#ESETresearch discovered unique toolset, QuietEnvelope, targeting the MailGates email protection system of Taiwanesw co OpenFind. The toolset was uploaded in an archive, named spam_log.7z, to VirusTotal from Taiwan. It contains Perl scripts, 3 stealthy backdoors, argument runner, and misc files. 1/8

#ESETresearch discovered and analyzed a previously undocumented malicious tool for network devices that we have named #EdgeStepper, enabling China-aligned #PlushDaemon APT to perform adversary-in-the-middle to hijack updates to deliver malware. www.welivesecurity.com/en/eset-rese... 1/5

New @esetresearch.bsky.social blog, where Peter Kalnai & I discuss a recent cyber espionage campaign by the 🇰🇵-aligned Lazarus group. This operation targeted 3 European defense companies and seemed in no small part interested in drone-related technologies. (1/5) www.welivesecurity.com/en/eset-rese...

#ESETresearch has uncovered the North Korea-aligned threat actor, DeceptiveDevelopment, targeting freelance developers with trojanized coding challenges and fake job interviews. www.welivesecurity.com/en/eset-rese... 1/6

#ESETresearch has discovered the first known cases of collaboration between Gamaredon and Turla, in Ukraine. Both groups are affiliated with the FSB, Russia’s main domestic intelligence and security agency. www.welivesecurity.com/en/eset-rese... 1/3

#ESETresearch’s Matthieu Faou and Zoltán Rusnák will present at Labscon 2025 @labscon_io: “Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine”. Join them in Scottsdale, September 19 at 11:00 AM MST. 1/3

#ESETResearch has discovered the first known AI-powered ransomware, which we named #PromptLock. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes 1/7

#ESETresearch has discovered a zero-day vulnerability in WinRAR, exploited in the wild by Russia-aligned #RomCom @dmnsch @cherepanov74 www.welivesecurity.com/en/eset-rese... 1/7

#ESETresearch has conducted a comprehensive technical analysis of new malicious tools and significant updates observed in 2024 in the arsenal of the Russia-aligned #Gamaredon #APTgroup targeting Ukraine🇺🇦. www.welivesecurity.com/en/eset-rese... 1/9

ESET’s Matthieu Faou exposed “Operation Texonto”, a pro-Russian disinformation operation aimed at Ukrainian speakers. He shared the full breakdown at #CYBERWARCON. Watch his talk >> www.youtube.com/watch?v=X5lL... Read the research >> www.welivesecurity.com/en/eset-rese... #IO #Cybersecurity

"La mathématisation du monde est une forme de négation du rôle et de la nature humaine dans ce monde. Si tout devient quantifiable, mesurable, objectivable, alors tout devient process, automatisme, donnée. Tout peut potentiellement être confié aux algorithmes."

🚨 Après plusieurs années passées à travailler sur les enjeux cyber, je nourrissais depuis quelques temps le désir de me rapprocher du « terrain ». C'est désormais chose faite: j'ai le privilège de rejoindre cette semaine @esetresearch.bsky.social à titre de Strategic Threat Intelligence Analyst !

#ESETresearch publishes its investigation of Operation RoundPress, which uses XSS vulnerabilities to target high-value webmail servers. We attribute the operation to Sednit with medium confidence. www.welivesecurity.com/en/eset-rese... 1/5

#ESETResearch analyzed the toolset of the China-aligned APT group that we have named #TheWizards. It can move laterally on compromised networks by performing adversary-in-the-middle (AitM) attacks to hijack software updates. www.welivesecurity.com/en/eset-rese... 1/6

We at Wired put together six stories on lesser known hacker groups who have quietly become some of the most harmful in the world. Case in point: The turncoat Ukrainian spies working for Russia who some analysts say are the top cyberespionage threat to Ukraine today. www.wired.com/story/gamare...

In July 2024, #ESETresearch discovered that the China-aligned #FamousSparrow APT group, thought at the time to have been inactive since 2022, compromised the network of a US trade group and a Mexican research institute. www.welivesecurity.com/en/eset-rese... 1/5

#ESETresearch published its investigation of Operation FishMedley, a global espionage operation by the China-aligned APT group FishMonger. We identified seven victims – including governments, NGOs, and think tanks – across Asia, Europe, and the US. www.welivesecurity.com/en/eset-rese... 1/3

#ESETresearch has uncovered the #MirrorFace Operation AkaiRyū, which extends the group’s usual focus beyond Japan into Europe. The initial lure centered around Expo 2025 in Japan, compromising a Central European diplomatic institute. 1/8 www.welivesecurity.com/en/eset-rese...

If I had a dollar for every single time something is attributed vaguely to “”Mustang Panda”” I could buy a flat in London

A lire absolument, pour ceux qui souhaitent comprendre l'ampleur de ce que les #databrokers obtiennent comme info sur les internautes. #adint #cybercriminalité #sensibilisation Merci #LeMonde pour cet excellent article. www.lemonde.fr/pixels/artic...

"ChatGPT and other Large Language Models are not a decision-making technology, they are decision-removing technologies. They generate text, but most powerfully, they generate pretext." Wonderful insight by @eryk.bsky.social, as usual. mail.cyberneticforests.com/a-fork-in-th...

Intelligence Online links the MOONSHINE framework that we discussed in our Earth Minotaur report (www.trendmicro.com/en_us/resear...) to a Chinese company www.intelligenceonline.com/surveillance... (article is free but needs registration to access it). Happy new year UPSEC ! 😘

#ESETresearch discovered + named 🇨🇳 China-aligned #APT group #PlushDaemon who did a supply-chain compromise of a 🇰🇷 South Korean #VPN provider, trojanizing its legitimate software installer with a Windows backdoor we named #SlowStepper www.welivesecurity.com/en/eset-rese... 🧵1/6

Join #ESETresearch at #JSAC2025! Facundo Munoz will talk about China-aligned PlushDaemon APT compromising the supply chain of a 🇰🇷 South Korean VPN. In 2024, several users downloaded a trojanized NSIS installer from the official website of a South Korean VPN company. 🧵 1/3

Sur le S1eg He1l de Musk et son euphémisation réflexe par la profession, voilà ce que j'écrivais *il y a un an et demi*. La presse n'est (majoritairement) pas équipée idéologiquement pour identifier la violence suprémaciste chez les oligarques occidentaux. www.arretsurimages.net/chroniques/c...

Trumpisme, biais racistes et menace écologique : « L’intelligence artificielle n’est pas une technique, c’est une idéologie ». Entretien avec l'excellent Thibault Prévost(@wnstnsmith.bsky.social), plume technocritique acérée www.mediapart.fr/journal/inte...

"The media theorist Marshall McLuhan once said of technology that every augmentation is also an amputation. We chose our digitally enhanced world. We did not realize the significance of what was being amputated." On the political economy of aloneness. Brilliant www.theatlantic.com/magazine/arc...

🇷🇺 #DoubleTap Campaign: #Russia-nexus APT possibly related to #APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations https://buff.ly/3WEwPG7

ESET Threat Report H2 2024: New MaaS threats rising to prominence, a novel attack vector targeting mobile users, and deepfake scams flooding social media. Read more in the full report, out now www.welivesecurity.com/en/eset-rese... #ESETresearch

"For century-scale storage, you aren’t fighting against mere mortal enemies—you’re waging a battle against the raging and unkind powers of geology, physics, and chemistry, not to mention the inexhaustible fallibility of humanity as a species." Magnificent essay. lil.law.harvard.edu/century-scal...

In December 11 and 12, 2024, a spearphishing campaign targeted at least 20 Autonomous System (AS) owners, predominantly Internet Service Providers (ISPs), and purported to come from the Network Operations Center (NOC) of a prominent European ISP. 🧵⤵️

Our latest report presents Earth Minotaur, a threat actor targeting Tibetans and Uyghurs using Moonshine, an exploitation framework for Android apps described in 2019 by @citizenlab.ca leveraging vulnerabilities in applications embedding old versions of Chromium trendmicro.com/en_us/resear...

#ESETresearch reveals the first Linux UEFI bootkit, Bootkitty. It disables kernel signature verification and preloads two ELFs unknown during our analysis. Also discovered, a possibly related unsigned LKM – both were uploaded to VT early this month. www.welivesecurity.com/en/eset-rese... 🧵

Instant agenda : Pour celleux qui se trouvent à Paris et qui veulent discuter technocritique, conquête spatiale, IA et technofascisme, on se retrouve ce soir avec @ireneer.bsky.social à la librairie Libre Ère de Menilmontant dès 19h30. Venez nous voir, on va dire plein d'autres mots en -isme.

@volexity.bsky.social has published a blog post detailing variants of LIGHTSPY & DEEPDATA malware discovered in the summer of 2024, including exploitation of a vulnerability in FortiClient to extract credentials from memory. Read more here: www.volexity.com/blog/2024/11...