DOCSLIB.ORG

ESET THREAT REPORT Q2 2020 | 2 ESET Researchers Reveal the Modus Operandi of the Elusive Invisimole Group, Including Newly Discovered Ties with the Gamaredon Group

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
ESET THREAT REPORT Q2 2020 | 2 ESET Researchers Reveal the Modus Operandi of the Elusive Invisimole Group, Including Newly Discovered Ties with the Gamaredon Group THREAT REPORT Q2 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contents Foreword Welcome to the Q2 2020 issue of the ESET Threat Report! 3 FEATURED STORY With half a year passed from the outbreak of COVID-19, the world is now trying to come 5 NEWS FROM THE LAB to terms with the new normal. But even with the initial panic settled, and many countries easing up on their lockdown restrictions, cyberattacks exploiting the pandemic showed no 8 APT GROUP ACTIVITY sign of slowing down in Q2 2020. Our specialists saw a continued influx of COVID-19 lures in web and email attacks, with fraudsters trying to make the most out of the crisis. ESET telemetry also showed a spike 14 STATISTICS & TRENDS in phishing emails targeting online shoppers by impersonating one of the world’s leading package delivery services — a tenfold increase compared to Q1. The rise in attacks target- 15 Top 10 malware detections ing Remote Desktop Protocol (RDP) — the security of which still often remains neglected — continued in Q2, with persistent attempts to establish RDP connections more than doubling 16 Downloaders since the beginning of the year. 17 Banking malware One of the most rapidly developing areas in Q2 was the ransomware scene, with some operators abandoning the — still quite new — trend of doxing and random data leaking, 18 Ransomware and moving to auctioning the stolen data on dedicated underground sites, and even forming “cartels” to attract more buyers. 20 Cryptominers Ransomware also made an appearance on the Android platform, targeting Canada under the 21 Spyware & backdoors guise of a COVID-19 tracing app. ESET researchers quickly put a halt to this campaign and provided a decryptor for victims. Among many other findings, our researchers: uncovered 22 Exploits Operation In(ter)ception, which targeted high-profile aerospace and military companies; revealed the modus operandi of the elusive InvisiMole group; and dissected Ramsay, 23 Mac threats a cyberespionage toolkit targeting air-gapped networks. 24 Android threats Besides offering recaps of these findings, this report also brings exclusive, previously unpublished ESET research updates, with a special focus on APT group operations — see 25 Web threats the News From the Lab and APT Group Activity sections! 27 Email threats Throughout the first half of 2020, ESET has also actively contributed to the MITRE ATT&CK knowledge base in its newly released, revamped version with sub-techniques. The latest 29 IoT security ATT&CK update includes four new ESET contributions. And finally, after a break, this quarter has seen new conference plans take shape — 30 ESET RESEARCH CONTRIBUTIONS although with packed venues replaced by virtual streams — and we are excited to invite you to ESET’s talks and workshops at BlackHat USA, BlackHat Asia, VB2020 and others. Happy reading, stay safe — and stay healthy! Roman Kovác, Chief Research Officer ESET THREAT REPORT Q2 2020 | 2 ESET researchers reveal the modus operandi of the elusive InvisiMole group, including newly discovered ties with the Gamaredon group. The InvisiMole Group is a threat actor InvisiMole’s toolset operating since at least 2013, whose malware was first reported by ESET [1] ESET telemetry suggests that the in 2018 in connection with targeted attackers were actively developing cyberespionage operations in Ukraine their malware throughout the campaign, and Russia. redesigning and recompiling its compo- nents, as well as introducing new ones. We previously documented the group’s two feature-rich backdoors, RC2CL and For example, we found several versions RC2FM, that provide extensive espionage of InvisiMole’s loader and RC2FM back- capabilities such as recording from the door, with one of the samples apparently victims’ webcam and microphone, tracking freshly compiled before being deployed the victims’ geolocation, and collecting and detected by ESET. FEATURED recently accessed documents. We also observed that, later in the However, little was known about the rest operation, the attackers abandoned the of the group’s tactics, techniques and use of the PE format for their files, in procedures (TTPs). an attempt to avoid detection. As for the newly introduced components, we discov- In late 2019, InvisiMole resurfaced ered a previously unreported TCP down- with an updated toolset, targeting a loader and a DNS downloader, the latter few high-profile organizations in the using DNS tunneling to communicate with STORY the C&C server. military sector and diplomatic missions, both in Eastern Europe. Overall, the campaign is characterized ESET researchers investigated these by long execution chains with multiple attacks in cooperation with the affected layers of per-victim encryption, making organizations and were able to uncover it difficult to reconstruct the attack. the extensive, sophisticated toolset In these execution chains, the attack- used for delivery, lateral movement and ers used several interesting living off — execution of InvisiMole’s backdoors the land techniques — they abused legiti- the missing pieces of the puzzle in our mate applications (also called living off previous research. the land binaries or LOLBins [3]) to exe- The investigation also led us to reveal cute their own code, set up persistence, Digging up InvisiMole’s previously unknown cooperation between perform lateral movement and other the InvisiMole Group and Gamaredon [2], a operations, aiming to bypass application hidden arsenal highly active threat group also operating whitelisting and fly under the radar. since at least 2013, and mainly targeting Furthermore, we found that InvisiMole Zuzana Hromcová and Anton Cherepanov Ukrainian institutions. delivers vulnerable executables to ESET THREAT REPORT Q2 2020 | 3 compromised computers and exploits them for covert code Execution guardrails execution and long-term persistence. InvisiMole uses a Windows feature called Data Protection browsers, is abused by InvisiMole to protect its payload The attackers brought a vulnerable speedfan.sys driver API (DPAPI) to place execution guardrails and encrypt the from security researchers. Even if they find InvisiMole’s onto a compromised computer, exploiting it in order to payloads individually per-victim, specifically: components in telemetry or on malware sharing platforms, inject InvisiMole into a legitimate process from kernel they can’t decrypt them outside the victim’s computer. mode. This technique was used previously, for example, • the CryptProtectData API for data encryption by the Slingshot APT [4] and has been referred to as • the CryptUnprotectData API for data decryption However, thanks to direct cooperation with the affected Bring Your Own Vulnerable Driver [5] (BYOVD) by fellow organizations, we were able to recover the payloads and This symmetric encryption scheme uses a key derived researchers. reconstruct four of InvisiMole’s execution chains. from the user’s login secrets, so the decryption must Besides the driver, the attackers delivered a vulnerable be performed on the same computer where the data was Acknowledgements to fellow ESET researchers Matthieu Faou, Windows component from Windows XP and exploited its in- encrypted. Ladislav Janko and Michal Poslušný for their work on this investigation. put validation vulnerability, or a vulnerable third-party The DPAPI feature, intended for local storage of creden- software package and exploited its stack overflow vulner- tials such as Wi-Fi passwords or login passwords in web WeLiveSecurity blogpost [6] | White paper [7] ability — a technique we named Bring Your Own Vulnerable Software (BYOVS). Stage Stage Stage Stage For lateral movement, we observed that the InvisiMole Group steals documents or software installers from the Control Panel misuse chain compromised organization, and replaces them in the orig- LNK JS inal locations with their own trojanized versions, or uses Startup folder LNK file JS script Control shellcode EternalBlue and BlueKeep exploits to spread to vulnerable Panel loader hosts within the network. Stage Stage TCP SMInit downloader Cooperation between InvisiMole and exploit chain Gamaredon Scheduled task Total Video shellcode During our investigation, we discovered that InvisiMole is Player loader delivered to the compromised systems by a .NET downloader Stage Stage Stage Stage Stage Stage detected by ESET products as MSIL/Pterodo, the work of Speedfan RCCL the Gamaredon group. Gamaredon malware is usually dis- exploit chain backdoor tributed through spearphishing emails and used to move laterally as far as possible within the target’s network, Service srvanyng winapiexec shellcode driver kernel mode shellcode loader exploit inject loader while fingerprinting the machines. Stage Stage Stage Stage Stage Our research now shows Gamaredon is used to pave the way DNS downloader for a far stealthier payload — according to our telemetry, Wdigest a small number of Gamaredon’s targets are “upgraded” exploit chain to the advanced InvisiMole malware, likely those deemed Scheduled task setupSNK wdigest shellcode user mode shellcode particularly significant by the attackers. loader inject loader ??? InvisiMole’s execution chains; padlocks indicate use of per-machine encryption ESET THREAT REPORT Q2 2020 | 4 IoT Serious flaws found in multiple smart home hubs ESET researchers found numerous serious security vulnerabilities in three different home hubs — Fibaro Home Center Lite, Homematic Central Control Unit (CCU2) and eLAN-RF-003. These devices are used to monitor and control smart homes and other
Load more

Recommended publications
  • Ransom Where?
    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
    [Show full text]
  • Minimizing the Risk of Ransomware
    Minimizing the Impact of Ransomware Authors: Tushar Nandwana, OneBeacon Technology Risk Control and Joe Budzyn – OneBeacon Insurance Group Published: July 2018 1 Ransomware has featured prominently in the news over the last few years. Ransomware – Hospitals, municipalities, businesses, law enforcement agencies, individuals and A Growing Threat even entire regions of the world have been affected by it. Some have paid the ransom and recovered their computer data; others have lost their data forever. In March 2018, the city of Atlanta, Georgia was hit by SamSam ransomware which prevented city residents from paying their bills and accessing court information online. The demand was for $51,000 but it ultimately cost the city several million dollars from other costs to rectify. SamSam also infected the Colorado Department of Transportation twice in February 2018. Numerous other U.S. municipalities and healthcare organizations have been hit by this ransomware2. WannaCry wreaked havoc on the world in May 2017. With its worm‐like, self‐ propagating behaviour, it spread to thousands of systems within hours using the Eternal Blue exploit to target Windows machines. WannaCry resulted in an estimated $4B in economic losses to the affected businesses and infected 30,000 machines worldwide3. In June 2017 we also saw Petya and NotPetya which used the same exploit as WannaCry, but were more intent on destruction rather than ransom. NotPetya targeted systems specifically in the Ukraine4. FedEx ended up reporting a $300M loss, not from the ransom payout but due to the downtime and economic loss sustained by its Ukrainian subsidiary, TNT Express5. Petya caused Danish shipping giant AP Moller $300M in lost revenue6.
    [Show full text]
  • Automatic Classifying of Mac OS X Samples
    Automatic Classifying of Mac OS X Samples Spencer Hsieh, Pin Wu and Haoping Liu Trend Micro Inc., Taiwan TREND MICRO LEGAL DISCLAIMER The information provided herein is for general information Contents and educational purposes only. It is not intended and should not be construed to constitute legal advice. The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be relied on or acted 4 upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing Introduction herein should be construed otherwise. Trend Micro reserves the right to modify the contents of this document at any time without prior notice. Translations of any material into other languages are intended solely as a convenience. Translation accuracy 6 is not guaranteed nor implied. If any questions arise related to the accuracy of a translation, please refer to Mac OS X Samples Dataset the original language official version of the document. Any discrepancies or differences created in the translation are not binding and have no legal effect for compliance or enforcement purposes. 10 Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any kind as Classification of Mach-O Files to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk. Trend Micro disclaims all warranties of any kind, express or implied. 11 Neither Trend Micro nor any party involved in creating, producing, or delivering this document shall be liable for any consequence, loss, or damage, including direct, Malware Families indirect, special, consequential, loss of business profits, or special damages, whatsoever arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content 15 thereof.
    [Show full text]
  • Hacking Healthcare Petya
    Hacking Healthcare Welcome to the first edition of Hacking Healthcare, NH-ISAC’s new weekly newsletter designed to guide you through the week in healthcare cybersecurity and policy. Every Wednesday, Hacking Healthcare, will bring you analysis on the latest news stories, policy developments, reports, and public remarks that impact the cybersecurity practitioner across all the different healthcare industries. We have our views on what matters, but we also want to reflect your interests – so get in touch and let the Hacking Healthcare team know what you want to see. Here we go… This is the public version of the Hacking Healthcare newsletter. For additional in-depth analysis and opinion, become a member of the NH-ISAC. Petya (aka GoldenEye, NotPetya) For the second time in as many months, a ransomware attack is snaking its way around the globe. It appears that the attack started in Ukraine and has much of its impact in Europe. But there are reports that U.S. entities have also been infected, including at least 1 U.S. hospital. Some researchers have reported that the malware resembles Petya or GoldenEye, or maybe an off-spring of one of these variants. We’ll call it Petya for now since that is the standard that NH-ISAC has adopted. Regardless of its lineage, the malware used in the current attack does seem to be relying on the ETERNALBLUE exploit to gain initial network access. Installing all of the latest Microsoft updates for the related vulnerabilitiesseems like a good first step in response. The NH-ISAC is working hard to gather and share further information on this attack and will keep its members informed through their incident- specific blog and AMBER list-serve.
    [Show full text]
  • Enisa Etl2020
    EN From January 2019 to April 2020 Spam ENISA Threat Landscape Overview The first spam message was sent in 1978 by a marketing manager to 393 people via ARPANET. It was an advertising campaign for a new product from the company he worked for, the Digital Equipment Corporation. For those first 393 spammed people it was as annoying as it would be today, regardless of the novelty of the idea.1 Receiving spam is an inconvenience, but it may also create an opportunity for a malicious actor to steal personal information or install malware.2 Spam consists of sending unsolicited messages in bulk. It is considered a cybersecurity threat when used as an attack vector to distribute or enable other threats. Another noteworthy aspect is how spam may sometimes be confused or misclassified as a phishing campaign. The main difference between the two is the fact that phishing is a targeted action using social engineering tactics, actively aiming to steal users’ data. In contrast spam is a tactic for sending unsolicited e-mails to a bulk list. Phishing campaigns can use spam tactics to distribute messages while spam can link the user to a compromised website to install malware and steal personal data. Spam campaigns, during these last 41 years have taken advantage of many popular global social and sports events such as UEFA Europa League Final, US Open, among others. Even so, nothing compared with the spam activity seen this year with the COVID-19 pandemic.8 2 __Findings 85%_of all e-mails exchanged in April 2019 were spam, a 15-month high1 14_million
    [Show full text]
  • View Final Report (PDF)
    TABLE OF CONTENTS TABLE OF CONTENTS I EXECUTIVE SUMMARY III INTRODUCTION 1 GENESIS OF THE PROJECT 1 RESEARCH QUESTIONS 1 INDUSTRY SITUATION 2 METHODOLOGY 3 GENERAL COMMENTS ON INTERVIEWS 5 APT1 (CHINA) 6 SUMMARY 7 THE GROUP 7 TIMELINE 7 TYPOLOGY OF ATTACKS 9 DISCLOSURE EVENTS 9 APT10 (CHINA) 13 INTRODUCTION 14 THE GROUP 14 TIMELINE 15 TYPOLOGY OF ATTACKS 16 DISCLOSURE EVENTS 18 COBALT (CRIMINAL GROUP) 22 INTRODUCTION 23 THE GROUP 23 TIMELINE 25 TYPOLOGY OF ATTACKS 27 DISCLOSURE EVENTS 30 APT33 (IRAN) 33 INTRODUCTION 34 THE GROUP 34 TIMELINE 35 TYPOLOGY OF ATTACKS 37 DISCLOSURE EVENTS 38 APT34 (IRAN) 41 INTRODUCTION 42 THE GROUP 42 SIPA Capstone 2020 i The Impact of Information Disclosures on APT Operations TIMELINE 43 TYPOLOGY OF ATTACKS 44 DISCLOSURE EVENTS 48 APT38 (NORTH KOREA) 52 INTRODUCTION 53 THE GROUP 53 TIMELINE 55 TYPOLOGY OF ATTACKS 59 DISCLOSURE EVENTS 61 APT28 (RUSSIA) 65 INTRODUCTION 66 THE GROUP 66 TIMELINE 66 TYPOLOGY OF ATTACKS 69 DISCLOSURE EVENTS 71 APT29 (RUSSIA) 74 INTRODUCTION 75 THE GROUP 75 TIMELINE 76 TYPOLOGY OF ATTACKS 79 DISCLOSURE EVENTS 81 COMPARISON AND ANALYSIS 84 DIFFERENCES BETWEEN ACTOR RESPONSE 84 CONTRIBUTING FACTORS TO SIMILARITIES AND DIFFERENCES 86 MEASURING THE SUCCESS OF DISCLOSURES 90 IMPLICATIONS OF OUR RESEARCH 92 FOR PERSISTENT ENGAGEMENT AND FORWARD DEFENSE 92 FOR PRIVATE CYBERSECURITY VENDORS 96 FOR THE FINANCIAL SECTOR 96 ROOM FOR FURTHER RESEARCH 97 ACKNOWLEDGEMENTS 98 ABOUT THE TEAM 99 SIPA Capstone 2020 ii The Impact of Information Disclosures on APT Operations EXECUTIVE SUMMARY This project was completed to fulfill the including the scope of the disclosure and capstone requirement for Columbia Uni- the disclosing actor.
    [Show full text]
  • Security – a Midlife Crisis 02/12/19 What Constitutes a Security Midlife Crisis? History of Technology and Threats
    Security – A midlife crisis 02/12/19 What constitutes a security midlife crisis? History of technology and threats 2005 – 2006 Identify theft (phishing) 2003 – 2004 Advanced worm/Trojan (“I love you”) 2007 – 2008 2000 1995 Organized crime Malicious (data theft) 1980s Breaking code Viruses websites (Melissa) 2009 – today Sophisticated targeted attacks Petya/ Non-Petya Meltdown/ Slammer Stuxnet Spectre Advanced For-profit Viruses and worms persistent Targeted attacks malware threats Mainframe Client / server Client / cloud You know the challenge – breaches are increasing World’s largest data breaches and hacks 2009 – 2014 2015 – 2019 2014 Latest 2019 2013 2018 2012 2017 2011 2016 2010 2015 2009 Source: http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ Sept 26 – Food delivery service gets hacked • Affected users: 4.9 million • Industry or type: restaurant • Cause of breach: hack DoorDash learned in September that an unauthorized third party was able to access its user data on May 4, 2019. Many of the food delivery app’s users were affected, totaling almost 5 million. The hack affected only those people who joined before April 5, 2018. The hacker was able to access the following information: • Profile information • Names • Email addresses • Delivery addresses • Order history • Phone numbers • Passwords (hashed and salted) • Last four digits of payment cards (for consumers) • Last four digits of bank accounts (for Dashers and merchants) • Driver’s license numbers (for roughly 100,000 Dashers) July 30 – Largest banking data breach • Affected users: 100 million • Industry or type: banking and finance • Cause of breach: hack Capital One, the major US banking institution, suffered possibly the largest banking data breach in history.
    [Show full text]
  • Reporte De Amenazas De ESET Q3
    INFORME DE AMENAZAS TERCER TRIMESTRE 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contenido Prólogo ¡Bienvenido a la edición del Informe de Amenazas de ESET del tercer 3 HISTORIA DESTACADA trimestre de 2020! Mientras el hemisferio norte se prepara para pasar un invierno azotado por la pandemia, el COVID-19 parece es- 5 NOTICIAS DEL LABORATORIO tar perdiendo fuerza, al menos en el ámbito del cibercrimen. Como la táctica de usar señuelos relacionados con el coronavirus ya no tiene el impacto deseado, los delincuentes parecen haber “vuelto a los modelos clásicos” durante el tercer trimestre de 2020. Sin embargo, hay un área donde persisten los efectos de la pandemia: en el 9 ACTIVIDAD DE GRUPOS DE APT trabajo remoto, con sus numerosos desafíos de seguridad. Esto es especialmente cierto para los ataques dirigidos al Protocolo de Escritorio Remoto (RDP), que crecieron 13 ESTADÍSTICAS Y TENDENCIAS durante todo el primer semestre. En el tercer trimestre, los intentos de ataques al RDP considerando el número de clientes únicos apuntados, aumentaron un 37%. Es probable que el aumento se deba al creciente número de 14 Las 10 principales detecciones de malware sistemas mal protegidos que se fueron conectando a Internet durante la pandemia, y quizá también a que otros delincuentes se inspiraron en las bandas de ransomware y comenzaron a atacar el protocolo RDP. 15 Downloaders La escena del ransomware, seguida de cerca por los especialistas de ESET, tuvo consecuencias inéditas este tri- mestre. Por ejemplo, el ataque de ransomware investigado como homicidio tras la muerte de un paciente porque 17 Malware bancario su hospital quedó inhabilitado.
    [Show full text]
  • Malware List.Numbers
    CLASS A - Tested once a month (and as significant updates and samples are available) (95% or higher detection rate) CLASS B - Tested every two months (and if many new samples or significant updates are available) (95 - 85% detection rate) CLASS C - Tested every three months (85-75% detection rate) CLASS D - Tested every six months (75% or lower detection rates) For Comparison, not an actual Antivirus CLASS F - Excluded from future testing (read notes) Notes, comments, remarks, FAQ and everything else. McAfee Endpoint Protection for Malware Family (by year) # Malware Sample Type MD5 Hash Avast 9.0 Intego VirusBarrier X8 10.8 Norman 3.0.7664 ESET 6.0 Sophos 9 F-Secure 1.0 Kaspersky Security 14 G Data AntiVirus for Mac Dr Web 9.0.0 Avira ClamXav 2.6.4 (web version) Norton 12.6 (26) Comodo Webroot 8 Thirtyseven4 Total Security eScan 5.5-7 iAntivirus 1.1.4 (282) ProtectMac 1.3.2 - 1.4 BitDefender 2.30 - 3.0.6681 McAfee Internet Security for Mac* AVG AntiVirus for Mac Dr Web Light 6.0.6 (201207050) Max Secure Antivirus MacBooster X-Protect Gatekeeper Intego VirusBarrier 2013 10.7 Intego VirusBarrier X6 VirusBarrier Express 1.1.6 (79) Panda Antivirus 1.6 Bitdefender (App Store) 2.21 MacKeeper 2.5.1 - 2.8 (476) Panda Antivirus 10.7.6 Trend Micro Titanium 3.0 McAfee Security 1.2.0 (1549) Norton 11.1.1 (2) Trend Micro Smart Sur. 1.6.1101 McAfee VirusScan for Mac 8.6.1 FortiClient 5.0.6.131 Quick Heal Total Sec 1.0 MacScan 2.9.4 McAfee Virex 7.7 (163) Magician 1.4.3 Vipre 1.0.51 Mac Malware Remover 1.1.6 MD5 Hash Mac 1 Price -> Free $39.99 (Internet
    [Show full text]
  • 2020 Trends & 2021 Outlook
    2020 trends w/ & 2021 outlook THREAT REPORT Q4 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contents 3 FOREWORD 4 FEATURED STORY 7 NEWS FROM THE LAB 9 APT GROUP ACTIVITY 15 STATISTICS & TRENDS 16 Top 10 malware detections 17 Downloaders 19 Banking malware 21 Ransomware 23 Cryptominers 25 Spyware & backdoors 27 Exploits 29 Mac threats 31 Android threats 33 Web threats 35 Email threats 38 IoT security 40 ESET RESEARCH CONTRIBUTIONS ESET THREAT REPORT Q4 2020 | 2 Foreword Welcome to the Q4 2020 issue of the ESET Threat Report! 2020 was many things (“typical” not being one of them), and it sure feels good to be writing The growth of ransomware might have been an important factor in the decline of banking about it in the past tense. malware; a decline that only intensified over the last quarter of the year. Ransomware and other malicious activities are simply more profitable than banking malware, the operators of As if really trying to prove a point, the pandemic picked up new steam in the last quarter, which already have to grapple with the heightening security in the banking sector. There was, bringing the largest waves of infections and further lockdowns around the world. Amid the — however, one exception to this trend: Android banking malware registered the highest detection chaos, the long-anticipated vaccine rollouts brought a collective sigh of relief or, at least, levels of 2020 in Q4, fueled by the source code leak of the trojan Cerberus. a glimmer of hope somewhere in the not-too-far-distant future. With the pandemic creating fertile ground for all kinds of malicious activities, it is all but In cyberspace, events also took a dramatic turn towards the end of the year, as news of the obvious that email scammers would not want to be left out.
    [Show full text]
  • The Cyber Threat to UK Business 2016/2017 Report Page 1
    The cyber threat to UK business 2016/2017 Report Page 1 Contents Foreword (Ciaran Martin - NCSC) ..................................................................................................................................... 2 Foreword (Donald Toon - NCA) ........................................................................................................................................ 3 Executive summary ........................................................................................................................................................... 4 What is the threat? ........................................................................................................................................................... 5 The year in review: pivotal incidents of 2016 ................................................................................................................ 10 Horizon scanning: future threats .................................................................................................................................... 13 Fighting back: what can business do? ............................................................................................................................ 15 Case studies illustrating UK LEA and industry joint protect work ................................................................................. 19 Debate: can we stop the Internet from being used for crime? .................................................................................... 20 Page 2 The
    [Show full text]
  • ESET THREAT REPORT Q3 2020 | 2 ESET Researchers Reveal That Bugs Similar to Krøøk Affect More Chip Brands Than Previously Thought
    THREAT REPORT Q3 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contents Foreword Welcome to the Q3 2020 issue of the ESET Threat Report! 3 FEATURED STORY As the world braces for a pandemic-ridden winter, COVID-19 appears to be losing steam at least in the cybercrime arena. With coronavirus-related lures played out, crooks seem to 5 NEWS FROM THE LAB have gone “back to basics” in Q3 2020. An area where the effects of the pandemic persist, however, is remote work with its many security challenges. 9 APT GROUP ACTIVITY This is especially true for attacks targeting Remote Desktop Protocol (RDP), which grew throughout all H1. In Q3, RDP attack attempts climbed by a further 37% in terms of unique 13 STATISTICS & TRENDS clients targeted — likely a result of the growing number of poorly secured systems connected to the internet during the pandemic, and possibly other criminals taking inspiration from 14 Top 10 malware detections ransomware gangs in targeting RDP. 15 Downloaders The ransomware scene, closely tracked by ESET specialists, saw a first this quarter — an attack investigated as a homicide after the death of a patient at a ransomware-struck 17 Banking malware hospital. Another surprising twist was the revival of cryptominers, which had been declining for seven consecutive quarters. There was a lot more happening in Q3: Emotet returning 18 Ransomware to the scene, Android banking malware surging, new waves of emails impersonating major delivery and logistics companies…. 20 Cryptominers This quarter’s research findings were equally as rich, with ESET researchers: uncovering 21 Spyware & backdoors more Wi-Fi chips vulnerable to KrØØk-like bugs, exposing Mac malware bundled with a cryptocurrency trading application, discovering CDRThief targeting Linux VoIP softswitches, 22 Exploits and delving into KryptoCibule, a triple threat in regard to cryptocurrencies.
    [Show full text]