The biggest news in malware so far this year has been WannaCryptor a.k.a. WannaCry, and one reason that particular ransomware spread so fast was because it used a “top secret” exploit developed by the NSA, an agency known to have dabbled in UEFI compromise.
When thinking about security we generally take risk into account. It is well known that risk is a composition of likelihood and potential impact.
David Harley and Josep Albors on the evolution of tech support scams and why the current high incidence of reports in Spain are significant.
ESET's David Harley revisits the Stuxnet phenomenon: How has the way we see the malware and its impact changed?
ESET conference papers from the 2014 Virus Bulletin and AVAR conferences are now available.
ESET research on Operation Windigo received an award at Virus Bulletin 2014. Our research on bootkits was also well received, and is now available publicly.
State organizations and private businesses from various sectors in Ukraine and Poland have been targeted with new versions of BlackEnergy, a malware that's evolved into a sophisticated threat with a modular architecture.
Updated information on ESET presentations at Virus Bulletin 2014.
Autumn: the season of mists and mellow fruitfulness, not to mention a couple of excellent security conferences. Virus Bulletin and AVAR make a very tasty Conference Pair.
In this blog post we confirm that the Avatar rootkit continues to thrive in the wild, and disclose some new information about its kernel-mode self-defense tricks. We continue our research into this malware family.
Introducing a detailed analysis of Win32/Gapz malware in a new white paper titled: Mind the Gapz: The most complex bootkit ever analyzed?
Win32/Gapz's new bootkit technique modifies just 4 bytes of the original VBR, has an enhanced dropper and complex kernel mode functionality, and evades ELAM.
Win32/Gapz has a new technique for code injection and a new VBR infection method. The dropper has many tricks for bypassing detection by security software.
Protecting your organization against cyber criminals and digital scammers is not easy, and it's certainly not cheap. A vital part of building and maintaining effective defenses is access to security knowledge and expertise, which may not even be a budget item if your organization happens to be an SMB, local government agency, or non-profit. One
The slides for many of the presentations by ESET researchers at VB 2012 can now be found on the Virus Bulletin conference web pages.
Alexandr Matrosov summarizes the evolution of complex threats using hidden storage, as discussed in his presentation with Eugene Rodionov at Virus Bulletin 2012.
Aleksandr Matrosov looks at the internal architecture of Win32/Flamer's mssecmgr.ocx module.
Detailed analysis of Rovnix.D reveal updates to the code injection technique employed, allowing multiple injections with a variety of payloads.
Analysis of the Flame worm (Win32/Flamer) reveals some interesting facts about the internal structure of its main module.
Aleksandr Matrosov and Eugene Rodionov presented their research into “Smartcard vulnerabilities in modern banking malware†at PHDays'2012.
