'Batavia' Windows Spyware Campaign Targets Dozens of Russian Orgs

'Batavia' Windows spyware campaign targets dozens of Russian orgs

A previously undocumented spyware called 'Batavia' has been targeting large industrial enterprises in Russia in a phishing email campaign that uses contract-related lures.

Researchers Uncover Batavia Windows Spyware Stealing Documents From Russian Firms - Data Intelligence

Jul 08, 2025Ravie LakshmananCyber Espionage / Threat Intelligence Russian organizations have been targeted as part of an ongoing campaign that delivers a previously undocumented Windows spyware called Batavia. The activity, per cybersecurity vendor Kaspersky, has been active since July 2024. “The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract,” the Russian company said. “The ma…

New Batavia Spyware Targets Russian Industrial Enterprises - Cybernoz - Cybersecurity News

New Batavia spyware targets Russian industrial enterprises Pierluigi Paganini July 07, 2025 Since March 2025, fake contract emails have been spreading Batavia spyware in targeted attacks on Russian organizations. Since March 2025, a targeted phishing campaign against Russian organizations has used fake contract-themed emails to spread the Batavia spyware, a new malware designed to steal internal documents. The attack, ongoing sin…

Batavia Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads

Batavia, an unidentified spyware, has been using a sophisticated phishing operation to target Russian industrial organizations since July 2024. Kaspersky researchers have identified a sharp rise in detections since early March 2025, with over 100 users across dozens of organizations falling prey to bait emails disguised as contract agreements. These emails, often containing file names […] The post Batavia Spyware Targets Employees via Weaponized…

Batavia spyware steals data from Russian organizations

Kaspersky experts have discovered a new spyware called Batavia, which steals data from corporate devices. This article has been indexed from Securelist Read the original article: Batavia spyware steals data from Russian organizations Read more → The post Batavia spyware steals data from Russian organizations appeared first on IT Security News.

How the Batavia spyware targeting Russian organizations works

Introduction Since early March 2025, our systems have recorded an increase in detections of similar files with names like договор-2025-5.vbe, приложение.vbe, and dogovor.vbe (translation: contract, attachment) among employees at various Russian organizations. The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract. The campaign began in July 2024 and is still ongoing at the time of pub…