Skip to content

ESET Research: Ebury botnet alive & growing; 400k Linux servers compromised for cryptocurrency theft and financial gain

  • ESET Research has released its deep-dive investigation into one of the most advanced server-side malware campaigns, which is still growing – Ebury group with their malware and botnet.
  • Over the years, Ebury has been deployed as a backdoor to compromise almost 400,000 Linux, FreeBSD, and OpenBSD servers; more than 100,000 were still compromised as of late 2023.
  • Ebury actors have been pursuing monetization activities subsequent to our 2014 publication on Operation Windigo, including the spread of spam, web traffic redirections, and credential stealing.
  • Additionally, ESET has confirmed that operators are also involved in cryptocurrency heists.
  • In many cases, Ebury operators were able to gain full access to large servers of ISPs and well-known hosting providers.

BRATISLAVA, MONTREAL — May 14, 2024 — ESET Research released today its deep-dive investigation into one of the most advanced server-side malware campaigns, which is still growing and has seen hundreds of thousands of compromised servers in its at least 15-year-long operation. Among the activities of the infamous Ebury group and botnet over the years has been the spread of spam, web traffic redirections, and credential stealing.  In recent years it has diversified to credit card and cryptocurrency theft. Additionally, Ebury has been deployed as a backdoor to compromise almost 400,000 Linux, FreeBSD, and OpenBSD servers; more than 100,000 were still compromised as of late 2023. In many cases, Ebury operators were able to gain full access to large servers of ISPs and well-known hosting providers.

Ten years ago, ESET published a white paper about Operation Windigo, which uses multiple malware families working in combination, with the Ebury malware family at its core. In late 2021, the Dutch National High Tech Crime Unit (NHTCU), part of the Netherlands national police, reached out to ESET regarding servers in the Netherlands suspected of being compromised with Ebury malware. Those suspicions turned out to be well-founded and with NHTCU’s assistance, ESET Research has gained considerable visibility into operations run by the Ebury threat actors.

“Following the release of the Windigo paper in early 2014, one of the perpetrators was arrested at the Finland-Russia border in 2015, and later extradited to the United States. While initially claiming innocence, he eventually pleaded guilty to the charges in 2017, a few weeks before his trial at the U.S. District Court in Minneapolis was set to proceed, and where ESET researchers were scheduled to testify,” says Marc-Etienne M. Léveillé, the ESET researcher who investigated Ebury for more than a decade.

Ebury, active since at least 2009, is an OpenSSH backdoor and credential stealer. It is used to deploy additional malware to: monetize the botnet (such as modules for web traffic redirection), proxy traffic for spam, perform adversary-in-the-middle attacks (AitM), and host supporting malicious infrastructure. In AitM attacks, ESET has observed over 200 targets across more than 75 networks in 34 different countries between February 2022 and May 2023.  

Its operators have used the Ebury botnet to steal cryptocurrency wallets, credentials, and credit card details. ESET has uncovered new malware families authored and deployed by the gang for financial gain, including Apache modules and a kernel module to perform web traffic redirection. Ebury operators also used zero-day vulnerabilities in administrator software to compromise servers in bulk.

After a system is compromised, a number of details are exfiltrated. Using the known passwords and keys obtained on that system, credentials are reused to try logging into related systems. Each new major version of Ebury introduces some important change and new features and obfuscation techniques.

“We have documented cases where the infrastructure of hosting providers was compromised by Ebury. In these cases, we have seen Ebury being deployed on servers rented out by those providers, with no warning to the lessees. This resulted in cases where the Ebury actors were able to compromise thousands of servers at once,” says Léveillé. There is no geographical boundary to Ebury; there are servers compromised with Ebury in almost all countries in the world. Whenever a hosting provider was compromised, it led to a vast number of compromised servers in the same data centers.

At the same time, no verticals appear more targeted than others. Victims include universities, small and large enterprises, internet service providers, cryptocurrency traders, Tor exit nodes, shared hosting providers, and dedicated server providers, to name a few.

In late 2019, the infrastructure of a large and popular US-based domain registrar and web hosting provider was compromised. In total, approximately 2,500 physical and 60,000 virtual servers were compromised by the attackers. A very large portion, if not all, of these servers are shared between multiple users to host the websites of more than 1.5 million accounts. In another incident, a total of 70,000 servers from that hosting provider were compromised by Ebury in 2023. Kernel.org, hosting the source code of the Linux kernel, had been a victim of Ebury too.

“Ebury poses a serious threat and a challenge to the Linux security community. There is no simple fix that would make Ebury ineffective, but a handful of mitigations can be applied to minimize its spread and impact. One thing to realize is that it doesn’t only happen to organizations or individuals that care less about security. A lot of very tech-savvy individuals and large organizations are among the list of victims,” concludes Léveillé.

For more technical information and a set of tools and indicators to help system administrators determine whether their systems are compromised by Ebury, read the full white paper “Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain”. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Ebury deployments per month using two different scales on the Y axis, according to the database of compromised servers maintained by the perpetrators.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Why Microsoft’s entry into the backup space is good news

Microsoft’s recent jump into the backup space with Microsoft 365 Backup signals a significant shift. Paul Robichaux, a seasoned Microsoft MVP and Senior Director of Product Management, shares what Microsoft’s entry to the market means for customers and the broader SaaS data protection community in a contributed article for Storage Magazine.

Read the full article or continue reading for the abbreviated version. 

  

A bit of a surprise — yet welcomed — entry 

For years, Microsoft has been synonymous with data integrity measures (think back to trusty-old Windows Backup), yet their prior reluctance to offer dedicated backup solutions for Microsoft 365 left a data protection gap. 

“They have been pretty steadfast in ignoring Microsoft 365 as a backup opportunity, broadcasting the message that the native data protection features in the service provide adequate coverage.” However, with the unveiling of Microsoft 365 Backup, a public preview poised for general availability, the narrative is set to change. 

 

You are responsible for your Microsoft SaaS data 

Robichaux underscores a critical message: While Microsoft ensures redundancy, the onus remains on users to safeguard their data. Put simply, Microsoft 365 Backup emphasizes that you need backup. This fundamental shift in perception is crucial, especially considering the prevalent misconception that cloud-hosted data is impervious to loss.

The introduction of Microsoft 365 Backup not only validates the necessity of third-party data protection but also ignites conversations around shared responsibility models. Questions like “What components of Microsoft 365 warrant backup?” and “What defines a robust backup strategy?” are being asked.

While Microsoft’s solution is a step in the right direction, it’s essential to recognize its limitations, notably in coverage and granularity. Moreover, the collaboration between Microsoft and third-party ISVs in leveraging Microsoft 365 Backup Storage opens avenues for innovation and growth. 

  

Ultimately, Microsoft’s venture into the backup arena revitalizes discussions on data protection, fostering a more nuanced understanding of shared responsibilities. With Microsoft’s influence, Robichaux envisions a future where comprehensive SaaS data protection becomes the norm, ensuring resilience in an ever-evolving digital landscape. 

Read the full article

Microsoft 365 BackupMicrosoft 365Shared responsibilityEntra ID

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

ESET Research: Russia-aligned Turla group likely uses Lunar arsenal to target & spy on European diplomats

  • ESET Research discovered two previously unknown backdoors — which we named LunarWeb and LunarMail — compromising a European ministry of foreign affairs and its diplomatic missions abroad, primarily in the Middle East.
  • ESET researchers attribute these compromises with medium confidence to the infamous Russia-aligned cyberespionage group Turla. The aim of the campaign is cyberespionage.
  • Turla, also known as Snake, has been active since at least 2004, possibly even dating back to the late 1990s. It is believed to be part of the Russian FSB.
  • ESET believes that the Lunar toolset has been in use since at least 2020.
  • Both backdoors employ steganography, a technique in which commands are hidden in images to avoid detection.

BRATISLAVA — May 15, 2024 — ESET Research discovered two previously unknown backdoors — which we named LunarWeb and LunarMail — compromising a European ministry of foreign affairs and its diplomatic missions abroad, primarily in the Middle East. ESET believes that the Lunar toolset has been used since at least 2020 and, given the similarities between the tactics, techniques, and procedures and past activities, ESET researchers attribute these compromises with medium confidence to the infamous Russia-aligned cyberespionage group Turla. The aim of the campaign is cyberespionage.

The ESET investigation began with the detection of a loader deployed on an unidentified server, which decrypts and loads a payload from a file. This led ESET researchers to the discovery of a previously unknown backdoor, which ESET named LunarWeb. Subsequently, a similar chain with LunarWeb deployed at a diplomatic mission was detected. Notably, the attacker also included a second backdoor — which ESET named LunarMail — that uses a different method for command and control (C&C) communications. During another attack, ESET observed simultaneous deployments of a chain with LunarWeb at three diplomatic missions of a European country in the Middle East, occurring within minutes of each other. The attacker probably had prior access to the domain controller of the ministry of foreign affairs and utilized it for lateral movement to machines of related institutions in the same network.

LunarWeb, deployed on servers, uses HTTP(S) for its C&C communications and mimics legitimate requests, while LunarMail, deployed on workstations, persists as an Outlook add-in and uses email messages for its C&C communications. Both backdoors employ steganography, a technique in which commands are hidden in images to avoid detection. Their loaders can exist in various forms, including trojanized open-source software, demonstrating the advanced techniques used by the attackers.

“We observed varying degrees of sophistication in the compromises — for example, the careful installation on the compromised server to avoid scanning by security software contrasted with coding errors and different coding styles of the backdoors. This suggests multiple individuals were probably involved in the development and operation of these tools,” says ESET researcher Filip Jurčacko, who discovered the Lunar toolset.

Recovered installation-related components and attacker activity suggest that possible initial compromise happened via spearphishing and abuse of misconfigured network and application monitoring software Zabbix. Furthermore, the attacker already had network access, used stolen credentials for lateral movement, and took careful steps to compromise the server without raising suspicion. In another compromise, researchers found an older malicious Word document, likely from a spearphishing email.

LunarWeb collects and exfiltrates information from the system, such as computer and operating system information, a list of running processes, a list of services, and a list of installed security products.  LunarWeb supports common backdoor capabilities, including file and process operations, and running shell commands. On first run, the LunarMail backdoor collects information from recipients’ sent email messages (email addresses). In terms of command capabilities, LunarMail is simpler and features a subset of the commands found in LunarWeb. It can write a file, create a new process, take a screenshot, and modify the C&C communication email address. Both backdoors have the unusual capability of being able to execute Lua scripts.

Turla, also known as Snake, has been active since at least 2004, possibly even dating back to the late 1990s. Believed to be part of the Russian FSB, Turla mainly targets high-profile entities such as governments and diplomatic organizations in Europe, Central Asia, and the Middle East. The group is notorious for breaching major organizations, including the US Department of Defense in 2008 and the Swiss defense company RUAG in 2014.

For more technical information about the Lunar toolset, read the blogpost “To the Moon and back(doors): Lunar landing in diplomatic missions.” Make sure to follow ESET Research on Twitter (today known as X) for the latest news.

Illustration of an exfiltration email with data hidden in the image

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Syncro Integration Announcement

We’re pleased to announce the Syncro integration with Comet is now available. This has been a popular feature request and we are pleased that partners can now monitor their backups through Syncro’s RMM platform.

Who Is Syncro?

Syncro – Helps you scale your MSP buisness with efficiency and ease.

Transform how you manage customers and your business with RMM, PSA and remote access in a single platform. The streamlined workflow allows you to focus your time and energy on what you’re an expert in – providing solutions for your clients.

How The Syncro Integration Works

With the Syncro integration, you can access RMM alerts in Syncro’s platform when a Comet backup job fails or doesn’t run. This allows you to see your alerts in one place, rather than logging into Comet, and troubleshoot before you lose any business critical data.

If you are interested in configuring this integration, you can read our guide here.

What To Expect

When a backup job fails, a new RMM alerts will be created. You can see this on the Open RMM Alerts page in Syncro. An example of how this will look is:

If the failure is due to an intermittent issue, Comet will clear the alert when the backup job succeeds again.

This means you no longer have to login to your Comet Server to check if backup jobs are running successfully or not.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Is your company data on the dark web? Key webinar takeaways

Cybersecurity experts Vladimir Krupnov, Threat Intelligence Lead at Revolut, Andrew Rose, Chief Security Officer at SoSafe, and Matt Lee, Senior Director of Security and Compliance at Pax8, joined Gerald Kasulis, VP Sales at NordStellar, to share their experiences and insights on dark web monitoring, and how they leverage threat intelligence to secure their organizations’ data. Enjoy the recording above for its comprehensive discussion on the topic, or keep reading for key business takeaways.

Understanding the dark web

The dark web refers to parts of the internet that are not indexed by typical search engines and require specific browsers or tools to access. According to Matt, it is “where data has been traded… where a lot of criminal business has historically been transmitted.” To Vladimir,  “It’s a cyberspace where criminals – or potential criminals – communicate and carry out malicious activity, which could be related to your company, government, or anything else.”

But as Andrew points out, it’s not all doom and gloom. The dark web has proven time and again to be a beneficial technology, providing a vital platform for journalists and social movements across the world for free speech and anonymous communication.

For security leaders, it’s a vast, largely untapped wellspring of information and data that isn’t attainable on the clear web. Fearing or ignoring it as a large business equates to simply wasting a good source of intelligence and/or value.

Quote bubble: “You have to embrace the dark web as well as fear it, because it might be serving your business, your community or your social group, not just endangering your business.”

So why do cybercriminals flock to the dark web? According to Matt, it offers threat actors a way to “control the discoverability” of illegal activities, leveraging end-to-end encrypted technologies for anonymity. Vladimir points out the ease with which individuals can now become cybercriminals, thanks to platforms like Telegram that host thousands of illicit groups: “this is a massive problem because it lowers the barrier for the typical person to become a cybercriminal. It just takes 2 clicks nowadays.”

What are they after?

Vladimir states that the point is not to be fully invisible, but to have an easy escape and lower traceability (compared to the “clear” web): “You can always find anyone… It all comes down to time and effort. If someone sells credentials belonging to your company and the existing damage is less than a few million, it’s unlikely to be picked up by law enforcement unless it’s a part of a broader campaign.”

Disposable fake profiles are a key tool in a threat actor’s arsenal. “They just burn the profile,” says Matt. “He would just say, they’re getting too close to me, time to burn my PGP key. Next I’ll just build a new profile. They’re living in plain sight. That said, they hate burning a persona. It sucks. But yes, they do it when they need to.”

Hacker gangs operate better than most think, he continues. “Their tradecraft and OPSEC (operations security) is better than most people give credit for, and I would also say is probably better than most companies’… it is the risk/reward of what they’re doing – since the risk is extremely high, they respond with better offset and better methodologies.”

Assessing and addressing business exposure

Matt Lee advises businesses to adopt a mindset of “live compromised,” focusing on limiting damage and improving incident response: “How do I limit the blast radius? How do I find it faster?”

This proactive stance can be supported by using threat intelligence services, as Andrew’s experience shows: “A threat intel firm brought me information about one of our staff members’ identities being sold online… We reached out immediately to that staff member and helped them close down all of those loops. We knew that although it was a personal issue for them, that could very easily turn into an insider threat, blackmail, or risk for us.”

Andrew explains that his team effectively scans for anything to do with their brand or company. In this case, it was a lucky find: “It just so happened that part of the details that were being sold said that this person is working for this organization in this role. So that was our trigger, that was our hook.”

He points out ethical concerns for business leaders when dealing with dark web resources. “You look at things like the Ashley Madison data dump… and we’re wondering what we do with this? Do we download this data and look at it to see whether any of our staff have been compromised and therefore potentially being blackmailed? Because that’s us downloading illegally stolen data. Or do we step away from it?”

Proactive measures and best practices for security leaders

Each expert supports ramping up education efforts and budget quotas for cybersecurity.

 

Business leaders, particularly newly hired executives, are singled out by threat actors with targeted phishing and vishing attempts, according to Vladimir, underscoring the need for comprehensive security protocols from day one.

What about “selling” to stakeholders and business leadership? As always, it comes down to communication. Andrew stated: “You have to take stories to your exec. Take my previous examples of finding at-risk employees online and being able to protect them, thus protecting the company. Or receiving a phone call from a threat intel provider, letting me know that there were discussions about attacking my sector. 

Should smaller companies be concerned about the dark web threats? There’s a common misconception that small companies are not a target for cybercriminals, with media exposure focusing on large scale data breaches of well-known brands. Matt Lee thinks so: “If I land on your credentials, your data, it doesn’t have to be valuable to me, it doesn’t have to be valuable to the world. It only has to matter to you to get you to pay.” Vladimir reminds us to watch out for fourth party risk – any risk posed to your organization from a business relationship a third party has with its vendor.

Insights and recommendations for threat exposure management

Matt recommends using canaries (attractive decoy targets for threat actors) as warning beacons on your security perimeter. “It enables you to take action, and makes that credential no longer valuable. Remove the credential, remove the persistence, whatever it may be.” A common question crops up: How can security leaders measure the effectiveness of dark web monitoring solutions? The panelists agree on measuring intelligence quality by how much of it their security teams can act upon.

Andrew looks at how current the data his solution is providing is, acknowledging that there are barren periods, but “it was never a service you could do without. Because you always knew that next month might be when suddenly they’d find something which could make the whole contract worthwhile.”

Matt agreed, saying it’s simply good strategy, relevant to sports, life, and cybersecurity: “You go scout the other team!”

Any final words? Incident response plan. If you don’t have one, Matt says, sort it out. “Too many companies lack this.” This plan should be reviewed annually and adapted to evolving threat and business environments. Ultimately, this is all about setting a strategic baseline for cybersecurity best practices. “Everything we’re talking about here is part of basic data hygiene and governance. Live as close to the CIS framework as you can.”

With actionable data, timely insights, and increased visibility into the online underworld, staying one step ahead of threat actors becomes possible. For CISOs protecting their organization’s data and security, this means having the ability to not just react to threats, but to anticipate them.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

ESET included among notable vendors in Mobile Threat Defense Solutions Landscape report

BRATISLAVA — May 9, 2024 — ESET, a global leader in cybersecurity solutions, has been included in Forrester’s Mobile Threat Defense (MTD) Solutions Landscape report, Q1 2024. Forrester, a respected analyst firm, provides an overview of 16 vendors in the field, including ESET, which, in our opinion, makes ESET a valuable player in this established market.

The importance of mobile malware protection is highlighted in the Forrester’s MTD Solutions Landscape report,1 which states: “Mobile devices are just as vulnerable to attacks as traditional endpoints like laptops and servers, whether through malicious applications, operating system (OS) vulnerabilities, phishing through messaging applications unique to mobile devices, or web-based attacks.” The report also emphasizes the comprehensive capabilities of MTD solutions designed to protect mobile devices with a level of rigor traditionally reserved for enterprises.

This inclusion comes shortly after the successful launch of the ESET’s Mobile Threat Defense module, a testament to ESET’s commitment to advancing mobile security. The module integrates seamlessly with the ESET PROTECT Platform, ensures comprehensive coverage of the mobile fleet attack vector with a one-to-one ratio to endpoints, and is included in all cloud subscription tiers starting from ESET PROTECT Advanced with no increase in price. This integration ensures unified security management and eliminates the need to juggle multiple consoles or platforms.

“The recognition in Forrester’s MTD Solutions Landscape report underscores for us the necessity of robust mobile threat defense in today’s security ecosystem,” explained Jakub Debski, Chief Product Officer at ESET. “With remote work expanding the scope of corporate networks, mobile devices have become prime targets for attackers. Our Mobile Threat Defense module not only addresses traditional threats but also adapts to the unique characteristics and challenges of mobile platforms, offering a solution that is both comprehensive and compliant with the evolving market needs.”

The report outlines three core and five extended use cases that underline the critical focus areas for organizations looking to strengthen their mobile security. Support for remote work, bring your own device policies, and mobile app security has been identified as core use cases, which are primary buyer expectations. Beyond these, the analysts have noted extended use cases like compliance assurance, contractor security, executive protection, and Zero Trust endpoint security. While not all MTD solutions cover these extended areas, they represent growing buyer interests alongside the core functionalities. ESET self-reported the extended use cases of compliance assurance, executive protection, and mobile knowledge worker as the top use cases for which clients select them.

For more information about ESET and its recently launched ESET Mobile Threat Defense module, please read here. The full report is available to Forrester clients with a valid subscription or for purchase.

1Forrester: Mobile Threat Defense Solutions Landscape, Q1 2024. Paddy Harrington and Team. March 18, 2024

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Why business continuity belongs in the cloud?

Resilience in today’s liquid business environment demands flexibility. The term “observability” replaces monitoring, reflecting the need to adapt and be agile in the face of challenges. The key is to dissolve operations into the cloud, integrating tools and operational expertise for effective resilience.

I remember that when I started my professional career (in a bank) one of the first tasks I was handled was to secure an email server exposed to the internet. Conversations around coffee were about these new trends that seemed suicidal, they wanted to take away service exploitation to servers on the internet!

There wasn’t even talk of the cloud at that time. The first steps of software as a service were already being taken, but in short, everything was on-premise, and infrastructure was the queen of computing, because without a data center, there was no business.

Two decades have gone by and the same thing that happened to Mainframes has happened to data centers. They are reminiscences of the past, something necessary, but outside of our lives. No one builds business continuity around the concept of the data center anymore, who cares about data centers anymore?

The number of devices worldwide that are connected to each other to collect and analyze data and perform tasks autonomously is projected to nearly triple, from 7 billion in 2020 to over 29.4 billion in 2030.

How many of those devices are located in a known data center?, furthermore, does it really matter where these devices are?

We don’t know who they are, who they are maintained by, or even what country they are in many times, no matter how much data protection laws insist, technology evolves a lot faster than legislation.

The most important challenge is ensuring business continuity, and that task is at the very least difficult when it is increasingly harder to know how to manage a business’ critical infrastructure, because the concept of infrastructure itself is changing.

Content:

What does IT infrastructure mean?

The suite of applications that manages the data needed to run your business. Below those applications is “everything else”, from databases, engines, libraries, full technology stacks, operating systems, hardware and hundreds of people in charge of each piece of that great babel tower.

What does business continuity mean?

According to ISO 22301, business continuity is defined as the “ability of an organization to continue the delivery of products and services in acceptable timeframes at a predefined capacity during an interruption.”

In practice, there is talk of disaster recovery and incident management, in a comprehensive approach that establishes a series of activities that an organization can initiate to respond to an incident, recover from the situation and resume business operations at an acceptable level. Generally, these actions have to do with infrastructure in one way or another.

Business continuity today

Before IT was simpler, infrastructure was located in one or more datacenters.

Now, we don’t even know where it is, beyond a series of intentionally fuzzy concepts, but what we do know is that neither the hardware is ours, nor the technology is ours, nor the technicians, nor the networks are ours. Only the data (supposedly).

What does business resilience mean?

It is funny that this term has become trendy, when the basic concept of the creation of the Internet was resilience. It means neither more nor less than that it is not a matter of hitting a wall and getting up, but that of accepting mistakes and moving forward, in other words, being a little more elegant and flexible when facing adversity.

Resilience and business continuity

In these liquid times, where everything flows, you have to be flexible and change the paradigm, that is why there is no longer talk of monitoring but of observability, because that of the all-seeing eye is a bit illusory, there is too much to see. Old models don’t work.

It’s not a scalability problem (or at least it’s not just a scalability problem), it’s a paradigm shift problem.

Let’s solve the problem using the problem

Today all organizations are somehow dissolved in the cloud. They mix their own infrastructure with the cloud, they mix their own technology with the cloud, they mix their own data with the cloud. Why not mix observability with cloud?

I’m not talking about using a SaaS monitoring tool, that would be to continue the previous paradigm, I’m talking about our tool dissolving in the cloud, that our operational knowledge dissolves in the cloud and that the resilience of our organization is based on that, on being in the cloud.

As in the beginnings of the internet, you may cut off a hydra’s head, but the rest keeps biting, and soon, it will grow back.

Being able to do something like this is not about purchasing one or more tools, hiring one or more services, no, that would be staying as usual.

Tip: the F of FMS in Pandora FMS, means Flexible. Find out why.

Resilience, business continuity and cloud

The first step should be to accept that you cannot be in control of everything. Your business is alive, do not try to corset it, manage each element as living parts of a whole. Different clouds, different applications, different work teams, a single technology to unite them all? Isn’t it tempting?

Talk to your teams, they probably have their own opinion on the subject, why not integrate their expertise into a joint solution? The key is not to choose a solution, but a solution of solutions, something that allows you to integrate the different needs, something flexible that you do not need to be in control of, just take a look, just have a complete map, so that whatever happens, you can move forward, that’s what continuity is all about.

Some tips on business continuity, resilience and cloud

Why scale a service instead of managing on-demand items?

A service is useful insofar as it provides customers with the benefits they need from it. It is therefore essential to guarantee its operation and operability.

Sizing a service is important to ensure its profitability and quality. When sizing a service, the amount of resources needed, such as personnel, equipment, and technology, can be determined to meet the demand efficiently and effectively. That way, you will avoid problems such as long waiting times, overwork for staff, low quality of service or loss of customers due to poor attention.

In addition, sizing a service will allow you to anticipate possible peaks in demand and adapt the capacity appropriately to respond satisfactorily to the needs of customers and contribute to their satisfaction. Likewise, it also helps you optimize operating costs and maximize service profitability.

Why find the perfect tool if you already have it in-house?

Integrate your internal solution with other external tools that can enhance its functionality. Before embarking on a never-ending quest, consider what you already have at home. If you have an internal solution that works well for your business, why not make the most of it by integrating it with other external tools?

For example, imagine that you already have an internal customer management (CRM) system that adapts to the specific needs of your company. Have you thought about integrating it with digital marketing tools like HubSpot or Salesforce Marketing Cloud? This integration could take your marketing strategies to the next level, automating processes and optimizing your campaigns in a way you never imagined before.

And if you’re using an internal project management system to keep everything in order, why not consider incorporating online collaboration tools like Trello or Asana? These platforms can complement your existing system with additional features, such as Kanban boards and task tracking, making your team’s life easier and more efficient.

Also, let’s not forget IT service management. If you already have an internal ITSM (IT Service Management) solution, such as Pandora ITSM, why not integrate it with other external tools that can enhance its functionality? Integrating Pandora ITSM with monitoring tools like Pandora FMS can provide a more complete and proactive view of your IT infrastructure, allowing you to identify and solve issues before they impact your services and users.

The key is to make the most of what you already have and further enhance it by integrating it with other tools that can complement it. Have you tried this strategy before? It could be the key to streamlining your operations and taking your business to the next level.

Why force your team to work in a specific way?

Incorporate other equipment and integrate it into your team (it may be easier than you imagine, and much cheaper).

The imposition of a single work method can limit the creativity and productivity of the team. Instead, consider incorporating new teams and work methods, seamlessly integrating them into your organization. Not only can this encourage innovation and collaboration, but it can also result in greater efficiency and cost reduction. Have you explored the option of incorporating new teams and work methods into your organization? Integrating diverse perspectives can be a powerful driver for business growth and success.

Why choose a single cloud if you can integrate several?

The supposed simplicity can be a prison of very high walls, never take your chances on a single supplier or you will depend on it. Use European alternatives to protect yourself from legal and political changes in the future.

Choosing a single cloud provider can offer simplicity in management, but it also carries significant risks, such as over-reliance and vulnerability to legal or political changes. Instead, integrating multiple cloud providers can provide greater flexibility and resilience, thereby reducing the risks associated with relying on a single provider.

Have you considered diversifying your cloud providers to protect your business from potential contingencies? Integrating European alternatives can provide an additional layer of protection and stability in an increasingly complex and changing business environment.

Why choose high availability?

Pandora FMS offers HA on servers, agents and its console for demanding environments ensuring their continuity.

High availability (HA) is a critical component in any company’s infrastructure, especially in environments where service continuity is key. With Pandora FMS, you have the ability to deploy HA to servers, agents, and the console itself, ensuring your systems are always online even in high demand or critical environments.

Imagine a scenario where your system experiences a significant load. In such circumstances, equitable load distribution among several servers becomes crucial. Pandora FMS allows you to make this distribution, which ensures that, in the event of a component failure, the system remains operational without interruptions.

In addition, Pandora FMS modular architecture allows you to work in synergy with other components, assuming the burden of those that may fail. This contributes to creating a fault-resistant infrastructure, where system stability is maintained, even in the face of unforeseen setbacks.

Why centralize if you can distribute?

Choose a flexible tool, such as Pandora FMS.

Centralizing resources may seem like a logical strategy to simplify management, but it can limit the flexibility and resilience of your infrastructure. Instead of locking your assets into a single point of failure, consider distributing your resources strategically to optimize performance and availability across your network.

With Pandora FMS, you have the ability to implement distributed monitoring that adapts to the specific needs of your business. This solution allows you to deploy monitoring agents across multiple locations, providing you with full visibility into your infrastructure in real time, no matter how dispersed it is.

By decentralizing monitoring with Pandora FMS, you may proactively identify and solve issues, thus minimizing downtime and maximizing operational efficiency. Have you considered how distributed monitoring with Pandora FMS can improve the management and control of your infrastructure more effectively and efficiently? Its flexibility and adaptability can offer you a strong and customized solution for your IT monitoring needs.

Contact our sales team, ask for a quote, or solve your doubts about our licenses. Pandora FMS, the integral solution for monitoring and observability.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.