Bitdefender researchers have noticed a new malware strain spiking in our telemetry. What caught our attention were processes that add local exclusions in Windows Defender for specific file names (prun.exe, appsetup.exe, etc.), that all reside in the same folder, called \PublicGaming\. Further investigation revealed that this malware is a downloader that can deliver any payload
The journey of Trickbot starts almost half a decade ago, when it appeared in the form of a banker and credential-stealing application. Drawing inspiration from Dyre (or Dyreza), Trickbot consists of an ecosystem of plugin modulesand helper components. As of late, the Trickbot group, which has managed to infect millions of computers worldwide, has played
A Fresh Look at Trickbot’s Ever-Improving VNC Module Read More »
Traditionally, the information security domain has examined identity through the lens of the corporate enterprise. In this context, user lifecycle management is about onboarding and managing the identity of employees who need access to corporate systems. For consumer-facing businesses, customer identity and access management (CIAM) is just as critical. And, this is why I’m so
For businesses around the world, 2020 was a year of change and disruption for reasons that go beyond the pandemic: ransomware was on the rise in a big way and underwent more change and innovation in 2020 than it had in a decade. Double extortion, third-party attacks, and DDoS techniques emerged, pushing ransomware even further
ThreatLabZ Ransomware Review: The Advent of Double Extortion Read More »
This marks the fourth edition of the Modern Bank Heists report, which annually takes the pulse of some of the financial industry’s top CISOs and security leaders. Thank you, again, for reading along, and thank you to the 126 security leaders who participated in this year’s study. 48 percent of the financial institutions (FIs) are
Cybercriminals have always been opportunists, and the 2020 COVID-19 pandemic offered more proof of this than perhaps any other event before it. Threat actors are becoming more powerful, more aggressive and more numerous, increasingly abandoning the tendency to look for the biggest quarry in favor of attacking the least defended. And 2020 was rife with
Foreword In January 2016, a new financially motivated threat actor group made its debut. Dubbed FIN8, this group is known to have used a diverse array of techniques, from spear-phishing to zero-day exploits in Windows, to infect retail, hospitality and entertainment companies and steal payment card data from POS systems. The FIN8 group uses, among
UNPRECEDENTED GLOBAL CHANGE CREATES NEW OPPORTUNITIES FOR CYBERCRIMINALS During a year of irrevocable change, cybercriminals have remained consistent. Looking for new opportunities, isolating targets that will deliver the most lucrative gains, and heaping additional pressure on global businesses that were forced to adapt and evolve in the face of unprecedented demand. Several new lines of
INTRODUCTION THE SECURITY IMPLICATIONS OF A CONNECTED WORLD To go forward sometimes we need to look back in time. In 2017, the NotPetya cyberattack temporarily crippled the shipping industry and many global organizations. It also revealed the depth of interdependence between global information systems. The attack started from a single stack of servers responsible for
Lessons Learned Investigating SUNBURST Software Supply Chain Attack Read More »
Foreword Welcome to the Q4 2020 issue of the ESET Threat Report! 2020 was many things (“typical” not being one of them), and it sure feels good to be writing about it in the past tense. As if really trying to prove a point, the pandemic picked up new steam in the last quarter, bringing
