Loading story…
Kaspersky, a Russian cybersecurity firm banned from selling its products in the United States due to national security concerns, has introduced its flagship antivirus software for Linux home users. Previously, Kaspersky's security tools for Linux were only available to enterprise customers, but the new offering targets individual consumers outside the U.S. The product is available in tiered subscription plans—Standard, Plus, and Premium—with the basic plan for Linux starting at $59.99 per year, and first-year discounts available. The software supports major 64-bit Linux distributions, including Ubuntu, ALT Linux, Uncom, and RED OS, and is distributed in both DEB and RPM package formats.
Kaspersky argues that the threat landscape for Linux is evolving, citing a 20-fold increase in malicious programs targeting Linux over the past five years and referencing the recent xz utility backdoor as a significant example. The new antivirus solution offers "AI-powered" malware detection, real-time scanning of files and removable media, anti-phishing features, and online payment protection. Kaspersky aims to address the growing perception that Linux is no longer immune to malware threats, positioning its product as a proactive defense for home users in a changing security environment.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky introduced new home-user security offerings for Linux, including a basic plan priced at $59.99 per year. Multiple reports describe this as a new consumer product rollout aimed at Linux users.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kali Linux has released version 2025.4, introducing three new security tools—`bpf-linker`, `evil-winrm-py`, and `hexstrike-ai`—alongside significant updates to its desktop environments. The GNOME desktop has been upgraded to version 49, featuring refreshed themes, a new Showtime video player, reorganized tool folders, and the complete transition to Wayland as the default and only window server. KDE Plasma has been updated to version 6.5, bringing improved window tiling, a new screenshot tool, enhanced clipboard access, and fuzzy search in KRunner. The Xfce desktop now supports color themes, further enhancing user customization. Additional quality-of-life improvements include new keyboard shortcuts for quickly opening a terminal across all desktop environments. These updates aim to improve usability and performance for cybersecurity professionals and ethical hackers who rely on Kali Linux for penetration testing, red-teaming, and security assessments. The release also maintains strong support for a wide range of hardware, including Raspberry Pi devices and Android phones via Kali NetHunter. The focus remains on delivering essential enhancements and new capabilities without unnecessary additions, ensuring Kali Linux continues to serve as a robust platform for security research and operations.
Jun 29, 2026
ESET reported that the **KillDisk** malware expanded from Windows to Linux systems, targeting Linux machines with a fake ransomware scheme that demanded **$250,000** in exchange for recovery. The malware encrypted filenames and damaged data on infected hosts, displaying a ransom note that claimed victims could regain access after payment. Researchers found the Linux variant lacked any practical mechanism to restore files, indicating the operation functioned as a destructive wiper rather than true ransomware. The finding reinforced concerns that attackers were using ransomware-style extortion as cover for sabotage, leaving affected organizations with little recovery path beyond backups and system rebuilds.
Jul 12, 2026
Researchers identified a Linux-targeting variant of **RansomEXX**, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with **AES-256 in ECB mode** and appends an **RSA-4096**-encrypted AES key to each file, using cryptographic functions from the `mbedtls` library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Aug 15, 2026