Operation Potao Express: Analysis of a cyber‑espionage toolkit
Operation Patao Express – Attackers spying on high-value targets in Ukraine, Russia and Belarus, and their TrueCrypt-encrypted data.
Research
Expert content, for researchers by researchersResearch
Porn clicker keeps infecting apps on Google Play
A recently identified trojan porn clicker is still infecting apps on Google Play.
Operation Liberpy: Keyloggers and information theft in Latin America
In April, ESET’s Laboratory in Latin America received a report on an executable program named "Liberty2-0.exe." Now, it asks is there a version 1.0?
Sednit APT Group Meets Hacking Team
The infamous Sednit espionage group is currently using the Hacking Team exploits disclosed earlier this week to target eastern European institutions.
Dino – the latest spying malware from an allegedly French espionage group analyzed
In this blog we describe a sophisticated backdoor, called Dino by its creators. We believe this malicious software has been developed by the Animal Farm espionage group, who also created the infamous Casper, Bunny and Babar malware.
ESET uncovers another porn clicker on Google Play
Porn clickers pretending to be the the Dubsmash application have found their way back onto Google Play, a month after being removed.
Dissecting Linux/Moose: a Linux Router‑based Worm Hungry for Social Networks
A malware family that primarily targets Linux-based consumer routers but that can infect other Linux-based embedded systems in its path: Dissecting Linux/Moose.
Scareware: Fake Minecraft apps Scare Hundreds of Thousands on Google Play
ESET has discovered over 30 scareware apps available for download from the Google Play store. The apps have been installed by more than 600,000 Android users.
CPL Malware in Brazil: somewhere between banking trojans and malicious emails
Not only is Brazil one of the most populated countries in the world, but it is also one of the countries with the highest percentage of Internet users using online banking. The latest research from ESET is now available: CPL Malware in Brazil.
Unboxing Linux/Mumblehard: Muttering spam from your servers
Today, ESET researchers reveal a family of Linux malware that stayed under the radar for more than 5 years. We have named this family Linux/Mumblehard. A white paper about this threat is available for download on WeLiveSecuriy.
Advanced Persistent Threats: Using multi‑layered detection to defend against APTs
Advanced persistent threats (APTs) are a growing concern to the world's companies and networks. This recorded webinar looks at real-world data breaches resulting from APTs and how multi-layered proactive detection can combat this threat.
Operation Buhtrap, the trap for Russian accountants
The Operation Buhtrap campaign targets a wide range of Russian banks, used several different code signing certificates and implements evasive methods to avoid detection.
Waski downloader spreads banker Trojan targeting users worldwide
If you have recently received an unexpected email with a ZIP file attached, it could be a threat attempting to steal your banking login credentials. Its name is Waski and is detected by ESET as Win32/TrojanDownloader.Waski.
Will Windows 10 leave enterprises vulnerable to zero‑days?
One thing Microsoft has been very public about is Windows 10's new strategy of releasing patches to update the operating system at different times for consumer and enterprise versions.
CryptoFortress mimics TorrentLocker but is a different ransomware
ESET assess the differences between CryptoFortress and TorrentLocker: two very different strains of ransomware.
Fer O’Neil: Say What? Required contents of notice in data breach notifications
With so many data breaches happening these days, Americans are getting a lot of breach notification letters and emails, but do they deliver useful, readable content, other than a general warning to remain vigilant?
MSIL/Agent.PYO: Have botnet, will travel
ESET's researchers recently encountered a piece of malware targeting the filling of the forms belonging to the Consulate of Poland. To understand why it is first necessary to have a brief look at the application process for visas.
CTB‑Locker: Multilingual Malware Demands Ransom
Starting a few days ago, we began receiving multiple reports of malware-spreading campaigns in various countries mostly in Latin America and Eastern Europe.
Virlock: First Self‑Reproducing Ransomware is also a Shape Shifter
Win32/VirLock is ransomware that locks victims’ screens but also acts as parasitic virus, infecting existing files on their computers. The virus is also polymorphic, which makes it an interesting piece of malware to analyze. This is the first time such combination of malware features has been observed.
Cybercrime Trends & Predictions for 2015
As regular readers will know, every year we publish our predictions on cybercrime attacks for the year ahead. Well, our South American research team has spent the last few weeks putting together our predictions for 2015.