New Kaspersky research revealed that since early March 2025, detections of Batavia spyware have increased across Russian organizations. The malicious files, named договор-2025-5[dot]vbe, приложение[dot]vbe, and dogovor[dot]vbe (translated as ‘contract’ and ‘attachment’), were observed targeting employees at multiple entities. The victims of the campaign were primarily Russian industrial enterprises.
“The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract,” the researchers detailed in a Monday blog post. “The campaign began in July 2024 and is still ongoing at the time of publication. The main goal of the attack is to infect organizations with the previously unknown Batavia spyware, which then proceeds to steal internal documents. The malware consists of the following malicious components: a VBA script and two executable files.”
The research indicates that the theme of the emails has remained largely unchanged since the start of the campaign. Targets are prompted to download a contract file supposedly attached to the message. In reality, the attachment is a malicious link. The sender’s address typically belongs to the same domain controlled by the attackers. Each email contains a unique argument, which is then used in later stages of the infection.
When the link is clicked, an archive is downloaded to the user’s device, containing just one file: the script Договор-2025-2[dot]vbe, encrypted using Microsoft’s proprietary algorithm. The script is a downloader that retrieves a specially crafted string of 12 comma-separated parameters from the hardcoded URL. These parameters are arguments for various malicious functions. For example, the script identifies the OS version of the infected device and sends it to the attackers’ C2 server.
By accessing the address, the script downloads the file WebView[dot]exe and saves it to the temporary directory, then executes it. If the OS version cannot be retrieved or does not match the one obtained from the C2 server, the downloader uses the Navigate() method; otherwise, it uses Run().
Kaspersky detailed that the WebView[dot]exe is an executable file written in Delphi, with a size of 3,235,328 bytes. When launched, the malware downloads content and saves it to the directory after which it displays the downloaded content in its window.
Researchers noted that while the link was inactive at the time of analysis, though it likely once hosted the fake contract referenced in the malicious email.
At the same time as displaying the window, the malware begins collecting information from the infected computer and sends it to an address with a different domain, but the same infection ID. The only difference from the ID used in the VBS script is the addition of the digit 1 at the beginning of the argument, which may indicate the next stage of infection.
The Batavia spyware collects several types of files, including various system logs and office documents found on the computer and removable media. Additionally, the malicious module periodically takes screenshots, which are also sent to the C2 server. To avoid sending the same files repeatedly, the malware creates a file named h12 in the temporary directory and writes a 4-byte FNV-1a_32 hash of the first 40,000 bytes of each uploaded file. If the hash of any subsequent file matches a value in h12, that file is not sent again.
The executable file javav[dot[exe is written in C++, unlike WebView[dot]exe. The malicious capabilities of the two files are largely similar; however, javav[dot]exe includes several new functions. Like its predecessor, the third-stage module compares the hash sums of the obtained files to the contents of the h12 file. Along the way, the digit 2 has been added to the infection ID.
Additionally, two new commands appear in the malware’s code ‘set’ to change the C2 server and ‘exa/exb’ to download and execute additional files.
Kaspersky telemetry data shows that the Batavia spyware campaign maintained a low but persistent presence throughout the second half of 2024, with activity fluctuating between 2 and 11 percent. A notable surge began in February 2025, peaking sharply in March when detection rates exceeded 22 percent. This spike was followed by a decline in April, a partial rebound in May, and another drop in June.
The trend suggests a period of aggressive targeting during early 2025, possibly tied to new phishing waves or expanded targeting efforts. Over 100 individuals across several dozen organizations were affected during this period.
In conclusion, the Kaspersky researchers said that Batavia is a new spyware that emerged in July 2024, targeting organizations in Russia. “It spreads through malicious emails: by clicking a link disguised as an official document, unsuspecting users download a script that initiates a three-stage infection process on their device. As a result of the attack, Batavia exfiltrated the victim’s documents, as well as information such as a list of installed programs, drivers, and operating system components.”
Last July, Kaspersky detailed an advanced persistent threat (APT) named CloudSorcerer that targeted government organizations in the Russian Federation. Discovered in May, the cyberespionage tool is designed for stealth monitoring, data collection, and data exfiltration utilizing cloud infrastructures like Microsoft Graph, Yandex Cloud, and Dropbox. The malware employs these cloud resources as its command and control (C2) servers, accessing them via APIs with authentication tokens. Initially, CloudSorcerer made use of GitHub as its C2 server.
