/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

@esetresearch

@esetresearch
17 posts
2024-11-29
#ESETresearch reveals the first Linux UEFI bootkit, Bootkitty. It disables kernel signature verification and preloads two ELFs unknown during our analysis. Also discovered, a possibly related unsigned LKM - both were uploaded to VT early this month. https://www.welivesecurity.com/ ... 1/5
2024-11-29 View on X
BleepingComputer

ESET researchers find the first UEFI bootkit designed specifically to target Linux systems, marking a shift in bootkits that previously focused on Windows

Article then proceeds to describe a toy GRUB wrapper bootkit that has nothing to do with UEFI firmware (other than running on UEFI systems like any other UEFI bootloader), does not...

Proof of concept or not, Bootkitty is an interesting progression, breaking the belief that modern UEFI bootkits are Windows-only threats. To find out more, read our WLS blogpost! IoCs available on our GitHub: https://github.com/...... 5/5 [image]
2024-11-29 View on X
BleepingComputer

ESET researchers find the first UEFI bootkit designed specifically to target Linux systems, marking a shift in bootkits that previously focused on Windows

Article then proceeds to describe a toy GRUB wrapper bootkit that has nothing to do with UEFI firmware (other than running on UEFI systems like any other UEFI bootloader), does not...

Bootkitty supports only a few Ubuntu versions due to hardcoded byte patterns and how it patches the Linux kernel at hardcoded offsets. We successfully tested it on Ubuntu 24.04.1 LTS running the official kernel image package linux-image-6.8.0-44-generic. 3/5 [image]
2024-11-29 View on X
BleepingComputer

ESET researchers find the first UEFI bootkit designed specifically to target Linux systems, marking a shift in bootkits that previously focused on Windows

Article then proceeds to describe a toy GRUB wrapper bootkit that has nothing to do with UEFI firmware (other than running on UEFI systems like any other UEFI bootloader), does not...

The bootkit file contains multiple artifacts suggesting we might be dealing with a proof of concept instead of actively used malware, including ASCII art with the bootkit's name. 2/5 [image]
2024-11-29 View on X
BleepingComputer

ESET researchers find the first UEFI bootkit designed specifically to target Linux systems, marking a shift in bootkits that previously focused on Windows

Article then proceeds to describe a toy GRUB wrapper bootkit that has nothing to do with UEFI firmware (other than running on UEFI systems like any other UEFI bootloader), does not...

2023-10-26
We notified @roundcube developers on October 14 and they very quickly patched the vulnerability. It affects versions 1.4.x before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 and can be triggered remotely by sending a specially crafted email message. 2/4
2023-10-26 View on X
WeLiveSecurity

Pro-Russia hacking group Winter Vivern is targeting European governmental entities' Roundcube Webmail servers, triggering an attack when an email is viewed

ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible

#ESETResearch discovered a zero-day XSS vulnerability (#CVE-2023-5631) in Roundcube Webmail servers. It is actively used in the wild by #WinterVivern to target governments and a think tank in Europe. The exploit was contained in a legitimate-looking email about Outlook. 1/4 [image]
2023-10-26 View on X
WeLiveSecurity

Pro-Russia hacking group Winter Vivern is targeting European governmental entities' Roundcube Webmail servers, triggering an attack when an email is viewed

ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible

2023-04-22
#ESETResearch confirms Lazarus is linked to the recent #3CX supply-chain attacks. Based on code similarities and network infrastructure, we connect the 3CX incident with a Linux case of DreamJob, a long-term Lazarus operation using job offer as lures. 1/6 https://www.welivesecurity.com/ ...
2023-04-22 View on X
Wired

Mandiant says the North Korea-linked hack of VoIP company 3CX's customers is the first confirmed incident of one software-supply-chain attack enabling another

perhaps the first confirmed case of one software supply chain attack causing another. https://www.wired.com/... Kim Zetter / @kimzetter : I've updated story about 3XC/X_Trader with...

2023-03-02
#ESETResearch analyze first in-the-wild UEFI bootkit bypassing UEFI Secure Boot even on fully updated Windows 11 systems. Its functionality indicates it is the #BlackLotus UEFI bootkit, for sale on hacking forums since at least Oct 6, 2022. @smolar_m https://www.welivesecurity.com/ ... 1/11
2023-03-02 View on X
WeLiveSecurity

Researchers detail UEFI bootkit BlackLotus, capable of bypassing UEFI Secure Boot even on up-to-date Windows 11 systems and selling for $5K since October 2022

The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality

2022-02-26
Breaking. #ESETResearch discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n
2022-02-26 View on X
Washington Post

Researchers say they realized Russia had invaded Ukraine hours before the news broke thanks to Google Maps traffic info and a SAR satellite image of troops

It was 3:15 a.m. in Belgorod, Russia — much too early for a traffic jam, thought Jeffrey Lewis, who was watching the traffic pileup on Google Maps.

2022-02-25
Breaking. #ESETResearch discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n
2022-02-25 View on X
Reuters

Sources: Ukraine is asking for volunteers from its hacker community to protect critical infrastructure and conduct cyber spying missions against Russian troops

The government of Ukraine is asking for volunteers from the country's hacker underground to help protect critical infrastructure …

Breaking. #ESETResearch discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n
2022-02-25 View on X
ZDNet

DDoS attacks disrupt several Ukrainian government sites; ESET researchers discover new data wiper malware installed on hundreds of Ukrainian machines

here's what you need to know NetBlocks : Internet disruptions registered as Russia moves in on Ukraine Andy Greenberg / Wired : Russia's Sandworm Hackers Have Built a Botnet of Fir...

2022-02-24
Breaking. #ESETResearch discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n
2022-02-24 View on X
ZDNet

Several Ukrainian government sites have been disrupted by DDoS attacks; researchers discover new data wiper malware installed on hundreds of Ukrainian machines

Cloudflare said the attack was “relatively modest compared to large DDoS attacks we've handled in the past.”

2022-01-18
The #WhisperGate malware discovered by Microsoft contains MSIL stub commonly used by commodity e-crime malware. We observed samples using the same stub that drop different malware families such as Remcos RAT, FormBook and others. #ESETresearch 1/5 https://twitter.com/... https://twitter.com/...
2022-01-18 View on X
Financial Times

Ukraine's digital transformation ministry says “all evidence points to Russia being behind the attack”, which took down about 70 government websites

Max Seddon / Financial Times :

2021-11-17
#ESETResearch unveils a large watering hole campaign targeting 20+ high-profile websites linked to the Middle East. We link that campaign to a likely customer of Candiru, a private spyware firm recently added to the @CommerceGov Entity List. https://www.welivesecurity.com/ ... 1/4
2021-11-17 View on X
VICE

Israeli spyware vendor Candiru, recently blacklisted by the US, waged “watering hole” attacks on UK and Middle East websites critical of Saudi Arabia and others

Lorenzo Franceschi-Bicchierai / VICE :

2021-07-05
#ESETresearch responded to ransomware deployed as supply-chain attack against #Kaseya VSA users attributed to #REvil beginning Friday afternoon EDT (US)/evening CEST (Europe). Detection was added for Win32/Filecoder.Sodinokibi.N on Friday shortly after.https://www.welivesecurity.com/ ... 1/3 https://twitter.com/...
2021-07-05 View on X
The Record

In a post on the REvil dark web blog, the gang takes credit for the Kaseya attack, claims it infected 1M+ systems, and demands $70M in bitcoin for the decryptor

The REvil ransomware gang is asking for a $70 million ransom payment to publish a universal decryptor that can unlock …

#ESETresearch responded to ransomware deployed as supply-chain attack against #Kaseya VSA users attributed to #REvil beginning Friday afternoon EDT (US)/evening CEST (Europe). Detection was added for Win32/Filecoder.Sodinokibi.N on Friday shortly after.https://www.welivesecurity.com/ ... 1/3 https://twitter.com/...
2021-07-05 View on X
Reuters

President Biden says he has directed US intelligence agencies to investigate the Kaseya ransomware attack and adds “we're not certain” who is behind the attack

Trevor Hunnicutt / Reuters :

2020-12-03
#ESETresearch discovered a new backdoor used by #Turla to exfiltrate stolen documents to Dropbox. Named Crutch by its developers, we were able to attribute it to the Turla APT group thanks to several similarities with #Gazer/#WhiteBear. @matthieu_faou 1/4 https://www.welivesecurity.com/ ...
2020-12-03 View on X
BleepingComputer

ESET researchers detail Crutch malware, used by Russian APT Turla to steal sensitive docs from an EU foreign ministry and exfiltrate them via Dropbox accounts

Russian-backed hacking group Turla has used a previously undocumented malware toolset to deploy backdoors and steal sensitive documents …