Skip to content

MENDEL 3.6 NOW AVAILABLE

GREYCORTEX has released the latest version of its MENDEL network traffic analysis solution. Version 3.6.0 brings important features, improvements, and bug fixes. The main features in MENDEL 3.6.0 include automatic plugin execution for faster response, more efficient storage for longer data retention, improved incident management, including generating incident reports, and many others.

MAIN FEATURES

Incident management 
Improves the ability to work with incidents, providing an easier way to define and describe security incidents and their management, and provide tools to export them into a final printable report (PDF) suitable for presentation and reporting

Automated Threat Response
MENDEL allows the automatic blocking of traffic on firewalls or sending notifications to external systems through custom scripts. The execution of the script is based on predefined event filter plugins.

Application Detection 
Enhanced flow detection, which can now recognize up to 4,000 commonly used applications to improve better visibility into specific services.

Multitier storage for longer data retention
A change in the way MENDEL stores data, with the goal of saving disk space and providing more effective storage for machines, with data retention over three months.

Parsing new RDP protocol and enhance existing parsers
Many improvements have been implemented for SMB, SNMP, SIP, SMTP, Modbus (TCP/UDP), and many other protocols.

JA3S support
Enhanced support for the JA3 fingerprint method, making it possible to fingerprint the entire cryptographic negotiation between a client and it’s server by combining JA3 + JA3S (server side fingerprinting).

Enhanced detection of malicious encrypted communication
MENDEL is able to detect malicious TLS certificates, malicious clients, or servers using JA3 fingerprints.

ENHANCEMENTS

Processing Cisco ASA NetFlow
Appliances are now able to process NetFlow data from Cisco ASA solutions in the NetFlow Secure Event Logging format.

Cloning MENDEL instances from VM templates
Allows the cloning of existing MENDEL instances in a virtual environment for faster deployment without installation. 

DB Optimizations and maintenance processes
Optimization and improvement for faster processing in user interface response for large networks. 

Extended protocol detection
Improvements in flow processing, with better flow direction for greater accuracy as well as support for dealing with asynchronous flows.

Samba backup
Enhanced configuration and password handling of data backup to Samba share, including a better connection error handling and consistency check for more reliable backup in the event of a backup error.

OTHER IMPROVEMENTS

Removed deprecated IDS signatures from Proofpoint
Added a certificate valid date into TLS protocol
Added the option to cancel data requests to most pages
Added support for Citrix Xen virtualization platform
Enhanced processing for false positives for external networks
Improve the processing of network statistics on a huge number of subnets in the User Interface
Enhanced reporting for Active Directory errors during processing logs
Enhanced port filter with full text
Added IPv4 Link-local subnet (APIPA) to default subnets
Updated Dell hardware monitoring tools to the latest version
Upgraded to latest Intel 10Gbits network cards drivers
Removed deprecated blacklisted sources

FIXED ISSUES

In general, our development team focused on improving user experience and reporting, as well as more improvements to user experience, system stability, and performance.

MENDEL PRODUCT SUPPORT

Full support is provided for the new released version 3.6.0 and previous version 3.5.x. Limited support is provided for previous version 3.4.x. Versions 3.3.x and older are no longer supported, end-users with valid support and maintenance or active SW subscription can upgrade to the supported version(s).

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

ESET Performs Best in Inaugural Test of Android Security Apps for Corporate Users

BRATISLAVA – May 27, 2020 – The enterprise version of ESET’s Android mobile security app, ESET Endpoint Security for Android, reached the best score in the first edition of the Android Security Apps for Corporate Users test by AV-TEST, a respected independent testing organization.

“Requirements of businesses differ from those of consumers, so it’s a step in the right direction by AV-TEST to design the Android test specifically for corporate use cases,” says Jiří Kropáč, Head of Threat Detection Labs at ESET.

In the first edition of the new test, three security solutions were tested, including ESET Endpoint Security for Android. In two of the three key parts of the test – Usability and Performance – all three solutions reached the best possible score. In the Protection part of the test, arguably the crucial one, ESET Endpoint Security for Android was the only app to detect 100% of the 3,100-strong sample set.

“This test shows ESET Endpoint security for Android is the right security solution for mobile devices allowed in corporate networks,” comments Kropáč.

The test of corporate Android security apps differs from the test for consumer apps in two main areas.

First, the set of samples for detection reflects the specifics of the business use of Android devices. For example, instead of infected game apps, the testing set contains threats known to target corporate users. Apps for the corporate version of the test were taken exclusively from the official Android app store, Google Play. This eliminates the need for tuning up the protection to also cover obscure types of threats that a corporate user will rarely encounter.

Second, the manageability of the security solution is also considered.

Besides that, the design of the performance test has been slightly adjusted so the new test evaluates the impact on website loading, document reading, or network traffic.

The testing of corporate Android apps was long overdue, according to Kropáč. “Nowadays, corporate internal systems tend to be accessible from mobile devices. Additionally, those devices are often also used for personal purposes. This combined means that the need for reliable corporate mobile security solutions is imminent. And where there is a need for reliability, there is also a need for independent tests.”

The results of the first edition of the test of Android security apps for corporate users can be found on AV-TEST’s website.

Head to ESET’s official Corporate blog, to read an interview with Jiří Kropáč.

Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers

Bratislava, Montreal – ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla’s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.

The fact that the attackers try to evade security software is concerning. “This shows the level of sophistication of this group and its intention to stay on the same machines for a long time,” explains Matthieu Faou, who has investigated the infamous group for several years. “Additionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn’t rely on any malicious domain,” says Faou.

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.“

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,” says Faou.

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper From Agent.BTZ to ComRAT v4: a ten year journey on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Bratislava, Montreal – ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla’s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.

The fact that the attackers try to evade security software is concerning. “This shows the level of sophistication of this group and its intention to stay on the same machines for a long time,” explains Matthieu Faou, who has investigated the infamous group for several years. “Additionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn’t rely on any malicious domain,” says Faou.

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.“

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,” says Faou.

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper From Agent.BTZ to ComRAT v4: a ten year journey on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Server will be regularly maintenance on 2020-06-02

Special Announcement
In order to provide more stable service, the server (http://eset.version-2.sg/purchase/register/) will be regularly maintenance on 2020-06-02.
Sorry for any inconveniences caused.

Support Hotline: (65) 6296 4268
Or email to support@version-2.com.sg

ESET NOD32 產品註冊伺服器將於2020-06-02進行定期維護

為了提供更穩定的服務，ESET NOD32 產品註冊伺服器 (https://www.eset.hk/download/register/) 將於2020-06-02進行定期維護。

不便之處，敬請原諒。

技術支援熱線: (852) 2893 8186
或電郵至: support@eset.hk

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於ESET
ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟件提供商，其獲獎產品 — NOD32防病毒軟件系統，能夠針對各種已知或未知病毒、間諜軟件 （spyware）、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布裏斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事處，代理機構覆蓋全球超過100個國家。

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×