Skip to content

What is Synthetic Monitoring?

Introduction

A system that allows you to identify potential issues in your digital services before they even occur—this is exactly what Synthetic Monitoring offers.

We are talking about a proactive approach that simulates user interactions to ensure everything runs smoothly, 24/7.

In practice, Synthetic Monitoring is a crucial solution for preventing downtime, maintaining high service standards, and ensuring user satisfaction. And we all know how much the current challenges revolve around improving user experience quality.

From e-commerce to SaaS platforms, Synthetic Monitoring adapts to the various characteristics and needs of companies, offering an essential tool for anyone who wants to keep their digital services efficient at all times.

What is Synthetic Monitoring?

Let’s dive into a more operational level: Synthetic Monitoring is a set of techniques that use predefined scripts to simulate typical user actions on websites, applications, or services.

These scripts replicate activities such as:

  • Logging into a portal.
  • Making an online purchase.
  • Checking the availability of an API (and much more).

As mentioned earlier, the goal is to identify performance or functionality issues before they impact real users. Unlike Real-User Monitoring (RUM), which collects data from actual interactions, Synthetic Monitoring continuously tests systems, even in the absence of real traffic.

Key Features of Synthetic Monitoring Systems

We have already touched on the functionality, usefulness, and characteristics of Synthetic Monitoring systems. Here is a detailed list of their main features:

  • Proactive monitoring: Accurately identifies potential issues before they affect users.
  • Customization: Allows the creation of tailored scripts for specific scenarios—an essential factor since every business has unique characteristics and needs.
  • Global coverage: A good Synthetic Monitoring system simulates interactions from various locations to assess performance on a geographical scale.
  • Detailed metrics: Analyzes parameters such as response times, loading speeds, and error rates. The breadth and depth of these data points fuel the continuous improvement of these systems.

Now, let’s focus on the processes of Synthetic Monitoring and the different phases involved.

Synthetic Monitoring – The Different Process Phases

Synthetic Monitoring follows a structured process that includes script creation, regular testing, and data analysis. Let’s examine these steps in more detail.

1. Script Creation 

Scripts are designed to simulate the most crucial workflows for a company’s users. For example:

  • Simulating a product search on an e-commerce site.
  • Testing an API’s response to a specific request.
  • Checking the functionality of a shopping cart.
  • Simulating a digital payment process.

In other business contexts, scripts can also mimic:

  • The digital onboarding process for employees.
  • Data retrieval functions in a corporate database.
  • Automatic software updates.

These are just a few examples—the scope of application is vast.

2. Test Execution 

Scripts are executed regularly according to a predefined schedule that aligns with the company’s needs. Tests can be conducted from:

  • Various geographical locations, to verify global performance.
  • Different devices and browsers, ensuring omnichannel compatibility and consistency.

3. Data Collection and Analysis 

During testing, detailed data is collected on numerous aspects, including:

  • Response times
  • Error rates
  • Overall system availability
  • Performance under specific conditions, such as different connection speeds
  • System stability under load
  • Resource efficiency (CPU, memory, and other hardware elements, often in combination with APM tools)
  • Compliance with security standards
  • Accuracy in exception handling

Of course, this is not an exhaustive list.

4. Issue Reporting 

If a test fails or results fall outside defined parameters, the system must send clear, automated notifications to the IT team, enabling a quick response to resolve any issues.

The Benefits of Synthetic Monitoring

1. Proactive Issue Detection 

As emphasized from the beginning, Synthetic Monitoring enables the identification of anomalies and performance issues before they affect users. This approach reduces downtime and improves customer satisfaction—two interconnected and critically important factors.

2. Continuous Monitoring 

Unlike Real-User Monitoring, Synthetic Monitoring operates continuously, ensuring performance monitoring even during inactive hours.

3. Global and Omnichannel Coverage 

Simulating interactions from different locations helps identify regional performance disparities and optimize services for users worldwide. The same applies to various devices.

4. User Experience Optimization 

This is one of the most significant benefits derived from the previous points. Maintaining high performance levels is essential for user retention. And user retention is crucial for market success.

With Synthetic Monitoring, companies can offer customers and employees a reliable, fast, and satisfying experience.

5. SLA Compliance Support 

Finally, Synthetic Monitoring helps organizations meet Service Level Agreements (SLAs) by providing concrete performance data and reducing the risk of penalties.

Practical Applications of Synthetic Monitoring Across Industries

E-commerce

For an e-commerce site, ensuring that payment processes are fast, secure, and error-free is essential. Synthetic Monitoring ensures that all steps in the purchase flow work correctly, preventing issues that could lead to abandoned carts and transaction failures.

SaaS and Business Applications

For Software-as-a-Service (SaaS) providers, Synthetic Monitoring is crucial for verifying that APIs, databases, and core workflows are always available. For instance, an HR management app might use Synthetic Monitoring to ensure that its reporting system operates without interruptions.

Banking and Financial Sector

Financial institutions use Synthetic Monitoring to ensure that online banking portals and mobile apps are always secure and operational, allowing for fast and error-free transactions.

Given the sensitivity of this sector, the importance of this cannot be overstated.

Healthcare

Speaking of industries where security and reliability are paramount, we come to the healthcare sector.

Hospitals and clinics can use Synthetic Monitoring to ensure the availability of online appointment systems, telemedicine platforms, and patient portals—while also maintaining strict data privacy standards.

Challenges of Synthetic Monitoring 

While the benefits of Synthetic Monitoring are clear and indispensable, its implementation comes with some challenges that must be carefully considered: 

  • Script Maintenance: Scripts need regular updates to adapt to changes in workflows or applications. 
  • Limitations Compared to Real Users: Synthetic Monitoring cannot fully capture the experience of individual users. 
  • False Positives: Incorrectly configured metrics and thresholds can generate unnecessary alerts, overwhelming IT teams. 
  • Initial Costs: Implementing and maintaining a Synthetic Monitoring system requires a significant investment in resources and expertise. However, in most cases, this investment is well justified by its long-term returns. 

Conclusion 

Synthetic Monitoring is a valuable and essential tool for any company managing complex digital services (which, today, is the vast majority). 

By ensuring continuous performance monitoring, it identifies issues before they arise, enabling organizations to offer optimal user experiences. 

By integrating Synthetic Monitoring with other tools, such as Real-User Monitoring (RUM) and ITSM platforms, companies can gain a comprehensive view of performance and system health, combining proactive and reactive monitoring. 

This combined approach significantly enhances service quality and fosters trust-based relationships with customers, increasing retention rates. 

FAQ 

  1. What is Synthetic Monitoring?  A system that uses scripts to simulate user interactions and measure the performance of websites, applications, and services for continuous optimization. 
  2. What are the main benefits?  Proactive issue detection, continuous monitoring, global optimization, and improved customer experience. 
  3. Which industries benefit from Synthetic Monitoring?  Practically any industry requiring reliability and stability, but especially e-commerce, SaaS, financial services, healthcare, and other sectors where service continuity is crucial. 

About EasyVista  
EasyVista is a leading IT software provider delivering comprehensive IT solutions, including service management, remote support, IT monitoring, and self-healing technologies. We empower companies to embrace a customer-focused, proactive, and predictive approach to IT service, support, and operations. EasyVista is dedicated to understanding and exceeding customer expectations, ensuring seamless and superior IT experiences. Today, EasyVista supports over 3,000 companies worldwide in accelerating digital transformation, enhancing employee productivity, reducing operating costs, and boosting satisfaction for both employees and customers across various industries, including financial services, healthcare, education, and manufacturing.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

What is an enterprise browser & why does your business need one?

Summary: Enterprise browsers enhance security, control, and management for businesses. See how they protect against cyber threats and ensure compliance in your digital environment.

In our digital-first daily life, businesses are navigating cybersecurity threats, more remote work, and a growing reliance on web-based applications. These challenges demand new solutions to ensure the security of business resources while maintaining a seamless user experience.

This is where an enterprise browser comes into play. As businesses adapt to the new conditions, an enterprise browser offers strengthened security for web access, better management of corporate data, and more control over user interactions with web applications. But what is a secure enterprise browser, and why should your business consider adopting one? Let’s explore.

What is an enterprise browser?

An enterprise browser is a web browser specifically designed to enhance security and optimize user experience for businesses. Unlike traditional consumer browsers, built for general use, an enterprise browser is equipped with specialized security features to protect company data and resources while ensuring smooth access to web applications and SaaS tools.

Secure enterprise browsers help IT teams manage everything in one place. They can set security rules and keep an eye on browser activities across the organization.

Beyond basic security, enterprise browsers also enhance productivity by reducing time spent on IT troubleshooting and security incidents. For example, instead of juggling multiple browsers to access different applications, employees can rely on one enterprise browser.

That helps ensure compatibility and streamlines their workflow, eliminating the frustration of switching between browsers and improving efficiency. At the same time, IT teams can centrally manage and configure browser settings, allowing employees to work without interruptions caused by security breaches or access issues.

This proactive approach minimizes downtime and streamlines daily operations, ensuring that employees remain focused on their tasks with fewer worries about cyber threats.

How does an enterprise browser work?

An enterprise browser works by incorporating security measures directly into the browser’s architecture. This ensures that every interaction with web applications and cloud resources is protected and compliant with corporate policies.

While the browser’s design prioritizes user experience, it is important to remember that threats can be mitigated but not completely eliminated. User awareness remains a crucial aspect of maintaining security.

Enterprise browser scheme

Here’s a simplified breakdown of how it works:

  1. Centralized management: IT teams can set up and enforce security configurations across the organization through a centralized dashboard. This includes browser settings, access controls, and data protection policies.
  2. Enhanced security layers: Secure enterprise browsers integrate safety features such as authentication methods, encryption, and browser isolation to guard against malicious attacks.
  3. Web access protection: Browsing is secured through real-time monitoring of web applications, which detects and blocks harmful activity that could expose corporate data.
  4. Corporate resource access: The enterprise browser enables protected access to internal resources and applications while keeping strict controls to safeguard sensitive information.
  5. Zero Trust principles: Following a Zero Trust security model, the enterprise browser verifies every request to access company data or resources. Only authorized users and their trusted devices get access.

Additionally, enterprise browsers can integrate with endpoint security solutions, identity and access management (IAM) systems, and security information and event management (SIEM) tools.

This allows businesses to gain deeper insights into browser activities, detect anomalies, and proactively respond to potential threats. With these integrations, companies can automate security enforcement, ensuring that only compliant and verified devices can access corporate data.

Threats from which an enterprise browser can protect you

Enterprise browsers are designed to protect businesses from common cybersecurity threats. Some of the key threats they guard against include:

  • Data loss: With encryption and strict access controls, enterprise browsers help prevent unauthorized access to a company’s data, reducing the risk of data loss.
  • Data leakage: Enterprise browsers help minimize the chance of sensitive data leakage by preventing the uploading and downloading of sensitive files through web apps and SaaS applications.
  • Phishing attacks: Advanced security features detect and block phishing attempts, safeguarding employees’ and organizations’ data from social engineering attacks.
  • Malware and ransomware: Secure enterprise browsers’ advanced protection layers can block malware and ransomware attacks before they reach a user’s device or network, reducing the risk of a breach.

For a comprehensive overview of these—and other—threats and their impact, explore our dedicated cyber threat hub.

A major advantage of an enterprise browser is its ability to enforce content filtering and network access restrictions. Organizations can block access to risky websites, prevent employees from downloading unauthorized software, and even restrict the use of web-based applications.

This level of control ensures that corporate devices and data remain secure, minimizing the chances of employees accidentally exposing the company to security threats.

Is an enterprise browser right for your business?

With the growing number of cyber threats targeting businesses, traditional browsers often lack the security controls to protect sensitive data and web-based internal resources, especially when accessed from unmanaged devices. An enterprise browser provides a dedicated security layer, ensuring safe access to web apps and SaaS platforms while preventing threats like phishing, malware, and data breaches.

But beyond just protection, enterprise browsers offer additional advantages such as enhanced security, control, and productivity across the organization. Here are the key enterprise browser benefits for your business:

1. BYOD (Bring Your Own Device) support

With the rise of remote work, many employees now use their devices to access corporate resources. However, managing security on personal devices can be challenging. An enterprise browser provides a secure environment for browsing and web-based resource access, even on unmanaged devices, ensuring that company data-related risks are mitigated regardless of the device being used.

2. Strengthened security for network access

As businesses increasingly rely on web applications and SaaS applications, it’s vital to have secure access to these resources. An enterprise browser enables businesses to safely access web-based tools and internal resources, with robust access controls and secure browser environments.

3. Centralized management

Managing security settings and configurations across a large organization can be hard to handle. Enterprise browsers simplify this process by offering unified management, allowing IT teams to configure and enforce security policies across all users with a few clicks. This level of control is critical in ensuring consistency and reducing vulnerabilities across the organization.

4. Compliance and regulatory requirements

With increasing scrutiny on data privacy and security, especially with global regulations like GDPR and CCPA, enterprises must ensure they meet strict compliance standards. Secure enterprise browsers help businesses stay compliant by incorporating features that prevent data leakage and support secure browsing practices, minimizing the risk of non-compliance.

5. Reduced IT overhead

By centralizing management and automating security updates, enterprise browsers reduce the burden on IT teams. IT administrators no longer need to manually configure browsers on each user’s devices or fix security issues from unsecured consumer browsers. This improves operational efficiency and reduces overall IT costs.

In addition, enterprise browsers can provide detailed auditing and reporting tools. IT administrators can track login attempts, user activity, and security incidents in real-time. This level of visibility allows organizations to identify potential risks early and take proactive measures before a security breach occurs.

The downsides of enterprise browsers

While enterprise browsers offer significant advantages, there are some challenges that businesses should consider:

  • Compatibility with legacy systems. Some legacy applications or older systems may not be fully compatible with enterprise browsers. This could cause issues when trying to access internal resources or run specific web applications. Compatibility testing is crucial before transitioning to an enterprise browser.
  • User resistance. Employees used to consumer browsers may be hesitant to adopt a new browser. Change management strategies and adequate training are necessary to ensure a smooth transition and to encourage adoption.
  • Potential performance issues. While enterprise browsers are designed to be efficient, sometimes security layers can cause slight performance slowdowns. It’s important to monitor and optimize performance to prevent any negative impact on the user experience.

Enterprise browser use cases: real-world applications

Enterprise browsers are versatile tools that can be used across various business environments. Here are some key use cases:

1. Enabling remote work

For businesses with remote teams, enterprise browsers enhance secure access to corporate resources without compromising security. Whether employees are using unmanaged devices or company-issued laptops, the browser provides a secure platform for accessing sensitive company data.

2. BYOD policies

With more organizations adopting BYOD policies, enterprise browsers provide a controlled environment for employees to use personal devices without risking the organization’s data. This is particularly valuable in industries where employees must access corporate resources from multiple locations.

3. Securing web applications and SaaS tools

Enterprise browsers are essential for businesses that rely on web apps and SaaS applications. They provide a monitored environment to ensure safe access to these tools while protecting business data.

4. Data protection in web browsing

Enterprise browsers add an extra layer of protection against data breaches and cyber threats for organizations dealing with sensitive or confidential data. By enforcing strict access controls and monitoring data interactions, businesses can confidently protect their information while employees access online resources.

5. Enhanced compliance management

Enterprise browsers help businesses meet regulatory requirements such as GDPR, HIPAA, or PCI DSS by providing secure browsing environments and robust logging capabilities. This ensures that all network access is monitored, logged, and compliant with data protection regulations.

Essential features of a secure enterprise browser

Some key features of enterprise browsers that contribute to their security and performance include:

  • Centralized management: Allowing IT teams to control browser settings and policies from a single dashboard
  • Secure authentication: Enabling two-factor authentication (2FA) or single sign-on (SSO) to ensure secure logins
  • Threat protection: Implementing measures to guard against various online threats and ensure data security
  • Access controls: Ensuring users only have access to the resources they need based on their role and permissions
  • Data protection: Using encryption and other technologies to prevent data breaches and unauthorized access
  • Threat protection: Implementing measures to guard against various online threats and ensure data security.

Enterprise browsers vs. alternatives: Security comparison

When considering the implementation of an enterprise browser, it’s important to compare it to other available security solutions. Here’s how enterprise browsers stack up against other technologies:

Enterprise browsers vs. remote browser isolation (RBI)

While both solutions provide enhanced security for web access, remote browser isolation (RBI) allows users to access web content securely by isolating the browsing activity on a separate virtual machine or cloud instance. In contrast, an enterprise browser prevents access to malicious content directly within the browser interface, offering more control and a better user experience.

Enterprise browsers vs. consumer browsers

Consumer browsers are designed for general use and lack the security layers to protect company data. Enterprise browser benefits are that it is specifically built with security and control in mind. They offer centralized management and enhanced protection features like secure browser environments and data loss prevention.

Enterprise browser vs. SASE

Secure Access Service Edge (SASE) provides a comprehensive network security model that combines SD-WAN and security features like Zero Trust and data encryption. While SASE focuses on network-level security, an enterprise browser focuses specifically on web-based resource access, providing granular control over browser activity.

Enterprise browser vs. VDI

Virtual Desktop Infrastructure (VDI) provides a virtualized desktop environment for employees, ensuring that all business applications and resources are accessed remotely and securely. While VDI offers comprehensive security for the entire desktop environment, an enterprise browser focuses on securing browser-based interactions with web apps and corporate resources.

With the shift towards cloud-based applications, businesses can leverage secure browsers as a more cost-effective alternative to VDI, simplifying access to SaaS apps while maintaining robust security.

Securing your browser with NordLayer

At NordLayer, we recognize the increasing need for secure web access. That’s why we’re working on a new-generation Enterprise Browser. It is designed to enhance SaaS security and control, provide built-in threat prevention, and safeguard company resources.

In the meantime, NordLayer can still help protect your browsers through our NordLayer Browser Extension, which adds an extra layer of security and data protection to your existing web browser.

Stay tuned for more updates on our Enterprise Browser, and join our waiting list to be the first to experience the next level of web browser security.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

This real-life example shows why your Android should not connect to Wi-Fi automatically

The world of smartphones is full of automation and requires reputable Android protection.

Most smartphone users probably know that connecting to any random Wi-Fi hotspot available is not the best idea. But sometimes, an Android device can autonomously connect to a malicious Wi-Fi network without your awareness.

Imagine that you are at your favorite restaurant, your order is complete, and now you want to check your smartphone before the meal comes. However, without your knowledge, someone else is already monitoring everything you do on your device, including the websites you browse, the applications you use, and the credentials you enter.

An attack like this is possible. For example, if ESET malware researcher Lukáš Štefanko used his Cheap Yellow Display (CYD) tool running Evil M5 firmware for malicious purposes. Luckily, acting as an ethical pen tester, he just published a video showing how easy it can be to obtain Wi-Fi networks that smartphones want to reconnect to automatically. With this information, he could create a fake Wi-Fi access point, or an “evil twin” network, to gather sensitive data from a victim’s device.

Let’s dive a little deeper into these kinds of attacks, and what lessons we can learn from them.

 

Dangers of comfort zones

When creating software, developers always think about usability, user comfort, and user experience. So, it’s only natural that smartphones have an incorporated function to reconnect automatically to previously used and trusted networks.

However, cybercriminals love to exploit situations in which users feel safe and enjoy ever-present automation. The attack displayed by Lukáš Štefanko does the same — this technique preys on the fact that Android smartphones constantly and transparently tell nearby devices which Wi-Fi networks they have connected to, and want to reconnect to, automatically.

Luckily, attacks that require the malicious actor to be physically present at the location aren’t common, but that doesn’t mean that they can’t happen. For example, Australia’s Federal Police (AFP) charged one of its citizens over an alleged evil twin attack on multiple domestic flights and airports in June 2024. His seized devices allegedly contained dozens of stolen personal credentials.

Other times, it can be a state-sponsored operation such as the plot of a UK-based spy ring, as described by a prosecutor during a recent trial. The spy ring, among other things, also operated in Germany, where its members allegedly used an International Mobile Subscriber Identity Catcher or IMSI catcher to intercept mobile phone traffic from a military base where Ukrainian soldiers were training.

 

Other threats

As you can see, connecting and reconnecting to publicly available Wi-Fi networks can pose a danger. And the list of possible threats doesn’t end with rogue hotspots:

Man-In-The-Middle (MITM) attack — In such attacks, cybercriminals intercept communications between a device and the Wi-Fi network, allowing them to access sensitive unencrypted information like passwords, credit card numbers, and personal messages.

Exploitation of vulnerabilities — Cybercriminals can exploit vulnerabilities in less-secure public networks, or vulnerabilities of a targeted mobile device (especially if it doesn’t have updated software), to distribute malware to connected devices. This malware can then be used to steal data, monitor users’ activities, or even take control of users’ devices.

Packet Sniffing — Public Wi-Fi networks often lack proper encryption, making it easier for hackers to eavesdrop on users’ online activities.

How to stay safe

Obviously, the basic security recommendation for Wi-Fi users is to disable automatic connections to Wi-Fi networks, and not use free publicly accessible Wi-Fi networks at all. If this is not possible for any reason, here are a few more tips:

Use a Virtual Private Network (VPN) —VPN creates a secure and encrypted connection between a user’s device and the internet.

Do not share sensitive data — Avoid websites and applications requesting sensitive information such as online banking or shopping sites while on public Wi-Fi.

Stay on top of updates — Keep your software and apps updated. Regular updates often include security patches that protect against known vulnerabilities.

ESET Mobile Security

When it comes to cybersecurity, ESET goes far beyond just simple antivirus — and this also applies to smartphones and mobile devices. ESET Mobile Security is built around the ESET prevention-first approach, stopping attacks before they can do any harm. This goal can be met by securing cybercriminals’ most common points of entry to devices while keeping the security solution simple to use.

ESET Mobile Security is well-prepared for attacks coming from malicious websites, thanks to multilayered protection against phishing, smishing, and scams. For example, Anti-Phishing enhanced by Link Scanner protects users against malicious websites, and Payment Protection delivers a new layer of security for sensitive payment and financial applications.

And the best part? The premium version of ESET Mobile Security utilizing all these features and more is 50% off between March 3 and March 9, 2025!

Enjoy technology with peace of mind

Most would agree that people love comfort, and, in fact, the entire technology industry is driven by users pursuing faster, easier, and more user-friendly solutions for their daily activities. And there is nothing bad about living in the lap of technological luxury; but don’t ignore the threats out there.

Luckily, with a pinch of cybersecurity awareness and a reputable security solution installed on your Android smartphone, you should be fine. Wi-Fi network attacks are well-known, and acclaimed cybersecurity companies such as ESET taking advantage of more than 30 years of experience have you covered.

 

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

North Korea-aligned DeceptiveDevelopment targets freelance developers with infostealers, ESET Research discovers

  • DeceptiveDevelopment targets freelance software developers through spearphishing on job-hunting and freelancing sites, aiming to steal cryptocurrency wallets and login information from browsers and password managers.
  • This operation primarily uses two malware families – BeaverTail (infostealer, downloader) and InvisibleFerret (infostealer, Remote Access Trojan – RAT).
  • DeceptiveDevelopment’s techniques are similar to several other known North Korea-aligned operations.
PRAGUE, BRATISLAVA — February 20, 2025 — Since 2024, ESET researchers have observed a series of malicious North Korea-aligned activities, where the operators, posing as software development  recruiters, entice the victims with fake employment offers. Subsequently, they try to serve their targets with software projects that conceal infostealing malware. ESET Research calls this activity cluster DeceptiveDevelopment. This North Korea-aligned activity is currently not attributed by ESET to any known threat actor. It targets freelance software developers through spearphishing on job-hunting and freelancing sites, aiming to steal cryptocurrency wallets and login information from browsers and password managers. “As part of a fake job interview process, the DeceptiveDevelopment operators ask their targets to take a coding test, such as adding a feature to an existing project, with the files necessary for the task usually hosted on private repositories on GitHub or other similar platforms. Unfortunately for the eager work candidate, these files are trojanized: Once they download and execute the project, the victim’s computer gets compromised,” explains ESET researcher Matěj Havránek, who made the discovery and analyzed DeceptiveDevelopment. DeceptiveDevelopment’s tactics, techniques, and procedures are similar to several other known North Korea-aligned operations. Operators behind DeceptiveDevelopment target software developers on Windows, Linux, and macOS. They steal cryptocurrency primarily for financial gain, with a possible secondary objective of cyberespionage. To approach their targets, these operators use fake recruiter profiles on social media. The attackers don’t distinguish based on geographical location, instead aiming to compromise as many victims as possible to increase the likelihood of successfully extracting funds and information. DeceptiveDevelopment primarily uses two malware families as part of its activities, delivered in two stages. In the first stage, BeaverTail (infostealer, downloader) acts as a simple login stealer, extracting browser databases containing saved logins, and as a downloader for the second stage, InvisibleFerret (infostealer, RAT), which includes spyware and backdoor components, and is also capable of downloading the legitimate AnyDesk remote management and monitoring software for post-compromise activities. In order to pose as recruiters, the attackers copy profiles of existing people or even construct new personas. They then either directly approach their potential victims on job-hunting and freelancing platforms, or post fake job listings there. While some of these profiles are set up by the attackers themselves, others are potentially compromised profiles of real people on the platform, modified by the attackers. Some of the platforms where these interactions occur are generic job-hunting ones, while others focus primarily on cryptocurrency and blockchain projects and are thus more in line with the attackers’ goals. The platforms include LinkedIn, Upwork, Freelancer.com, We Work Remotely, Moonlight, and Crypto Jobs List. Victims receive the project files either directly via file transfer on the site, or through a link to a repository like GitHub, GitLab, or Bitbucket. They are asked to download the files, add features or fix bugs, and report back to the recruiter. Additionally, they are instructed to build and execute the project in order to test it, which is where the initial compromise happens. The attackers often use a clever trick to hide their malicious code: They place it in an otherwise benign component of the project, usually within backend code unrelated to the task given to the developer, where they append it as a single line behind a long comment. This way, it is moved off-screen and stays mostly hidden. “The DeceptiveDevelopment cluster is an addition to an already large collection of money-making schemes employed by North Korea-aligned actors and conforms to an ongoing trend of shifting focus from traditional money to cryptocurrencies,” concludes Havránek. For a more detailed analysis and technical breakdown of DeceptiveDevelopment, check out the latest ESET Research blogpost, “DeceptiveDevelopment targets freelance developers,” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Heatmap of different victims of DeceptiveDevelopment

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.