White Papers

ESET researchers have discovered a previously unreported cyberespionage platform used in targeted attacks since at least 2013. Focusing on diplomatic missions and governmental institutions, Attor is designed specifically to attack privacy-concerned targets. Its most interesting features are a complex modular architecture, elaborate network communications, and a unique plugin to fingerprint GSM devices.

Building on their earlier work on UEFI threats, ESET experts describe how they trained a machine-learning model to recognize a handful of unwanted UEFI components within a flood of millions of harmless samples. Besides showing strong capabilities in identifying suspicious UEFI executables, this system offers real-time monitoring of the UEFI landscape and was found to reduce the workload of ESET analysts by up to 90 percent.

This white paper presents ESET research into a new version of Machete, a cyberespionage toolset developed by a Spanish-speaking group that has been operating since at least 2010. ESET researchers have detected an ongoing, highly targeted campaign by the group, with a majority of its targets being government organizations in Latin America. In 2019, ESET has seen more than 50 computers compromised by Machete. More than 75% of the compromised computers were part of Venezuelan government organizations, including the military forces, education, police, and foreign affairs sectors.

In this white paper, we will take a deep technical look at this previously undocumented malware family and the other Ke3chang malware families detected from 2015 to 2019. We will provide evidence that the latter are evolved versions of known malware families attributed to Ke3chang group and explain how Okrum is linked to them – in terms of code, modus operandi and shared targets.

In this white paper, we present the analysis of LightNeuron, a backdoor specifically designed to target Microsoft Exchange mail servers. LightNeuron, which the cyberespionage group Turla is believed to have used since at least 2014, can spy on, modify or block any emails going through the compromised mail server, as well as execute commands sent by email.

In this white paper, we will provide insight into the two most prevalent types of Android banking malware to date – sophisticated banking Trojans and fake banking apps – and compare their different approaches to achieving the same malicious goal. At the same time, we will explore the impact of those approaches on potential victims. Having identified the tactics of both categories, we will provide advice for users on how to stay safe from Android banking malware.

While the idea of artificial intelligence (AI) and the real applications of machine learning (ML) have been influencing various fields for years now, their full transformative potential is yet to be realized. ML-based technologies increasingly help fight large-scale fraud, evaluate and optimize business processes, improve testing procedures and develop new solutions to existing problems. Like most innovations, however, even machine learning has drawbacks.

A little more than three years ago we started hunting for OpenSSH backdoors being used in-the-wild. While we are always trying to improve defenses against Linux malware by discovering and analyzing examples, the scope of this hunt was specifically to catch server-side OpenSSH backdoors. Unfortunately, telemetry on Linux malware is not as readily available as it is on other platforms. Nonetheless, malicious OpenSSH binaries are quite common and have features that help us detect them among legitimate OpenSSH binaries. While, as soon as we got them, we used the samples collected to improve our detection, we only began sorting and analyzing them in 2018. Surprisingly, we discovered many new backdoor families that had never been documented before.

ESET researchers have discovered and analyzed advanced malware, previously undocumented, that has been used in targeted attacks against critical infrastructure organizations in Central and Eastern Europe. The malware, named GreyEnergy by ESET researchers, exhibits many conceptual similarities with BlackEnergy, the malware used in attacks against the Ukrainian energy industry in December 2015