Kaspersky APT C&C Tracking

What is included in Kaspersky APT C&C Tracking?

APT infrastructure list – IP addresses of infrastructure connected to advanced targeted attacks.
Daily updates – New findings from the Kaspersky Global Research and Analysis Team.
Attribution context – APT group, operation or malware name per address.
Network context – Internet service provider, autonomous system, first and last seen.
Machine-readable export – CSV or JSON archive for import into security tools.
Important – No agent and no management console; the service delivers data only.

What are the main benefits of Kaspersky APT C&C Tracking?

Kaspersky APT C&C Tracking is a subscription service inside the Kaspersky Threat Intelligence Portal that publishes IP addresses of infrastructure linked to advanced targeted attacks; there is no console and nothing to install, because the list is read in the browser or pulled through the portal API. Kaspersky now lists the service in its threat intelligence portfolio as Threat Infrastructure Tracking and has renamed the portal section accordingly, while the earlier APT C&C Tracking name still appears in the product help and in the API method.

Blocklist input – Addresses can feed firewall, proxy and SIEM rules.
Named attribution – Analysts see which APT group an address serves.
Country filter – Narrows the list to the regions you monitor.
No rollout – Nothing to install, no agents to maintain or update.
Incident dating – First and last seen dates support attack timelines.
API retrieval – The list can be pulled programmatically instead of manually.

Which company size is Kaspersky APT C&C Tracking suitable for?

This is analyst-facing data, not a protection product, so the deciding factor is not headcount but whether someone reads the list and acts on it. An organisation with a firewall or SIEM it can feed, and a person who reviews the matches, gets value from it. An organisation without either downloads a file it never uses.

Does Kaspersky APT C&C Tracking meet the requirements of Swiss cybersecurity legislation?

The reporting obligation under the revised Information Security Act has applied since 1 April 2025 and covers operators of critical infrastructure in Switzerland, among them energy and water suppliers, transport companies, hospitals, financial institutions and cantonal and communal authorities. Those organisations must submit an initial report to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering a qualifying cyberattack, with the remaining details due within 14 days. Kaspersky APT C&C Tracking supports the discovery step in a narrow way: when a monitored system contacts an address on the list, the match is a dated signal that a targeted attack may be under way, and the first and last seen fields give the reporting form a defensible timeline. It does not detect anything by itself, does not monitor your network, does not generate the report and keeps no logs on your behalf, so detection, triage and the reporting workflow all have to exist elsewhere. This overview is not legal advice; whether your organisation falls under the reporting obligation should be clarified with your own legal counsel.

Does Kaspersky APT C&C Tracking meet the requirements of European cybersecurity legislation?

No product makes a company compliant with the NIS 2 Directive, because the directive addresses organisational duties: risk analysis, incident handling and reporting, business continuity, supply chain security and a review of how effective the measures actually are. Kaspersky APT C&C Tracking touches two of those categories. It contributes to risk analysis by naming infrastructure associated with specific threat actors, and it contributes to incident handling as an enrichment source when an analyst has to decide whether an outbound connection matters. It does nothing for business continuity, access control, encryption, staff training or supplier assessment, and it produces no audit trail of its own that an effectiveness review could rest on. Organisations in scope should treat it as one input into an existing detection process, not as one of the required measures.

What should you know about official assessments of Kaspersky?

Germany's Federal Office for Information Security (BSI) published a warning against the use of Kaspersky antivirus software on 15 March 2022. The warning is still published and still in force; since Germany's NIS 2 implementation act took effect on 6 December 2025 it is issued under section 13 of the BSI Act rather than section 7. The United States went further: on 20 June 2024 the Bureau of Industry and Security issued a Final Determination prohibiting Kaspersky from supplying antivirus software and cybersecurity products or services to US persons, cut off updates on 29 September 2024, and added AO Kaspersky Lab, OOO Kaspersky Group and Kaspersky Labs Limited to the Entity List. That determination expressly excludes Kaspersky threat intelligence, training and consulting services that are informational in nature, which is the category this service falls into. Kaspersky rejects the BSI warning as not based on an objective technical analysis and points to its transparency centres and third-party audits. Switzerland has taken neither step: the Federal Office for Cybersecurity has issued no warning and no ban, has stated that no misuse of Kaspersky software in Switzerland has been reported to it, and has confirmed that no federal directive against the products exists. The warnings concern software with deep system privileges installed on protected machines, whereas this service installs nothing; independent laboratory tests cover Kaspersky's endpoint products and do not assess this data service either way. In practice the assessments matter most for public sector tenders, defence-adjacent supply chains and customers whose own procurement rules exclude vendors of Russian origin.

Norton vs. Kaspersky – Which antivirus program offers the best protection in 2025?
A side-by-side comparison of the two vendors, useful if the official assessments have put your Kaspersky endpoint software back on the internal agenda.

Does Kaspersky APT C&C Tracking help with security questionnaires from large customers?

Yes, but only for one line of questioning. It answers the questions about external threat intelligence sources: you can name a commercial feed, state that it is updated daily, describe the attribution context each address carries, and show that indicators are imported into your firewall, proxy or SIEM. Everything else on a standard questionnaire remains open. There is no endpoint protection, no EDR, no logging or retention evidence, no patch or vulnerability management, no encryption or key management, no multi-factor authentication, no backup, no access control model and no report format built to serve as audit evidence. Two further items need a prepared answer rather than a product: the vendor's country of origin, which large customers increasingly ask about directly, and the absence of an independent certification covering this specific service. Where the remaining gaps are in intelligence coverage rather than protection, staying inside the same portal is usually the cheaper route, since Threat Data Feeds, Threat Intelligence Reporting and Digital Footprint Intelligence are licensed as separate services on the same access.

Which limitations should you know before buying?

The service covers IP addresses only; domains, web addresses and file hashes are not part of it and have to come from another source. The web interface and the API are not equivalent: the interface can filter by date and by country and can export a CSV or JSON archive, while the API can list addresses and filter by country but cannot filter by date and cannot export a file, which constrains automated pipelines built on the API alone. Access is not self-service, because the portal requires credentials and a certificate issued through a Kaspersky Technical Account Manager. On regional availability, the US prohibition on Kaspersky cybersecurity products carves out threat intelligence services, so this one is not covered by it, but groups with US entities should still confirm their own procurement rules first. The most common follow-up purchase is a second intelligence service, since an IP list alone rarely answers the next question an analyst has after a match.

Best antivirus? Why Windows Defender alone is not enough
Explains what a protection layer on the endpoint actually has to do, which is the part this data service does not replace.

Frequently asked questions about Kaspersky APT C&C Tracking

In which formats can the IP list be exported?

The web interface offers a download in two formats, a CSV archive or a JSON archive, both delivered as .zip files. The country filter is applied before the download, so the export contains only the regions you selected.

How is access to the service granted?

Access runs through the Kaspersky Threat Intelligence Portal with credentials issued by a Kaspersky Technical Account Manager. The second authentication factor is either an imported certificate or a one-time password from a TOTP authenticator app, where your organisation permits that method.