(eset):research;

Research has been at the core of ESET and its technology since the company's inception. The journey began in 1987, when ESET co-founders Miroslav Trnka and Peter Paško uncovered one of the world's first computer viruses, which they named "Vienna" and wrote a program to detect it. Many other discoveries quickly followed.

More than 30 years later, ESET remains at the forefront of cybersecurity research, operating 13 R&D centers across the world that analyze, monitor and anticipate new threats. In recent years alone, ESET researchers have made a number of significant discoveries that shed light on various malicious campaigns orchestrated by the world’s most advanced threat actors. They have also identified multiple high-impact vulnerabilities in third-party products and services.

Over the years, ESET’s experts have assisted law enforcement with disruptions of several notorious cybercrime operations. They also frequently present at leading industry conferences and are among the most referenced contributors to the MITRE ATT&CK® knowledge base of adversary tactics and techniques.

@ESETresearch | ESET GitHub | ESET Coordinated Vulnerability Disclosure Policy


2230 articles

Malware

Operation Hangover: more links to the Oslo Freedom Forum incident

Operation Hangover: more links to the Oslo Freedom Forum incident

Malware

Operation Hangover: more links to the Oslo Freedom Forum incident

In our previous post on Operation Hangover, we revealed the existence of an attack group, apparently operating from within India, who were mainly targeting systems in Pakistan. In this post, we will analyze the Mac OS X samples that have been linked to this group and will provide new evidence that the Mac and Windows spywares are related.

Jean-Ian Boutin05 Jun 2013


ESET Research

Tax returns: Slovakian spyware campaign

Tax returns: Slovakian spyware campaign

ESET Research

Tax returns: Slovakian spyware campaign

ESET’s Security Research Lab details a malware-spreading campaign leveraging the deadline for tax returns in Slovakia and examines a case of infection where a bank's two-factor authentication prevented financial loss.

Robert Lipovsky24 May 2013


ESET Research

Syndicasec in the sin bin: targeted espionage malware in action

Syndicasec in the sin bin: targeted espionage malware in action

ESET Research

Syndicasec in the sin bin: targeted espionage malware in action

Technical analysis of Win32/Syndicasec.A, malware active in Nepal and China as far back as 2010, with a JavaScript payload registered in the Windows WMI subsystem and a system of fake blogs to discover its C&C servers, hosted on Tibet-related domains.

Alexis Dorais-Joncas23 May 2013


ESET Research

Targeted information stealing attacks in South Asia use email, signed binaries

Targeted information stealing attacks in South Asia use email, signed binaries

ESET Research

Targeted information stealing attacks in South Asia use email, signed binaries

Detailed analysis of a targeted campaign that tries to steal sensitive information from different organizations throughout the world, but particularly in Pakistan.

Jean-Ian Boutin16 May 2013


ESET Research

Linux/Cdorked.A malware: Lighttpd and nginx web servers also affected

Linux/Cdorked.A malware: Lighttpd and nginx web servers also affected

ESET Research

Linux/Cdorked.A malware: Lighttpd and nginx web servers also affected

Some 400 web servers found infected with Linux/Cdorked.A. including 50 in Alexa’s top 100,000 websites. And this backdoor has been applied to Lighttpd and nginx binaries in addition to Apache.

Marc-Etienne M.Léveillé07 May 2013


Malware

The stealthiness of Linux/Cdorked: a clarification

The stealthiness of Linux/Cdorked: a clarification

Malware

The stealthiness of Linux/Cdorked: a clarification

We clarify that the Linux/Cdorked backdoor malware leaves no traces on the hard drive "other than its modified httpd binary" which can be scanned for detection in several ways.

Stephen Cobb02 May 2013


ESET Research

Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication

Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication

ESET Research

Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication

The mysterious Avatar rootkit, detected by ESET as Win32/Rootkit.Avatar, appears to reflect a heavy investment in code development, with an API and a SDK available, plus an interesting abuse of Yahoo Groups for C&C communications.

Aleksandr Matrosov and Anton Cherepanov01 May 2013


ESET Research

Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole

Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole

ESET Research

Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole

Analysis of a malicious backdoor serving Blackhole exploit pack found on Linux Apache webserver compromised by malware dubbed Linux/Cdorked.A, together with remediation tool and techniques.

Pierre-Marc Bureau26 Apr 2013


Malware

Is Gapz the most complex bootkit yet?

Is Gapz the most complex bootkit yet?

Malware

Is Gapz the most complex bootkit yet?

Introducing a detailed analysis of Win32/Gapz malware in a new white paper titled: Mind the Gapz: The most complex bootkit ever analyzed?

Aleksandr Matrosov08 Apr 2013