About ESET
ESET develops software solutions that deliver instant, comprehensive protection against evolving computer security threats. ESET pioneered and continues to lead the industry in proactive threat detection. ESET NOD32 Antivirus, its flagship product, consistently achieves the highest accolades in all types of comparative testing and is the foundational product that builds out the ESET product line to include ESET Smart Security. ESET Smart Security is an integrated antivirus, antispyware, antispam and personal firewall solution that combines accuracy, speed and an extremely small system footprint to create the most effective security solution in the industry. Both products have an extremely efficient code base that eliminates the unnecessary large size found in some solutions. This means faster scanning that doesn’t slow down computers or networks. Sold in more than 160 countries, ESET has worldwide production headquarters in Bratislava, SK and worldwide distribution headquarters in San Diego, U.S. ESET also has offices in Bristol, U.K.; Buenos Aires, AR; Prague, CZ; and is globally represented by an extensive partner network. For more information, visit our local office at https://eset.version-2.sg.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The Company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which includes Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities. For more information, please visit https://www.version-2.com.sg/ or call (65) 6296-4268.

BRATISLAVA, MONTREAL — October 25, 2023 — ESET researchers, during their regular monitoring of the cyberespionage operations of Winter Vivern, discovered that the group recently began exploiting a zero-day XSS vulnerability in the Roundcube Webmail server. In an XSS attack, malicious scripts are injected into otherwise trusted websites. According to ESET telemetry data, the campaign targeted Roundcube Webmail servers belonging to governmental entities and a think tank, all in Europe. ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible.

ESET discovered the vulnerability on October 12 and immediately reported it to the Roundcube team, who patched the vulnerability and released security updates soon after, on October 14. “We would like to thank the Roundcube developers for their quick reply and for patching the vulnerability in such a short time frame,” says ESET researcher Matthieu Faou, who discovered the vulnerability and Winter Vivern attacks.

“Winter Vivern is a threat to governments in Europe because of its persistence, its very consistent running of phishing campaigns, and because a significant number of internet-facing applications are not regularly updated despite being known to contain vulnerabilities,” explains Faou.

Exploitation of the XSS vulnerability CVE-2023-5631 can be done remotely by sending a specially crafted email message. “At first sight, the email doesn’t seem malicious – but if we examine the HTML source code, we can see a tag for SVG graphics at the end that contains an encoded malicious payload,” says Faou. By sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user’s browser window. No manual interaction other than viewing the message in a web browser is required. The final JavaScript payload can exfiltrate email messages to the command and control server of the group.

Winter Vivern is a cyberespionage group that is thought to have been active since at least 2020 and targets governments in Europe and Central Asia. To compromise its targets, the group uses malicious documents, phishing websites, and a custom PowerShell backdoor. ESET believes with low confidence that Winter Vivern is linked to MoustachedBouncer, a sophisticated Belarus-aligned group that we first published about in August 2023. Winter Vivern has been targeting Zimbra and Roundcube email servers belonging to governmental entities since at least 2022.

For more technical information about Winter Vivern, its latest attack, and the Roundcube vulnerability, check out the blogpost “Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers” on WeLiveSecurity. Make sure to follow ESET Research on Twitter (now known as X) for the latest news from ESET Research.

• The latest APT Activity Report contains activities of selected APT groups from April 2023 to September 2023.
• It highlights China-aligned groups’ persistent campaigns in the EU and the evolution of Russia’s cyberwar in Ukraine from sabotage to espionage.
• Various groups exploited vulnerabilities in WinRAR, Microsoft Exchange servers, and IIS servers.
• The prime target of Russia-aligned groups remained Ukraine; Telegram users were targeted for data collection.
• Among the newly discovered China-aligned groups, DigitalRecyclers repeatedly compromised a governmental organization in the EU, TheWizards conducted adversary-in-the-middle attacks, and PerplexedGoblin targeted another governmental organization in the EU.

BRATISLAVA — October 26, 2023 — ESET released its latest report about the activities of selected advanced persistent threat (APT) groups that were observed, investigated, and analyzed by ESET researchers from April 2023 until the end of September 2023. Notably, ESET Research observed various APT groups exploiting known vulnerabilities to exfiltrate data from governmental entities or related organizations. Handpicked findings were presented exclusively to selected journalists during a press event. The presentation and the report explore China-aligned groups’ persistent campaigns in the European Union and the evolution of Russia’s cyberwar in Ukraine from sabotage to espionage.

Russia-aligned Sednit and Sandworm, North Korea-aligned Konni, and geographically unattributed Winter Vivern and SturgeonPhisher seized the opportunity to exploit vulnerabilities in WinRAR (Sednit, SturgeonPhisher, and Konni), Roundcube (Sednit and Winter Vivern), Zimbra (Winter Vivern), and Outlook for Windows (Sednit) to target various governmental organizations, not only in Ukraine but also in Europe and Central Asia. Regarding China-aligned threat actors, GALLIUM probably exploited weaknesses in Microsoft Exchange servers or IIS servers, extending its targeting from telecommunications operators to governmental organizations around the world; MirrorFace probably exploited vulnerabilities in the Proself online storage service; and TA410 probably exploited flaws in the Adobe ColdFusion application server.

Iran- and Middle East-aligned groups continued to operate at high volume, primarily focusing on espionage and data theft from organizations in Israel. Notably, Iran-aligned MuddyWater also targeted an unidentified entity in Saudi Arabia, deploying a payload that suggests the possibility of this threat actor serving as an access development team for a more advanced group.

The prime target of Russia-aligned groups remained Ukraine, where we discovered new versions of the known wipers RoarBat and NikoWiper and a new wiper we named SharpNikoWiper, all deployed by Sandworm. Interestingly, while other groups – such as Gamaredon, GREF, and SturgeonPhisher – target Telegram users to try to exfiltrate information, or at least some Telegram-related metadata, Sandworm actively uses this service for active measure purposes, advertising its cybersabotage operations. However, the most active group in Ukraine continued to be Gamaredon, which significantly enhanced its data-collecting capabilities by redeveloping existing tools and deploying new ones.

North Korea-aligned groups continued to focus on Japan, South Korea, and South Korea-focused entities, employing carefully crafted spear phishing emails. The most active Lazarus scheme observed was Operation DreamJob, luring targets with fake job offers for lucrative positions. This group consistently demonstrated its capability to create malware for all major desktop platforms.

Finally, our researchers uncovered the operations of three previously unidentified China-aligned groups: DigitalRecyclers, repeatedly compromising a governmental organization in the EU; TheWizards, conducting adversary-in-the-middle attacks; and PerplexedGoblin, targeting another governmental organization in the EU.

ESET APT Activity Reports contain only a fraction of the cybersecurity intelligence data provided to customers of ESET’s private APT reports. ESET researchers prepare in-depth technical reports and frequent activity updates detailing activities of specific APT groups, in the form of ESET APT Reports PREMIUM, to help organizations tasked with protecting citizens, critical national infrastructure, and high-value assets from criminal and nation-state-directed cyberattacks. Comprehensive descriptions of activities described in this document were therefore previously provided exclusively to our premium customers. More information about ESET APT Reports PREMIUM, which delivers high-quality, strategic, actionable, and tactical cybersecurity threat intelligence, is available on the ESET Threat Intelligence website.

For more technical information, check the full ESET APT Activity Report on WeLiveSecurity. Make sure to follow ESET Research on Twitter (now known as X) for the latest news from ESET Research.

ESET PROTECT Enterprise scored highly in the EPR CyberRisk Quadrant™

• ESET has been named a Strategic Leader in the AV-Comparatives Endpoint Prevention and Response (EPR) Comparative Report 2023.
• ESET PROTECT Enterprise stands out with its high detection rates, minimal false positives, and intuitive design.

BRATISLAVA, — October 23, 2023 — ESET, a global cybersecurity leader, is pleased to announce that ESET PROTECT Enterprise has been rigorously tested and named a Strategic Leader in the 2023 AV-Comparatives Endpoint Prevention and Response (EPR) Comparative Report. In this assessment, conducted by the esteemed independent testing organization AV-Comparatives, ESET PROTECT Enterprise outperformed 11 other vendors in 50 real-world scenarios testing prevention and response. The resultant EPR CyberRisk Quadrant factors in product efficacy in breach prevention, the calculated savings, and the product’s purchase, operational accuracy, and workflow delay costs.

ESET PROTECT Enterprise version 10.1, which includes ESET PROTECT and ESET INSPECT, has proven its effectiveness in providing robust enterprise prevention and response capabilities against threats of high concern for enterprises. During the test, it effectively countered threats targeted at business users, particularly by halting threats before they could breach organizational networks.

The product displayed a set of safeguards, effectively protecting enterprise systems and networks against the tested scenarios, and achieving the highest detection rate among all products tested. Overall, ESET PROTECT Enterprise showed a 100% Active Response rate and a 100% Passive Response rate across all scenarios, demonstrating its ability to automatically stop attacks and report them accurately. Its alignment with MITRE ATT&CK® tactics, techniques, and procedures (TTPs) greatly assists even entry-level SOC analysts in conducting detailed investigations and escalating incidents when necessary.

As described in the report, ESET PROTECT Enterprise stands out with its high detection rates, minimal false positives, and intuitive design. Enterprises that transitioned to ESET may not only experience enhanced security but also reduce IT costs significantly in comparison to other vendor solutions.

Roman Kováč, Chief Research Officer at ESET, noted: “Being named a Strategic Leader in the 2023 EPR Comparative Report makes us immensely proud. This recognition demonstrates our commitment to providing top-tier cybersecurity solutions for businesses globally. At ESET, we are dedicated to empowering enterprises with cutting-edge technology that not only enhances their security posture but also reduces operational costs. The test results of the EPR Comparative report reinforce our mission to create a safer digital world for all and underscore the effectiveness of our prevention and response capabilities.”

“ESET has consistently proven its strength in endpoint security and EDR, achieving certification in the EPR Test for four consecutive years since its introduction. Notably, ESET´s exceptional performance is also recognized in the leading Business security benchmarks, setting it apart in the industry,” stated by Andreas Clementi, CEO & Founder of AV-Comparatives.

ESET was one of only four vendors to receive the highest certification in the EPR CyberRisk Quadrant. These outstanding results reaffirm ESET’s position as a Strategic Leader, as recognized by AV-Comparatives. ESET continues to excel in the cybersecurity landscape, offering innovative solutions that effectively protect enterprises.

For more information about ESET’s results in the AV-Comparatives EPR Test 2023, click here.

BRATISLAVA, BUENOS AIRES — October 17, 2023 — ESET Research announced today the release of the report “Looking into TUT’s tomb: The universe of threats in LATAM,” which analyzes more than a dozen operations and various cybercriminal campaigns in Latin America. With evolving targeting strategies and techniques, these campaigns exhibit a high level of sophistication, specifically tailoring their approaches to exploit enterprise users, including government sectors. The predominant method of compromising victims is through phishing emails that deliver multiple malicious components.

“Much like the life and mysterious demise of the ancient Egyptian pharaoh Tutankhamun, also known as King Tut, the threat landscape in Latin America remains shrouded in mystery. This is primarily due to limited global attention on evolving malicious campaigns within the region,” says ESET researcher Camilo Gutierrez, based in Buenos Aires, Argentina, who investigated the malicious campaigns. “With parallels to how archaeological excavations of King Tut’s tomb shed light on ancient Egyptian life, we embarked on a journey to delve into less-publicized cyberthreats affecting Latin American countries. Our initiative, named Operation King TUT (The Universe of Threats), sought to explore this significant threat landscape.”

In the paper, ESET Research looks back at various publicly documented campaigns targeting the LATAM region between 2019 and 2023; the vast majority of the detections surrounding these cybercriminal activities are in Latin America and are not associated with global crimeware. Since each of these operations has its own unique traits, and they don’t appear to be linked to a single threat actor, it’s highly likely that multiple actors are at play.

ESET analysis revealed a notable shift from simplistic, opportunistic crimeware to more complex threats. Notably, researchers have observed a transition in targeting, moving from a focus on the general public to high-profile users, including businesses and governmental entities. These threat actors continually update their tools, introducing different evasion techniques to increase the success of their campaigns. Furthermore, while the LATAM region contains the vast majority of victims, in some cases we have seen an expansion of these campaigns targeting countries outside the region, with the actors taking their crimeware business beyond Latin America and mirroring the pattern seen in banking trojans born in Brazil.

“Our comparison also shows that the majority of malicious campaigns seen in the region are directed at enterprise users, including government sectors, by primarily employing spearphishing emails to reach potential victims. Attackers often masquerade as recognized organizations within specific countries in the region, particularly government or tax entities,” says Gutierrez.

The precision and specificity observed in these attacks point to a high level of targeting, indicating that the threat actors have detailed knowledge about their intended victims. In these campaigns, attackers utilize malicious components like downloaders and droppers, mostly created in PowerShell and VBS. Regarding the tools used in these malicious operations in Latin America, ESET observations indicate a preference for remote access trojans.

For more technical information about “Operation King TUT: The universe of threats in LATAM,” read the blog post on WeLiveSecurity. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Described cybercriminal activities were detected exclusively in LATAM countries