Connecting the dots: Exposing the arsenal and methods of the Winnti Group
New ESET white paper released describing updates to the malware arsenal and campaigns of this group known for its supply-chain attacks
Malware
ESET discovers Attor, a spy platform with curious GSM fingerprinting
ESET researchers discover a previously unreported cyberespionage platform used in targeted attacks against diplomatic missions and governmental institutions, and privacy-concerned users
Casbaneiro: Dangerous cooking with a secret ingredient
Número dois in our series demystifying Latin American banking trojans
No summer vacations for Zebrocy
ESET researchers describe the latest components used in a recent Sednit campaign
ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group
ESET researchers discovered a backdoor linked to malware used by the Stealth Falcon group, an operator of targeted spyware attacks against journalists, activists and dissidents in the Middle East
First‑of‑its‑kind spyware sneaks into Google Play
ESET analysis breaks down the first known spyware that is built on the AhMyth open-source espionage tool and has appeared on Google Play – twice
In the Balkans, businesses are under fire from a double‑barreled weapon
ESET researchers discovered a campaign that uses two malicious tools with similar capabilities to ensure both resilience and broader potential for the attackers
From Carnaval to Cinco de Mayo – The journey of Amavaldo
The first in an occasional series demystifying Latin American banking trojans
Okrum: Ke3chang group targets diplomatic missions
Tracking the malicious activities of the elusive Ke3chang APT group, ESET researchers have discovered new versions of malware families linked to the group, and a previously unreported backdoor
Buhtrap group uses zero‑day in latest espionage campaigns
ESET research reveals notorious crime group also conducting espionage campaigns for the past five years
Malicious campaign targets South Korean users with backdoor‑laced torrents
ESET researchers have discovered a malicious campaign distributing a backdoor via torrents, with Korean TV content used as a lure
LoudMiner: Cross‑platform mining in cracked VST software
The story of a Linux miner bundled with pirated copies of VST (Virtual Studio Technology) software for Windows and macOS
Malware sidesteps Google permissions policy with new 2FA bypass technique
ESET analysis uncovers a novel technique bypassing SMS-based two-factor authentication while circumventing Google’s recent SMS permissions restrictions
Wajam: From start‑up to massively‑spread adware
How a Montreal-made "social search engine" application has managed to become widely-spread adware, while escaping consequences
A dive into Turla PowerShell usage
ESET researchers analyze new TTPs attributed to the Turla group that leverage PowerShell to run malware in-memory only
Fake cryptocurrency apps crop up on Google Play as bitcoin price rises
ESET researchers have analyzed fake cryptocurrency wallets emerging on Google Play at the time of bitcoin’s renewed growth
A journey to Zebrocy land
ESET sheds light on commands used by the favorite backdoor of the Sednit group
Plead malware distributed via MitM attacks at router level, misusing ASUS WebStorage
ESET researchers have discovered that the attackers have been distributing the Plead malware via compromised routers and man-in-the-middle attacks against the legitimate ASUS WebStorage software
Turla LightNeuron: An email too far
ESET research uncovers Microsoft Exchange malware remotely controlled via steganographic PDF and JPG email attachments
Buhtrap backdoor and Buran ransomware distributed via major advertising platform
Criminal activities against accountants on the rise – Buhtrap and RTM still active