Notes of cyber inspector: three clusters of threat in cyberspace

Notes of cyber inspector: three clusters of threat in cyberspace outlines how hacktivism and geopolitically motivated APT groups have become a major threat, with the report identifying three main threat clusters based on TTPs observed in 2025. It notes that hacktivists are increasingly collaborating with financially motivated groups, sharing tools and infrastructure, and that the landscape includes dual‑purpose groups as well as traditional cyber espionage actors targeting Russian organisations.

The report covers current TTPs for groups targeting Russian entities in 2025, with mentions that some clusters also affect assets in Europe, Asia and the Middle East, and that infections were traced in 2024 in Slovakia and Serbia.

It divides groups into Cluster I, Cluster II and Cluster III, and provides recommendations such as keeping SOCs armed with up‑to‑date threat intelligence feeds from providers like Kaspersky Threat Intelligence, and using platforms such as Kaspersky NEXT XDR and Kaspersky Industrial CyberSecurity to protect critical infrastructure. According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities, underscoring the ongoing relevance of geopolitically motivated threats in the region. The report invites partners and customers to contact report@kaspersky[.]com for access.