ESET Research

This is the first in a series of two blog posts on the malware family Win32/Boaxxe.BE whose end goal is to drive traffic to advertisement websites by using various click fraud techniques, and thus earn money from these websites as an “advertiser”.

The first sign we saw of this malware was in mid-May 2013, but it is still very active, and uses Android to bypass two-factor authentication systems. It clearly seeks to infect Dutch computers - 75% of detections come from this region.

In September we informed about a new banking trojan called Hesperbot (detected as Win32/Spy.Hesperbot). The perpetrators responsible for the threat are still active – November has been particularly eventful. In this post, we’ll give an update on the situation and malware developments.

Once in a while we get to spend time analyzing malicious code that is not as widespread as other threats we've encountered. Here we analyze a targeted attack used in Taiwan and Vietnam - but is this 'APT' really that advanced?

By the middle of May, users around the world started to receive messages from their contacts through different instant-messaging applications, such as Skype and Gtalk - an attack that showed off how age-old techniques can ensnare thousands of users. Here, we analyze this attack.

A new white paper, titled Windows 8.1 Security – New and Improved, looks at the some of the most anticipated—and controversial—security features of this new ".1" point release of Windows 8.

On November 2nd, 1988, the Morris worm was released by its author, and within 24 hours had caused damage across the world. It spread via the internet - and its release marked a new dawn for malicious software. Our five facts highlight what has changed since - and what hasn't.

We have already discussed how a system gets infected with Win32/Nymaim ransomware. In this blog post, we reveal a new infection vector, a study of the different international locker designs and ransom prices as well as a complete technical analysis of its communication protocol.