Skip to content

ESET Research discovers close cooperation among Latin American financial cybercriminals

BRATISLAVA, PRAGUE – ESET researchers have today published a white paper detailing their findings on the interconnected nature of Latin American banking trojan families. Even though Latin American banking trojans can be looked upon as one homogeneous group of malware, ESET reports that multiple distinct malware families can be recognized. At the same time, ESET researchers have discovered a surprising number of indicators of close cooperation among Latin American banking trojan authors. Despite the term “Latin American,”  some of the trojans have been targeting Spain and Portugal since late last year. The white paper was first published during the VB2020 localhost conference.

“Over the past year, we have been publishing an ongoing blog post series about Latin American banking trojan families. These blog posts mainly focus on the most important and interesting aspects of these families,” says Jakub Souček, one of the researchers working on Latin American financial cybercrime. “At the VB conference, we looked at these families from a high-level perspective. Rather than examining details of each family and highlighting their unique characteristics, we focused on what they have in common.”  

The first similarities ESET spotted were in the actual implementation of these banking trojans. The most obvious are the practically identical implementations of the banking trojans’ core functionalities and attack techniques via fake pop-up windows carefully designed to lure victims into providing sensitive information. Besides that, these malware families share third-party libraries, generally unknown string encryption algorithms, and both string and binary obfuscation techniques.

Other similarities can be observed in malware distribution. The trojans usually check for a marker used to indicate that the machine has already been compromised and download data in ZIP archives. ESET also observed identical distribution chains distributing several different payloads and shared execution methods.

“Additionally, different families use similar spam email templates in their latest campaigns, almost as if this was a coordinated move,” says Souček. “Since we don’t believe it to be possible that independent malware authors would come up with so many common ideas – and, moreover, since we don’t believe one group to be responsible for maintaining all these malware families – we must conclude that these are multiple threat actors closely cooperating with each other.”  

For more technical details about this spyware, read the white paper “LATAM financial cybercrime: Competitors in crime sharing TTPs” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.  

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

訊連科技推出新一代「威力導演」、「相片大師」及「創意導演」系列 全新特效、升級功能 強化多媒體創作體驗

更多AI智慧編修工具、擴充特效與內建數十萬款圖片、影片之 Shutterstock素材庫

所有創作者皆能輕鬆打造專業級作品

2020917日,台北訊】多媒體創作軟體領導廠商訊連科技(5203.TW)今日舉辦創意導演家族新品線上發表會,發布全新一代的「威力導演365」、「相片大師365」及「創意導演365」訂閱版本更新,除內建Shutterstock素材庫外,也推出各式全新特效套件、擴充內容,及採用AI等先進技術打造的全新創作工具,為使用者帶來更強大的編輯工具、豐富擴充內容及優化創作流程。

針對影音創作者的創作需求,全新版本的「威力導演365」及「威力導演19」大幅強化介面設計,透過更簡潔的編輯介面有效提升影片編輯效率,並簡化重複套用不同特效的繁複程序。此外,也提供全新的向量筆畫範本、遮罩設計師、色調調節及自訂動態圖形文字等工具,為使用者提供更快速、高效率、精準的編輯體驗,不論是剛開始接觸威力導演的使用者或專業YouTuber、影音創作者等都能輕鬆創作出吸睛作品。

「相片大師365」及「相片大師12」全新的AI人像去背工具可準確辨認相片中之人像進行去背及背景分離,可廣泛使用在圖層編輯及多種特效工具中,可加速圖文創作者、設計師人像去背流程。此外,相片大師亦新增了動態照片、碎片效果、故障特效及光線效果等,協助創作者快速打造吸睛的社群圖文創作。

「創意導演365」是全方位的多媒體創作軟體,集結最新版本之威力導演、相片大師、AudioDirector及ColorDirector等四套旗艦創作軟體,協助專業影音創作者打造專業影片、圖文創作,更可透過強大的音訊編輯工具及影片調色工具,增加影片的專業感。針對「創意導演365」、「威力導演365」及「相片大師365」之訂閱戶,除了每個月更新訂閱戶專屬的特效、背景音樂、音效等素材擴充外,更內建Shutterstock影音素材庫,訂閱用戶可由程式中瀏覽、下載超過十萬種的影片、圖像及音樂素材。

「全民創作時代來臨,無論是一般用戶或是專業的影音或是圖文創作者,都需要功能強大、簡易上手的創作工具來進行創作。此外,創作時各式影片、圖片,甚至音樂素材皆是打造吸睛作品不可或缺的。」訊連科技執行長黃肇雄表示:「此次創意導演、威力導演及相片大師的升級,除了在功能上大幅強化、優化使用者介面外,也與全球最大的專業素材庫公司Shutterstock攜手,提供訂閱用戶數十萬種的影音素材庫,讓所有使用者皆能揮灑創意不受限。」

更多創意導演家族、多媒體創作軟體資訊請上訊連科技官網: https://tw.cyberlink.com/products/index_zh_TW.html

創意導演家族已可於指定零售通路選購,並內建繁體中文、簡體中文、英文、法文、德文、義大利文、西班牙文、日文及韓文等九國語系。

2020創意導演家族新品線上發表會

活動回看連結:https://u.cyberlink.com/live/840385615882094748

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於CyberLink
訊連科技創立於1996年,擁有頂尖視訊與音訊技術的影音軟體公司,專精於數位影音軟體及多媒體串流應用解決方案產品研發,並以「抓準技術板塊,擴大全球行銷布局」的策略,深根台灣、佈局全球,展現亮麗的成績。訊連科技以先進的技術提供完美的高解析影音播放效果、以尖端的科技提供完整的高解析度擷取、編輯、製片及燒錄功能且完整支援各種高解析度影片及音訊格式。產品包括:「威力導演」、「PowerDVD」、「威力製片」、「威力酷燒」等。

The new headquarters and campus for ESET will be designed by leading Danish architectural studio BIG (Bjarke Ingels Group)

BRATISLAVA – ESET has named its partner in transforming the premises of the former Military Hospital at Patrónka into the Center for Innovation and Creativity – ESET Campus – the world-renowned architectural studio Bjarke Ingels Group (BIG). Architects from one of today’s most sought-after studios have won the international architectural competition that was announced by ESET last September. As ESET Campus is an exceptional project in terms of scope but especially the combination and interconnectedness of functions, the most important selection criteria were previous experience with a focus on master planning, campuses and innovation centers, but also sufficient studio size and capacity.

“We also see ESET Campus as an extremely complex project for our company, which is why we paid a lot of attention and time to the choice of the conceptual architect. The international competition and workshops with the addressed studios, as well as discussions with Slovak experts who helped us with the selection, significantly moved us not only in thinking about the future design of the project, but also on current topics such as sustainability, ecology and flexibility of the working environment. In addition, we are preparing this exceptional project at a time that posed completely new challenges for us, so I am very happy that we will develop it with exceptional architects from the BIG studio,” said Pavel Luka, ESET’s chief operating officer, about the results of the competition.

“We are honoured to work with ESET, which has set out an extraordinary level of ambition for their new headquarters. With the global events of 2020 and the rise of remote working in mind, this has become an opportunity to explore the future of both physical and virtual work space, and to rethink the campus as an integrated part of the city. The vision is to demonstrate a true carbon neutral approach to construction, and to create a campus blended closely with the natural environment at the foot of the Small Carpathians,” said Andreas Klok Pedersen, partner, BIG London.

As the intention of the competition was the presentation of conceptual proposals and the selection of a long-term partner for cooperation, the result of the selection is not yet the final design of the project. It should be created in the coming months in cooperation with the BIG studio, ESET and also with the involvement of a local architectural studio, the selection of which is currently being prepared.

Based on the cooperation of ESET with the Faculty of Architecture and Design of the Slovak Technical University (FAD STU) in Bratislava, the architects from the BIG studio also became the guarantors of the newly opened 25th vertical studio at FAD STU. In the next school year, under their leadership, students will solve assignments related to the topic of innovation centers, science parks, and sustainability, but also design solutions in the post-COVID-19 era.

ABOUT THE ESET CAMPUS PROJECT
ESET acquired the plot of land at the Bratislava Patrónka site in 2017. It plans to create an ESET Campus on the site of the former Military Hospital — a living place that will turn this part of the city into an epicenter of innovation and creativity in Bratislava. In addition to the new headquarters and global research center of ESET, the campus will create a unique and stimulating environment for IT and technology companies and startups, and connect them with technically oriented universities.

In addition to a high-quality environment for innovation and research, the campus will provide a wide range of other useful services and facilities, unique public spaces and, in part, a residential function intended mainly for company employees. The campus is also envisioned to create modern forms of accommodation for students, which can deepen the integration of universities within this innovative ecosystem. An important part of the campus will be its sports infrastructure and auditorium; many of these spaces will also be available to the general public.

The campus will be built on the principles of functionality, sustainability and ecology. It is intended to support the use of public transport and maximum comfort for pedestrians as much as possible. In addition to public transport stops, there is also a railway station in the immediate vicinity of the complex, thanks to which train transport in this part of the city could become a full-fledged part of public transport.

BIG – BJARKE INGELS GROUP
BIG is a Copenhagen, New York, London and Barcelona based group of architects, designers, urbanists, landscape professionals, interior and product designers, researchers and inventors. The office is currently involved in a large number of projects throughout Europe, North America, Asia and the Middle East. BIG’s architecture emerges out of a careful analysis of how contemporary life constantly evolves and changes, not least due to the influence from multicultural exchange, global economic flows and communication technologies that all together require new ways of architectural and urban organization. More info: big.dk.

Google headquarters, USA. With Google and parent company Alphabet’s ever-expanding and ever-evolving ventures, occupying existing buildings for the expanding workforce has reached its organizational limitations – teams become spread across multiple buildings, separated by parking lots. On the other hand, a single centralized headquarters is also not the approach for Google, nor is it desirable for the city of Mountain View. Our mission is to create a replicable and scalable building typology that is also adaptable and inclusive to the various sites of North Bayshore and beyond. More info: big.dk/press/gce/

Toyota Woven City. Together with Toyota Motor Corporation, BIG unveils Toyota Woven City as the world’s first urban incubator dedicated to the advancement of all aspects of mobility at the foothills of Mt. Fuji in Japan. Envisioned as a living laboratory to test and advance mobility, autonomy, connectivity, hydrogen-powered infrastructure and industry collaboration, More info: big.dk/press/twc

Google London headquarter, UK.  Centrally located in King’s Cross and adjacent to the city’s largest station, Google’s London headquarters will be its first wholly owned and designed building outside the United States. The new 11-storey building, combined with Google’s current building at 6 Pancras Square and an additional third building, will create a King’s Cross Campus with the potential to house 7,000 Google employees. Comprising of more than 1 million sqft, of which Google will occupy 650,000 sqft, the purpose-built building is being developed from the ground up and will contribute to the Knowledge Quarter and King’s Cross’s growing knowledge-based economy. More info: big.dk/press/kgx

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

The Glaring Vulnerabilities in Power Distribution Networks Today

It is hard to think of another facility more crucial than power distribution facilities, which control everything from turning on the lights in homes to running critical infrastructure systems. The US Institute for Critical Infrastructure Technology (ICIT) recently labelled what it terms ‘disruptionware’ in the context of an attack on a national energy grid as “a weapon of mass destruction.”

Western countries have been concerned about the threat of cyber-attacks crippling energy grids ever since the Russian targeting of the Ukrainian power grid in 2015 and, more recently, indictments by the US Department of Justice against two Chinese threat actors for targeting groups including a Department of Energy site.

The same group that targeted the Ukrainian grid, named as Dragonfly or Energetic Bear, was subsequently alleged to have been responsible for numerous other attacks on energy facilities, including a major attack on the UK power grid, which only came to light as a result of a leaked memo from GCHQ and the UK National Grid, has been on high alert for cyber-attacks since the start of the COVID-19 crisis.

Yet these vital facilities are not only poorly protected when compared to many other types of organization, but are also becoming increasingly vulnerable to cyber-attacks. Threats such as Trisis, Industroyer and BlackEnergy are now increasingly deployed in order to exploit a growing number of glaring vulnerabilities within power distribution systems.

The push to modernize power distribution facilities has brought in its wake a host of new entry points for threat actors to exploit. The rapid shift to smart grids means that utilities are now adding tens of thousands of largely unprotected devices such as new sensors, controllers, relays and meters.

Existing perimeter security is currently largely incapable of controlling all entry points to the network; once any one of these is bypassed, attackers can access a wide range of assets and remain undetected for long periods of time. Increasing connectivity of OT networks to remote sub-stations as well as to organizational systems also brings with it a host of vulnerable and often unsecured entry points.

Automation components, such as programmable logic controllers (PLCs) function via microprocessors and contain function-specific software programming. They also have management and communications capabilities running over network paths. These have been a major target for cyber-attacks as a means of gaining access to control systems.

Legacy industrial control system (ICS) protocols such as Modbus and DNP3, commonly used throughout power systems, have little or no security measures and lack authentication capabilities. These can easily be intercepted, spoofed or altered – potentially causing a dangerous event in the operations environment.

Like many other utilities, power distribution organizations also increasingly rely on remotely accessible equipment and mobile devices. While this has an immediate payback in terms of efficiency and convenience, it has also created vulnerabilities stemming from unsecure access or from connection to critical systems via remote tools and devices.

Coming from a world of stand-alone secure systems, many vendors of ICS systems also unwittingly create ‘backdoor’ access to devices and software, which are easy to exploit. Some vendors are even known to threaten to void equipment warranties should their products be reconfigured from the original factory settings by changing passwords or installing unapproved security packages.

The absence of constant network monitoring systems in most OT networks means that many utilities cannot even obtain basic forensic data related to cyber intrusions and attacks. This not only leaves such facilities vulnerable to financially motivated ransomware demands, but also to potentially devastating attacks from state-sponsored threat actors bent on causing physical destruction as well as economic damage.

Badly secured facilities mean that potentially highly destructive intrusions can sit on a power distribution network’s system undetected for months until they are triggered at a time calculated to cause maximum damage, possibly coinciding with other forms of attack or during a period of social unrest or national emergency such as the current COVID-19 crisis.

In order to protect against system abuse or cyber-attacks, power distribution networks must provide real-time monitoring across their newly-extended security perimeters in order to detect anomalous and non-authorized behavior while addressing both external and internal attack vectors.

source from:https://www.infosecurity-magazine.com/opinions/glaring-vulnerabilities-power

Elad Ben-Meir

CEO, SCADAfence

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×