ESET Research


2301 articles

The SideWalk may be as dangerous as the CROSSWALK

The SideWalk may be as dangerous as the CROSSWALK

The SideWalk may be as dangerous as the CROSSWALK

Meet SparklingGoblin, a member of the Winnti family

Mathieu Tartare and Thibaut Passilly • 24 Aug 2021


IISerpent: Malware-driven SEO fraud as a service

IISerpent: Malware-driven SEO fraud as a service

IISerpent: Malware-driven SEO fraud as a service

The last in our series on IIS threats introduces a malicious IIS extension used to manipulate page rankings for third-party websites

Zuzana Hromcová • 11 Aug 2021


IISpy: A complex server-side backdoor with anti-forensic features

IISpy: A complex server-side backdoor with anti-forensic features

IISpy: A complex server-side backdoor with anti-forensic features

The second in our series on IIS threats dissects a malicious IIS extension that employs nifty tricks in an attempt to secure long-term espionage on the compromised servers

Zuzana Hromcová • 09 Aug 2021


IIStealer: A server-side threat to e-commerce transactions

IIStealer: A server-side threat to e-commerce transactions

IIStealer: A server-side threat to e-commerce transactions

The first in our series on IIS threats looks at a malicious IIS extension that intercepts server transactions to steal credit card information

Zuzana Hromcová • 06 Aug 2021


Anatomy of native IIS malware

Anatomy of native IIS malware

Anatomy of native IIS malware

ESET researchers publish a white paper putting IIS web server threats under the microscope

Zuzana Hromcová and Anton Cherepanov • 06 Aug 2021


Some URL shortener services distribute Android malware, including banking or SMS trojans

Some URL shortener services distribute Android malware, including banking or SMS trojans

Some URL shortener services distribute Android malware, including banking or SMS trojans

On iOS we have seen link shortener services pushing spam calendar files to victims’ devices.

Lukas Stefanko • 20 Jul 2021


Bandidos at large: A spying campaign in Latin America

Bandidos at large: A spying campaign in Latin America

Bandidos at large: A spying campaign in Latin America

ESET Research uncovers an active malicious campaign that uses new versions of old malware, Bandook, to spy on its victims

Matías Porolli and Fernando Tavella • 07 Jul 2021


BackdoorDiplomacy: Upgrading from Quarian to Turian

BackdoorDiplomacy: Upgrading from Quarian to Turian

BackdoorDiplomacy: Upgrading from Quarian to Turian

ESET researchers discover a new campaign that evolved from the Quarian backdoor

Adam Burgher • 10 Jun 2021


Gelsemium: When threat actors go gardening

Gelsemium: When threat actors go gardening

Gelsemium: When threat actors go gardening

ESET researchers shed light on new campaigns from the quiet Gelsemium group

Matthieu Faou and Thomas Dupuy • 09 Jun 2021