Kaspersky identifies cyberespionage drive targeting Windows Server systems

ISLAMABAD: A cyber security company on Wednesday disclosed that a cyberespionage campaign is targeting Windows Server systems in government, financial and industrial organizations across Asia, Africa and Latin America.

Kaspersky’s Global Research and Analysis Team (GReAT) have uncovered an ongoing cyberespionage PassiveNeuron campaign has been observed since December 2024 and continued through August 2025.

After six months of inactivity, PassiveNeuron has resumed operations, using three main tools - two of which were previously unknown - to gain and maintain access to targeted networks. These tools are: Neursite, a modular backdoor; NeuralExecutor, a .NET-based implant; Cobalt Strike, a penetration testing framework often used by threat actors.

“PassiveNeuron stands out for its focus on compromising servers, which are often the backbone of organizational networks,” said Georgy Kucherin, Security Researcher at GReAT, Kaspersky.

“Servers exposed to the Internet are particularly attractive targets for advanced persistent threat (APT) groups, as a single compromised host can provide access to critical systems. It is therefore essential to minimize the attack surface related to them and continuously monitor server applications to detect and stop potential infections.”

The Neursite backdoor can collect system information, manage running processes and route network traffic through compromised hosts, enabling lateral movement within a network. Samples were found communicating with both external command-and-control servers and compromised internal systems, the report added.

Copyright Business Recorder, 2025