Security Researcher, Global Research & Analysis Team
Jornt works as a local security expert for the BeNeLux region in Kaspersky’s Global Research and Analysis Team (GReAT). During his time at the company, Jornt has managed several different high-profile projects. For instance, he helped the Dutch police with the Coinvault case, that led to the arrest of two malware authors. After this success, Jornt was a driving force behind the NoMoreRansom project. Together with various law enforcement agencies, he identified several servers that held cryptographic keys of ransomware victims. As a result, more than 35,000 people got their files back without paying the criminals and the action prevented millions of dollars going into the pockets of criminals. Jornt also speaks at national and international conferences, is a regular media commentator and alongside his malware research, offers malware reverse engineering training. Before joining Kaspersky in 2014, Jornt worked as a researcher/developer for Security Matters. Whilst he was there, he implemented and designed detection modules for Intrusion Detection Systems that operate in an Industrial Control System (ICS) environment. Prior to that, Jornt worked as a security consultant for Digidentity, where he improved existing products by creating new software and cryptographic algorithms. He has also worked as a consultant at the Rijkswaterstaat Security Operations Center (the governmental institution responsible for roads and water management), where he was actively involved in securing ICS environments.While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. We created offline backups of the devices, inspected them and discovered traces of compromise.
GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo and JackalScreenWatcher.
Kaspersky analysis of the CloudWizard APT framework used in a campaign in the region of the Russo-Ukrainian conflict.
For more than five years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. These summaries are based on our threat intelligence research; and they provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.