FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
β–³ πŸ”ƒ
There are new available articles, click to refresh the page.
☐ β˜† βœ‡ WeLiveSecurity

BladedFeline: Whispering in the dark

β€” June 5th 2025 at 09:00
ESET researchers analyzed a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group with likely ties to OilRig
☐ β˜† βœ‡ WeLiveSecurity

Danabot: Analyzing a fallen empire

β€” May 22nd 2025 at 20:03
ESET Research shares its findings on the workings of Danabot, an infostealer recently disrupted in a multinational law enforcement operation
☐ β˜† βœ‡ WeLiveSecurity

ESET takes part in global operation to disrupt Lumma Stealer

β€” May 21st 2025 at 16:15
Our intense monitoring of tens of thousands of malicious samples helped this global disruption operation
☐ β˜† βœ‡ WeLiveSecurity

ESET APT Activity Report Q4 2024–Q1 2025

β€” May 19th 2025 at 08:55
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2024 and Q1 2025
☐ β˜† βœ‡ WeLiveSecurity

Operation RoundPress

β€” May 15th 2025 at 07:22
ESET researchers uncover a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities
☐ β˜† βœ‡ WeLiveSecurity

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

β€” April 30th 2025 at 09:00
ESET researchers analyzed Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks
☐ β˜† βœ‡ WeLiveSecurity

Shifting the sands of RansomHub’s EDRKillShifter

β€” March 26th 2025 at 14:58
ESET researchers discover new ties between affiliates of RansomHub and of rival gangs Medusa, BianLian, and Play
☐ β˜† βœ‡ WeLiveSecurity

You will always remember this as the day you finally caught FamousSparrow

β€” March 26th 2025 at 14:45
ESET researchers uncover the toolset used by the FamousSparrow APT group, including two undocumented versions of the group’s signature backdoor, SparrowDoor
☐ β˜† βœ‡ WeLiveSecurity

Operation FishMedley

β€” March 20th 2025 at 10:00
ESET researchers detail a global espionage operation by FishMonger, the APT group run by I‑SOON
☐ β˜† βœ‡ WeLiveSecurity

Operation AkaiRyΕ«: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor

β€” March 18th 2025 at 10:00
ESET researchers uncovered MirrorFace activity that expanded beyond its usual focus on Japan and targeted a Central European diplomatic institute with the ANEL backdoor
☐ β˜† βœ‡ WeLiveSecurity

Threat Report H2 2024: Infostealer shakeup, new attack vector for mobile, and Nomani

β€” February 28th 2025 at 10:00
Big shifts in the infostealer scene, novel attack vector against iOS and Android, and a massive surge in investment scams on social media
β˜‘ β˜† βœ‡ WeLiveSecurity

Will Windows 10 leave enterprises vulnerable to zero-days?

β€” March 13th 2015 at 11:24
One thing Microsoft has been very public about is Windows 10's new strategy of releasing patches to update the operating system at different times for consumer and enterprise versions.
β˜‘ β˜† βœ‡ WeLiveSecurity

CryptoFortress mimics TorrentLocker but is a different ransomware

β€” March 9th 2015 at 17:25
ESET assess the differences between CryptoFortress and TorrentLocker: two very different strains of ransomware.
β˜‘ β˜† βœ‡ WeLiveSecurity

MSIL/Agent.PYO: Have botnet, will travel

β€” January 29th 2015 at 13:50
ESET's researchers recently encountered a piece of malware targeting the filling of the forms belonging to the Consulate of Poland. To understand why it is first necessary to have a brief look at the application process for visas.
β˜‘ β˜† βœ‡ WeLiveSecurity

Windows exploitation in 2014

β€” January 8th 2015 at 13:44
Today, we published our research about Windows exploitation in 2014. This report contains interesting information about vulnerabilities in Microsoft Windows and Office patched over the course of the year, drive-by download attacks and mitigation techniques.
β˜‘ β˜† βœ‡ WeLiveSecurity

Virlock: First Self-Reproducing Ransomware is also a Shape Shifter

β€” December 22nd 2014 at 13:55
Win32/VirLock is ransomware that locks victims’ screens but also acts as parasitic virus, infecting existing files on their computers. The virus is also polymorphic, which makes it an interesting piece of malware to analyze. This is the first time such combination of malware features has been observed.
β˜‘ β˜† βœ‡ WeLiveSecurity

Cybercrime Trends & Predictions for 2015

β€” December 18th 2014 at 13:19
As regular readers will know, every year we publish our predictions on cybercrime attacks for the year ahead. Well, our South American research team has spent the last few weeks putting together our predictions for 2015.
β˜‘ β˜† βœ‡ WeLiveSecurity

TorrentLocker — Ransomware in a country near you

β€” December 16th 2014 at 14:30
Today, we are publishing research on ransomware that emerged in 2014. We have posted blog articles about this threat before, to raise awareness when we realized the criminals were targeting the United Kingdom and Spain.
β˜‘ β˜† βœ‡ WeLiveSecurity

First exploitation of Internet Explorer 'Unicorn bug' in-the-wild

β€” November 20th 2014 at 11:28
Microsoft released a patch last week for a critical vulnerability allowing remote code execution in Internet Explorer. This vulnerability is significant because it exploits an old bug present in Internet Explorer versions 3 through 11.
β˜‘ β˜† βœ‡ WeLiveSecurity

G20 2014 Summit Lure used to target Tibetan activists

β€” November 14th 2014 at 15:29
APT actors trying to use big events as a lure to compromise their targets is nothing new. Tibetan NGOs being targeted by APT actors is also nothing new. Thus, surrounding the upcoming G20 2014 summit that is held in Brisbane, Australia, we were expecting to see G20 themed threats targeted at Tibetan NGOs. A Win32/Farfli (alias Gh0st RAT) sample ultimately confirmed our suspicions.
β˜‘ β˜† βœ‡ WeLiveSecurity

Korplug military targeted attacks: Afghanistan & Tajikistan

β€” November 12th 2014 at 15:17
After taking a look at recent Korplug (PlugX) detections, we identified two larger scale campaigns employing this well-known Remote Access Trojan. This blog gives an overview of the first one
β˜‘ β˜† βœ‡ WeLiveSecurity

The Evolution of Webinject

β€” October 23rd 2014 at 11:33
Last month, we presented β€œThe Evolution of Webinject” in Seattle at the 24th Virus Bulletin conference. This blog post will go over its key findings and provide links to the various material that has been released in the last few weeks.
β˜‘ β˜† βœ‡ WeLiveSecurity

CVE-2014-4114: Details on August BlackEnergy PowerPoint Campaigns

β€” October 14th 2014 at 15:29
In this post we provide additional information on how a specially crafted PowerPoint slideshow file (.PPSX) led to the execution of a BlackEnergy dropper.
β˜‘ β˜† βœ‡ WeLiveSecurity

Back in BlackEnergy *: 2014 Targeted Attacks in Ukraine and Poland

β€” September 22nd 2014 at 22:19
State organizations and private businesses from various sectors in Ukraine and Poland have been targeted with new versions of BlackEnergy, a malware that's evolved into a sophisticated threat with a modular architecture.
☐ β˜† βœ‡ WeLiveSecurity

DeceptiveDevelopment targets freelance developers

β€” February 20th 2025 at 10:00
ESET researchers analyzed a campaign delivering malware bundled with job interview challenges
☐ β˜† βœ‡ WeLiveSecurity

PlushDaemon compromises supply chain of Korean VPN service

β€” January 22nd 2025 at 06:00
ESET researchers have discovered a supply-chain attack against a VPN provider in South Korea by a new China-aligned APT group we have named PlushDaemon
☐ β˜† βœ‡ WeLiveSecurity

Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344

β€” January 16th 2025 at 10:00
The story of a signed UEFI application allowing a UEFI Secure Boot bypass
☐ β˜† βœ‡ WeLiveSecurity

ESET Research Podcast: Telekopye, again

β€” December 20th 2024 at 10:00
Take a peek into the murky world of cybercrime where groups of scammers who go by the nickname of 'Neanderthals’ wield the Telekopye toolkit to ensnare unsuspecting victims they call 'Mammoths'
☐ β˜† βœ‡ WeLiveSecurity

ESET Threat Report H2 2024

β€” December 16th 2024 at 10:00
A view of the H2 2024 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts
☐ β˜† βœ‡ WeLiveSecurity

Bootkitty: Analyzing the first UEFI bootkit for Linux

β€” November 27th 2024 at 07:00
ESET researchers analyze the first UEFI bootkit designed for Linux systems
☐ β˜† βœ‡ WeLiveSecurity

RomCom exploits Firefox and Windows zero days in the wild

β€” November 26th 2024 at 10:00
ESET Research details the analysis of a previously unknown vulnerability in Mozilla products exploited in the wild and another previously unknown Microsoft Windows vulnerability, combined in a zero-click exploit
☐ β˜† βœ‡ WeLiveSecurity

Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine

β€” November 21st 2024 at 10:00
ESET researchers analyzed previously unknown Linux backdoors that are connected to known Windows malware used by the China-aligned Gelsemium group, and to Project Wood
☐ β˜† βœ‡ WeLiveSecurity

ESET Research Podcast: Finding the mythical BlackLotus bootkit

β€” July 12th 2023 at 11:30
Here's a story of how an analysis of a supposed game cheat turned into the discovery of a powerful UEFI threat
☐ β˜† βœ‡ WeLiveSecurity

Stop Cyberbullying Day: Prevention is everyone's responsibility

β€” June 16th 2023 at 11:30
Strategies for stopping and responding to cyberbullying require a concerted, community-wide effort involving parents, educators and children themselves
☐ β˜† βœ‡ WeLiveSecurity

Android GravityRAT goes after WhatsApp backups

β€” June 15th 2023 at 11:30
ESET researchers analyzed an updated version of Android GravityRAT spyware that steals WhatsApp backup files and can receive commands to delete files
☐ β˜† βœ‡ WeLiveSecurity

7 tips for spotting a fake mobile app

β€” June 6th 2023 at 11:30
Plus, 7 ways to tell that you downloaded a sketchy app and 7 tips for staying safe from mobile security threats in the future
☐ β˜† βœ‡ WeLiveSecurity

Shedding light on AceCryptor and its operation

β€” May 25th 2023 at 11:30
ESET researchers reveal details about a prevalent cryptor, operating as a cryptor-as-a-service used by tens of malware families
☐ β˜† βœ‡ WeLiveSecurity

ESET Research Podcast: Finding the mythical BlackLotus bootkit

By: ESET Research β€” July 12th 2023 at 09:30

A story of how an analysis of a supposed game cheat turned into the discovery of a powerful UEFI threat

The post ESET Research Podcast: Finding the mythical BlackLotus bootkit appeared first on WeLiveSecurity

☐ β˜† βœ‡ WeLiveSecurity

ESET Threat Report H1 2023

By: Roman KovÑč β€” July 11th 2023 at 09:30

A view of the H1 2023 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts

The post ESET Threat Report H1 2023 appeared first on WeLiveSecurity

☐ β˜† βœ‡ WeLiveSecurity

What’s up with Emotet?

By: Jakub Kaloč β€” July 6th 2023 at 09:30

A brief summary of what happened with Emotet since its comeback in November 2021

The post What’s up with Emotet? appeared first on WeLiveSecurity

❌