its possible authors. It quickly connects a suspicious file to known APT threats, actors,
campaigns, using a unique algorithm and a special database comprising APT malware samples and the industry’s
largest collection of clean files gathered by Kaspersky experts over the last 25 years and more.
We track 1100+ threat actors and campaigns and release 200+ threat intelligence reports a year. Our ongoing
research supports an APT collection which contains more than 100 000 files that, in conjunction with the use of
automated tools, results in outstandingly accurate level of attribution.
The product offers a unique approach to comparing similar samples while ensuring near-zero false positive
rates. Any new attack can quickly be linked to known APT malware, previous targeted attacks and hacker
groups, helping you to distinguish high-risk threats from less serious incidents, so you can take timely protective
measures to prevent an attacker from gaining a foothold in your system. Kaspersky Threat Attribution Engine
can be deployed in secure, air-gapped environments, restricting any 3rd party from accessing the processed
information and submitted objects. On-premise deployment provides additional functionality to add own actors
and samples to detect samples that are similar to files in your private collection as well as export YARA rules forfurther automated search for similar files in your infrastructure an integration with third-party solutions.

How it works

File

New APT and clean files
genotypes (updates)

DeathStalker
DNA Extractor

DNA Matcher

Proprietary searching method
To link malware to attribution entities, Kaspersky Threat Attribution Engine uses a unique proprietary methodof searching for similar genotypes and strings between files. This method involves:

1
Analyzing the genetics ofa sample by extracting thefollowing elements from its
code:• Genotypes — distinctive
pieces of binary code.
• Strings — distinctive strings ofcharacters.

2

3

Automatically searching theanalyzed files for genotypes
and strings which are similar to
genotypes and strings of APT
samples previously analyzed,
or already linked to attribution
entities.

Based on similar genotypes andstrings found in APT samples,
providing a report on the originof the analyzed sample, related
attribution entities, and any
similarities between this sample
and known APT samples.

Product highlights• Patented technology• Instant access to a repository of curated data
about thousands of APT actors, samples andcampaigns• Manual sample upload and an enhanced REST API
for integration with automated workflows• Functionality for unpacking password protectedarchives with custom passwords• Export to STIX 2.1 format (TXT and JSON are
also supported) for further automated analysisof security logs or integration with third- party
solutions• Supports deployment on cloud infrastructures
such as Amazon Web Services (AWS) enabling
quick product setup and saving costs as no needto invest in hardware upfrontKaspersky Similarity
Kaspersky Similarity is a handy tool for identifying files with similar functionality based on the technology
developed by Kaspersky experts to protect against unknown and hidden threats. The technology uses morethan 50 unique types of special hashes and a database of malware samples accumulated by Kaspersky over 25
years and containing millions of malicious files to ensure the highest accuracy and reliability of results.
Kaspersky Similarity enables to find similar (e.g. evasive) malware samples and look for them in the infrastructure
to make you confident that even a slight change of the sample, made by the adversary, is still on your security
radar.

How it works

Threat Analysis

Match Engine

File

Matches
found?

Report withlist of similar
files

Fuzzy hashes
extractor

Kaspersky fuzzy
hashes collection

Similarity reports
Kaspersky experts have created a set of hashes to determine the similarity between different files based onthese attributes.
Kaspersky Similarity allows users to submit a suspicious file, extract its hashes and compare them with hashesof files existing in Kaspersky threat database. In case the matches are found it generates the list of hashes for
TOP similar malicious files, already known to Kaspersky and sorted by similarity score. The report contains the
additional context with metadata for each similar file:• Similarity confidence• Quantity of hits (detections)• File status (malware, adware or other)• File hash

• Threat name• File type• Timestamps of first and last detection• File size

Product highlights• Patented technology• Leverages one of the largest in the industry
database of malicious and clean files, collected bylatest 25+ years, enabling maximum coverage forhighest comparison accuracy• Manual sample upload and an enhanced REST API
for integration with automated workflows• The technology has long been used by Kaspersky
experts for exploring new threats to deliver evenhigher threat protection in our products which isregularly confirmed by regular top rates according
to independent tests:
Learn more

Kaspersky Threat Analysis benefits
1
Boost your incident response
and forensic activities with
Kaspersky Research Sandbox,
providing you with the cuttingedge dynamic analysis of
suspicious files with ability tofind 0-day threats and results
mapped to MITTRE ATT&ACK
TTPs.

2
Correct and timely attribution
with Kaspersky Threat
Attribution Engine helps todefine threat actor with thefull list of TTPs providing
comprehensive view of attack
vector with clear mitigation
steps enabling to shorten
incident response times frommonths to minutes.

3
Reveal evasive threats with
Kaspersky Similarity enabling
to find malicious samples, thathave been specially created to
bypass traditional anti-malware
technologies, thus to detect
the most sophisticated APTattacks which can last for years
untracked.

Kaspersky Threat Intelligence ReportingCounteracting modern cyberthreats requires a 360-degree view of the tactics, techniques and procedures
used by threat actors. While the C&Cs and tools used in attacks change frequently, it’s difficult for attackers tochange their behavior and methods during attack execution. Identifying and exposing these patterns promptly
helps deploy effective defensive mechanisms in advance, disarming cybercriminals and disrupting the kill chain.
Subscribing to Kaspersky Threat Intelligence Reporting provides ongoing exclusive access to our research,
providing up-to-date information on the most dangerous threats, enabling you and your security team toproactively apply an effective strategy for attack detection in a timely manner, as well as minimizing the damage
from similar threats.
While only a small percentage of our investigations are made public, Kaspersky Intelligence Reporting gives you
privileged access to the most up-to-date information on the latest threats. Our experts continuously monitor
the activities of cybercriminals, identifying the most sophisticated and dangerous targeted attacks, cyberespionage campaigns, malware and encryption samples, and the latest cybercrime trends around the world.

200+

300+

500+

2500+

170 000+

privatereportsa yearthreat actors

campaigns

YARA rules

IoCs

Analytical reports include:
Threat actor profiles
Mapping to MITRE ATT&CKExecutive summary (C-leveloriented information)

Deep technical analysis
including:• Attack methods• Exploits used
• Malware description• C&C infrastructure and protocols
description• Victim analysis• Data exfiltration analysis• Attributions

Indicators of Compromise(IOCs) and YARA / SIGMA /Suricata rules
Recommendations from
Kaspersky experts

We offer several different commercial reporting tracks based on yourneeds and the specifics of your organization:

Provides insights into
sophisticated, long-termtargeted cyber threats that
often originate from wellorganized and well-fundedgroups. It includes information
on various APT groups
worldwide and their tactics,
techniques, and procedures(TTPs), as well as the sectors
and regions they target. This
reporting track focuses on
espionage activities, spanningfrom supply-chain attacks
to hacktivist and destructive
activities. These reports are ideal
if your organization is a large
corporation, government agency
or an organization involved in
critical infrastructure, and arealso particularly relevant toorganizations holding sensitive
data that may be a subject ofinterest to government entities.

Focuses on attacks andcampaigns with financial
gain as their primary goal. It
includes information on thelatest trends in cybercrime,
including stolen data sold on
the darkweb, financial fraud,
ransomware, and ATM/PoS
malware. They provide details on
new crimeware varieties, theirdistribution methods and thetypes of data they target. This
reporting track is particularly
relevant if your organization
conducts a substantial amountof business online, or you holdsensitive customer data perhaps as a financial institution
or ecommerce platform.

Provides in-depth intelligenceand greater awareness ofmalicious campaigns targeting
industrial organizations, as wellas information on vulnerabilities
found in the most popular
industrial control systems andunderlying technologies. This
reporting track is deliveredby Kaspersky ICS CERT – a
dedicated team of 30+ highly
qualified experts in ICS threat
and vulnerability research,
incident response and security
analysis, established in2016. These reports provide
actionable insights and guidance
to safeguard your criticalassets - including software andhardware component - andensure the safety and continuityof your technological processes.

You may wish to consider the following related Kaspersky ICS ThreatIntelligence services:
ICS Threat Intelligence
Reporting

ICS Threat Data Feeds

Ask the Analyst

Subscription to our regular publications
on industrial cybersecurity threats andvulnerabilities:• Alerts about 0-day threats

Machine-readable data streams aboutindustrial cybersecurity threats andvulnerabilities.

Consultation with Kaspersky ICS CERT
experts, providing you with individual
advice on the industrial cybersecurity
threats and vulnerabilities, threat
statistics and landscape, industry
standards, etc most relevant to you.

• Detailed technical reports• Monthly reviews• Recommendations on vulnerability
mitigations• Statistics and trends

Simple data distribution formats (JSON,
CSV, OpenIoC, STIX) via HTTPS, TAXII
and specialized delivery methods for
integration into information security
solutions.

Kaspersky Threat Intelligence Reporting gives you:Privileged access

Access to technical data

Threat actor profiles

For various reasons, not all high-profile
threats are made known to the generalpublic. However, we provide this kind of
exclusive information to our customers
during the investigation process, even
before the official public announcement.

Including an extended list of IOCs,
available in standard formats including
openIOC or STIX, as well as access to our
YARA / Sigma / Suricata rules.

Including suspected country of origin
and main activity, malware families used,industries and geographies targeted,and descriptions of all TTPs used, withmapping to MITRE ATT&CK.

MITRE ATT&CK

Retrospective analysis

RESTful API support

All TTPs described in the reports are
mapped to MITRE ATT&CK, enabling
improved detection and response
through developing and prioritizing thecorresponding security monitoring use
cases, performing gap analyses andtesting current defenses against relevant
TTPs.

Access to all previously issued private
reports is available throughout yoursubscription.

Seamless integration and automation ofyour security workflows.

Kaspersky Digital Footprint Intelligence
As your business grows, the complexity and distribution of your IT environments grow too, presenting
a challenge: protecting your widely distributed digital presence without direct control or ownership. Dynamic
and interconnected environments enable companies to derive significant benefits. However, ever-increasing
interconnectivity is also expanding the attack surface. As attackers become more skilled, it’s vital not only
to have an accurate picture of your organization’s online presence, but also to be able to track its changes
and react to external threats aimed at exposed digital assets.
Organizations use a wide range of security tools in their security operations but there are still digital threatsthat loom which require very specific capabilities - to detect and mitigate data leakages, monitor plans
and attack schemes of cybercriminals located on dark web forums, etc. To help your security analysts explore
the adversaries’ view of your company resources, promptly discover the potential attack vectors available
to them and adjust your defenses accordingly, Kaspersky has created Kaspersky Digital Footprint Intelligence.

Kaspersky Digital Footprint Intelligence provides

Threats Detection

Network reconnaissance

Monitoring of fraudulent activities that can damage acompany’s reputation and/or deceive customers.

Identification of the customer’s network resources and exposedservices which are a potential entry point for an attack.
Tailored analysis of existing vulnerabilities, with further scoring
and comprehensive risk evaluation based on the CVSS basescore, availability of public exploits, penetration testing
experience and location of the network resource(hosting/infrastructure).

Dark Web monitoring
Continuous monitoring of dark web resources (forums, ransomware blogs, messengers, tor sites, etc.), detecting any references andthreats relating to your company, clients and partners. Analysis of active targeted attacks or attacks that are being planned, APT
campaigns aimed at your company, industry and regions of operation.

Discovery of data leaks

Multitenancy support

Detection of compromised employees, partner and client
credentials, bank cards, phone numbers and other sensitive
information that can be used to carry out an attack or pose
reputational risks for your company.

Enhanced capabilities for managed security service providers(MSSPs) and large organizations with a multi-branch structure.

Intelligence sources
It’s essential that you have a comprehensive understanding of your business's external security posture.
To provide this information, Kaspersky security analysts collect and aggregate information from the following
intelligence sources:

Your unstructured data
• IP addresses• Company domains• Brand names• Keywords• Network ranges• BIN/IIN card numbers• Employee information

Network perimeter inventory
Surface, deep
and dark web search
Kaspersky
Knowledge Base search

Threat alerts
Real-time search acrossKaspersky's, surface
and dark web sources
Analytical reports*

How it works

ConfigureCollect

FilterNotification

Information discovery
about the company’s
digital assets

Automated datacollection from surface,deep and dark webs,
and the Kaspersky
knowledgebase

Threat detection,
analysis andprioritization managed
by analysts

Providing promtly threat
notifications on Kaspersky
Threat Intelligence Portal
or via API* Add-on service

Digital Footprint Intelligence business values
Kaspersky Digital Footprint Intelligence delivers powerful benefits and significant value to your organization:

Threats detection

Reduce cyber risks

React faster

Detect potential threats in real-time toprotect your brand reputation, preserve
customer trust, reduce the risk offinancial loss and damage to business
operations.

Equip your key stake holders (CxO
and Board) with information on where
to focus cybersecurity spending by
revealing gaps in the current setup andthe risks they bring.

Additional context for security alerts
improves incident response andreduces your Mean Time To Respond(MTTR)

Reduce the attack
surface

Understand youradversaries

Know the unknown

Manage your company’s digitalpresence and control external network
resources to minimize attack vectors
and vulnerabilities that can be used for
an attack.

Forewarned is forearmed - knowwhat cybercriminals are planning anddiscussing about your company on thedark web so that you’re prepared for it.

Improve your ability to withstandcyberattacks and identify threatsoutside the jurisdiction of your internal
security teams.

Service delivery efficiency
Rapid start and easy scaling in multitenancy mode saves time both for managed security service providers (MSSP) and their customers,
as well as large multi-affiliate organizations.

Kaspersky Takedown Service
Cybercriminals create malicious and phishing domains which are used to attack your company and your brands.
The inability to quickly mitigate these threats, once identified, can lead to a loss of revenue, brand damage, lossof customer trust, data leaks, and more. But managing takedowns of these domains is a complex process that
requires expertise and time.
Kaspersky Takedown Service quickly mitigates threats posed by malicious and phishing domains before any
damage can be caused to your brand and business. End-to-end management of the entire process saves
customers valuable time and resources. The service is delivered globally.
Kaspersky blocks more than 15 000 phishing/scam URLs and prevents over a million attempts clicking such
URLs every single day. Our many years of experience in analyzing malicious and phishing domains means weknow how to collect all the necessary evidence to prove that they are malicious. We'll take care of your takedown
management and enable swift action to minimize your digital risk so your team can focus on other priority tasks.
Kaspersky provides its customers with effective protection of their online services and reputation by working
with international organizations, national and regional law enforcement agencies (e.g. INTERPOL, Europol,
Microsoft Digital Crimes Unit, The National High‑Tech Crime Unit (NHTCU) of the Netherlands’ Police Agency
and The City of London Police), as well as Computer Emergency Response Teams (CERTs) worldwide.

Complete visibility

End-to-end management

Global coverage

You will be notified at each stage of theprocess, from registration of yourrequest to a successful takedown

We will manage the entire takedown
process and minimize your involvement

It doesn’t matter where a maliciousor phishing domain is registered,Kaspersky will request its takedown
from the regional organization withthe relevant legal authority

How it works
You can submit your requests via Kaspersky Company Account, our corporate customer support portal. We
will prepare all the necessary documentation and will send the request for takedown to the relevant local/
regional authority (CERT, registrar, etc.) that has the necessary legal rights to shut down the domain. You will
receive notifications at every step of the way until the requested resource is successfully taken down.

Effortless protection
The Kaspersky Takedown Service quickly mitigates threats posed by malicious and phishing domains before any
damage can be caused to your brand and business. End-to-end management of the entire process saves you
valuable time and resources.

Kaspersky Ask the Analyst
Cybercriminals are constantly developing sophisticated ways of attacking businesses. Today’s volatile and fastgrowing threat landscape features increasingly agile cybercrime techniques. Organizations face complex
incidents caused by non-malware attacks, fileless attacks, living-off-the-land attacks, zero-day exploits —and combinations of all of these built into complex threats, APT-like and targeted attacks.
In an age of business-crippling cyberattacks, cybersecurity professionals are more important than ever,
but finding and retaining them isn’t easy. And even if you have a well-established cybersecurity team, yourexperts can’t always be expected to fight the war against sophisticated threats alone — they need to be able
to call on expert third-party assistance. External expertise can shed light on the likely paths of complex attacks
and APTs, and deliver actionable advice on the most decisive way to eliminate them.
Continuous threat research enables Kaspersky to discover, infiltrate and monitor closed communities anddark forums worldwide frequented by adversaries and cybercriminals. Our analysts leverage this accessto proactively detect and investigate the most damaging and notorious threats, as well as threats tailoredto target specific organizations.
Kaspersky Ask the Analyst extends our Threat Intelligence portfolio, enabling you to request guidance
and insights into specific threats you’re facing or interested in. The service tailors Kaspersky’s powerful threat
intelligence and research capabilities to your specific needs, enabling you to build resilient defenses against
threats targeting your organization.

Kaspersky Ask the Analyst Deliverables (Unified request-based
subscription)

APT and Crimeware

Descriptions of threats, vulnerabilities and related IoCs

Additional information on publishedreports and ongoing research (on topof APT or Crimeware Intelligence
Reporting service)• General description of a specific malware family• Additional context for threats (related hashes, URLs, CnCs, etc.)• Information on a specific vulnerability (how critical it is, and the corresponding
protection mechanisms in Kaspersky products)

ICS-related requests

Dark Web intelligence

Malware analysis• Additional information on publishedreports• ICS Vulnerability information• ICS threat statistics and trends
for region / industry• ICS Malware Analysis Information
on regulations or standards• Dark Web research on particularartefacts, IP addresses, domainnames, file names, e-mails, links
or images• Information search and analysis• Malware sample analysis• Recommendations on further
remediation actions

How it works
Kaspersky Ask the Analyst can be purchased separately or in addition to any of our threat intelligence services.
You can submit your requests via Kaspersky Company Account, our corporate customer support portal. We
will respond by email, but if necessary and agreed on by you, we can organize a conference call
and/or screen-sharing session. Once your request has been accepted, you’ll be informed of the estimatedtimeframe for processing it.

Use cases
1
Clarify any details in previously
published threat intelligence reports

4
Receive additional details
on the specific Dark Web activities
you’re interested in

7
Request assistance in identifying
if detected unusual activity relates
to an APT or crimeware actor

2
Get additional intelligence for alreadyprovided IoCs

5
Get an overview malware family reportthat includes the malware's behavior, its
potential impact and details about any
related activity Kaspersky has observed

3
Obtain details on vulnerabilities
and recommendations on how
to protect against their exploitation

6
Effectively prioritize alerts/incidents
with detailed contextual informationand categorization for related IoCs
provided via short reports

8
Submit malware files for comprehensive
analysis to understand the behavior
and functionality of the provided
sample(s)Kaspersky Ask the Analyst benefits

Expand your expertise

Accelerate investigations

Respond fast

Get on-demand access to industry
experts without having to search
for and invest in hiring hard to find fulltime specialists

Effectively scope and prioritize
incidents based on tailored and detailed
contextual information

Respond to threats and vulnerabilities
fast using our guidance to block attacks
via known vectors

Extend your knowledge and resources
Kaspersky Ask the Analyst gives you access to a core group of Kaspersky researchers on a case-bycase basis. The service delivers comprehensive communication between experts to expand your existing
capabilities with our unique knowledge and resources.

Conclusion
Counteracting today’s cyberthreats requires a 360-degree view of the tactics and tools used by threat
actors. Generating this intelligence and identifying the most effective countermeasures requires constantdedication and high levels of expertise. With petabytes of rich threat data to mine, advanced machine-learningtechnologies and a unique pool of world experts, we work to support our customers with the latest threat
intelligence from around the world, helping them maintain immunity to even previously unseen cyberattacks.

Key benefits

Enables global threat visibility, timely
detection of cyberthreats, prioritizationof security alerts and an effective
response to information security
incidents

The unique insights into the tactics,
techniques and procedures used bythreat actors across different industries
and regions enable proactive protection
against targeted and complex threats

Prevents analyst burnout and helps
focus your workforce on genuine
threats

Improved and accelerated incident
response and threat hunting capabilities
help to reduce attack ‘dwell time’and significantly minimize possible
damageA comprehensive overview of yoursecurity posture with actionable
recommendations on mitigation
strategies enables you to focus yourdefensive strategy on areas identified
as prime cyberattack targets

Learn more

www.kaspersky.com© 2024 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture