BRATISLAVA — December 4, 2024 — ESET, a global leader in cybersecurity solutions, is proud to announce the publication of its 2023 Carbon Footprint Report. This comprehensive report underscores ESET’s dedication to transparency, accountability, and environmental sustainability, reflecting the company’s ongoing efforts to mitigate its environmental impact and progress toward a net-zero future.

The report reveals that ESET Group’s total carbon footprint for 2023 is 8,146.34 tonnes CO2e using the location-based method and 7,835.06 tonnes CO2e using the market-based method. Greenhouse gas (GHG) emissions per employee amount to 3.38 tonnes CO2e. The majority of the total carbon footprint comes from indirect emissions within ESET Group’s value chain (Scope 3), representing 79% of all emissions.

Compared to 2022, ESET Group’s total GHG emissions increased by 25%, with GHG emissions per employee rising by 16%. The increase is attributed to the inclusion of additional offices previously excluded from data collection, increased business travel attributed to the significant and lasting changes in how businesses operate, driven by the adaptations made during the COVID-19 pandemic, an increase in the number of employees (by 7%), as well as a return to offices in most locations, and more accurate data collection overall year on year.

Despite these increases, ESET has made significant strides in reducing emissions from stationary combustion and fugitive emissions, thanks to implementing various measures to ensure efficient use of heating and cooling through timers, thermostats, and zoning in many offices. That has resulted in an 11% decrease in emissions from stationary combustion, which is due to the use of natural gas and CNG for heating, an 82% decrease in fugitive emissions for A/C unit leakages, and only a 1% increase in purchased heat emissions.

Palo Luka, ESET’s Global COO, said: “We remain committed to our Global Environmental Strategy and will continue to work tirelessly toward reducing our environmental impact. We plan to do this by increasing the use of renewable energy, enhancing energy efficiency, and promoting sustainable practices across all our operations, individually through employees, business partners, and throughout our supply chain. Our ultimate goal is to leave the planet in a better state for future generations.”

According to Luka, the use of renewable energy helps create demand for more sustainable technologies, and the company’s hope is that, where possible, they can contribute toward influencing more options and higher-quality renewable energy sources. In 2023, 36% of electricity consumed in our offices around the world is from renewable sources, with emissions from purchased electricity category contributing the most to the company’s Scope 2 emissions (87%). Furthermore, although energy consumption in our external data centers has increased by 17% between 2022 and 2023, the emissions from external data centers are almost zero as ESET is using responsible providers and 100% renewable energy. 

Read the full report here.

Read about ESET’s commitment to environmental sustainability here.

BRATISLAVA — December 5, 2024 — ESET, a global leader in cybersecurity solutions, is proud to announce its recognition as a Product and Market Leader in KuppingerCole’s Leadership Compass for Managed Detection & Response (MDR). This report prepared by KuppingerCole Analysts AG evaluates the most influential players in the Managed Detection & Response space, and once again acknowledges ESET’s commitment to delivering leading cybersecurity solutions tailored to the needs of organizations across industries.

KuppingerCole’s Leadership Compass recognizes ESET both as a Product and Market Leader for its ESET PROTECT MDR solution, emphasizing the benefits of its fully integrated, cloud-native platform with flexible and rapid deployment capabilities. The report highlights the service’s simple pricing model as well as the new standard tier tailored to the needs of small and medium enterprises (SMEs). ESET PROTECT MDR provides cross-industry, multi-regional insights, strong ransomware/extortion detection, and excellent blocking capabilities.

“ESET PROTECT MDR caters to organizations across the spectrum, from nimble startups to large enterprises,” said Warwick Ashford, Senior Analyst at KuppingerCole, and author of the report. “What sets this solution apart is its ability to deliver rapid response times, robust threat intelligence, and strong ransomware protection, all while offering strong compliance and localization support.”

Delivered via the ESET PROTECT Platform, it also stands out for its additional advantages as a 20-minute Mean Time to Respond (MTTR) and a generative AI assistant in the form of the ESET AI Advisor, for proactive security insight. These features make ESET a versatile and reliable solution for organizations of all sizes and maturity levels.

“Being named a Product and Market Leader in KuppingerCole’s Leadership Compass for MDR reflects our dedication to innovation and excellence in cybersecurity,” said Michal Jankech, Vice President, Enterprise & SMB/MSP at ESET. “Organizations are seeking solutions that provide both proactive detection and rapid response. ESET PROTECT MDR is designed to meet these demands, ensuring businesses stay resilient and protected,” he added.

The recognition comes at a time when MDR solutions are more critical than ever. As cyber threats grow in complexity and frequency, organizations face great challenges, including endpoint vulnerabilities, phishing attacks, and ransomware campaigns. Compounding these issues is a widespread cybersecurity skills shortage, which makes it increasingly difficult for businesses to manage threats internally. MDR solutions, particularly those leveraging advanced AI and machine learning technologies, are essential tools for combating these challenges. They provide critical support for organizations lacking in-house security capabilities, and offer advanced threat detection, rapid response, and proactive risk mitigation strategies to address evolving cyber risks.

ESET has also been named a Product and Innovation Leader in the recent KuppingerCole’s Leadership Compass report on Endpoint Protection Detection and Response (EPDR). The authoritative guide to the EPDR market segment acknowledged ESET for its robust and innovative ESET PROTECT Platform, which integrates the Extended Detection and Response (XDR) enabling ESET Inspect, and ESET Threat Intelligence, among many other modules.

For more information about ESET PROTECT MDR and the ESET PROTECT Platform, please visit www.eset.com.

• ESET researchers discovered two previously unknown vulnerabilities, one in Mozilla and the other in Windows, being exploited by the Russia-aligned RomCom Advanced persistent threat (APT) group.
• Analysis of the exploit led to the discovery of the first vulnerability, now assigned CVE-2024-9680: a use-after-free bug in the animation timeline feature in Firefox. ESET reported the vulnerability to Mozilla on October 8, 2024; it was patched within a day.
• This critical vulnerability has a score of 9.8 out of 10.
• Further analysis revealed another zero-day vulnerability in Windows: a privilege escalation bug, now assigned CVE 2024 49039, that allows code to run outside of Firefox’s sandbox. Microsoft released a patch for this second vulnerability on November 12, 2024.
• The two zero-day vulnerabilities chained together armed RomCom with an exploit that requires no user interaction other than browsing to a specially crafted website.
• Potential victims who visited websites hosting the exploit were located mostly in Europe and North America.

MONTREAL, BRATISLAVA — November 26, 2024 — ESET researchers discovered a previously unknown vulnerability, CVE-2024-9680, in Mozilla products, exploited in the wild by Russia-aligned APT group RomCom. Further analysis revealed another zero-day vulnerability in Windows: a privilege escalation bug, now assigned CVE-2024-49039. In a successful attack, if a victim browses a web page containing the exploit, an adversary can run arbitrary code – without any user interaction required (zero click) – which in this case led to the installation of RomCom’s backdoor on the victim’s computer. The backdoor used by the group is capable of executing commands and downloading additional modules to the victim’s machine. The Mozilla-related critical vulnerability discovered by ESET Research on October 8 has a CVSS score of 9.8 on a scale from 0 to 10. In 2024, RomCom struck in Ukraine and other European countries, as well as the United States. According to our telemetry, from October 10, 2024 to November 4th, 2024, potential victims who visited websites hosting the exploit were located mostly in Europe and North America.

On October 8, 2024, ESET researchers discovered vulnerability CVE-2024-9680. It is a use-after-free bug in the animation timeline feature in Firefox. Mozilla patched the vulnerability on October 9, 2024. Further analysis revealed another zero-day vulnerability, in Windows: a privilege escalation bug, now assigned CVE 2024 49039, that allows code to run outside Firefox’s sandbox. Microsoft released a patch for this second vulnerability on November 12, 2024.

The vulnerability CVE-2024-9680 discovered on October 8 allows vulnerable versions of Firefox, Thunderbird, and the Tor Browser to execute code in the restricted context of the browser. Chained with the previously unknown vulnerability in Windows, CVE-2024-49039, which has a CVSS score of 8.8, arbitrary code can be executed in the context of the logged-in user. Chaining together two zero-day vulnerabilities armed RomCom with an exploit that requires no user interaction. This level of sophistication demonstrates the threat actor’s intent and means to obtain or develop stealthy capabilities. Furthermore, successful exploitation attempts delivered the RomCom backdoor in what looks like a widespread campaign.

RomCom (also known as Storm-0978, Tropical Scorpius, or UNC2596) is a Russia-aligned group that conducts both opportunistic campaigns against selected business verticals and targeted espionage operations. The group’s focus has shifted to include espionage operations collecting intelligence, in parallel with its more conventional cybercrime operations. In 2024, ESET discovered cyberespionage and cybercrime operations of RomCom against governmental entities, defense, and energy sectors in Ukraine, the pharmaceutical and insurance sectors in the US; the legal sector in Germany; and governmental entities in Europe.

“The compromise chain is composed of a fake website that redirects the potential victim to the server hosting the exploit, and should the exploit succeed, shellcode is executed that downloads and executes the RomCom backdoor. While we don’t know how the link to the fake website is distributed, however, if the page is reached using a vulnerable browser, a payload is dropped and executed on the victim’s computer with no user interaction required,” says ESET researcher Damien Schaeffer, who discovered both vulnerabilities. “We would like to thank the team at Mozilla for being very responsive and to highlight their impressive work ethic to release a patch within a day,” he adds. Each vulnerability was fixed by, respectively, Mozilla and Microsoft.

This is at least the second time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild, after the abuse of CVE-2023-36884 via Microsoft Word in June 2023.

For a more detailed analysis and technical breakdown of the discovered vulnerabilities, check out the latest ESET Research blogpost “RomCom exploits Firefox and Windows zero days in the wild” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Heatmap of potential victims

• In November 2024, a previously unknown application, named bootkit.efi, was uploaded to VirusTotal, upon inspection ESET Research discovered it to be an UEFI application.
• Further analysis confirmed that it is a UEFI bootkit, named Bootkitty by its creators; surprisingly, it’s the first UEFI bootkit to target Linux – specifically, several Ubuntu versions. The bootkit contains many artifacts, suggesting that this is more like a proof of concept than the work of a threat actor.
• ESET Research also discovered a possibly related kernel module, which we named BCDropper, that deploys an Executable and Linking Format (ELF) Linux program responsible for loading another kernel module.

BRATISLAVA — November 27, 2024 — ESET research has discovered the first UEFI bootkit designed for Linux systems, named Bootkitty by its creators. ESET believes this bootkit is likely an initial proof of concept, and based on ESET telemetry, it has not been deployed in the wild. However, it is the first evidence that UEFI bootkits are no longer confined to Windows systems alone. The bootkit’s main goal is to disable the kernel’s signature verification feature and to preload two as yet unknown ELF binaries via the Linux “init” process (which is the first process executed by the Linux kernel during system startup).

The previously unknown UEFI application, named “bootkit.efi”, was uploaded to VirusTotal. Bootkitty is signed by a self-signed certificate, thus is not capable of running on systems with UEFI Secure Boot enabled by default. However, Bootkitty is designed to boot the Linux kernel seamlessly, whether UEFI Secure Boot is enabled or not, as it patches, in memory, the necessary functions responsible for integrity verification.

The bootkit is an advanced rootkit that is capable of replacing the boot loader, and of patching the kernel ahead of its execution. Bootkitty allows the attacker to take full control over the affected machine, as it co-opts the machine’s booting process and executes malware before the operating system has even started.

During the analysis, ESET discovered a possibly related unsigned kernel module that ESET named BCDropper – with signs suggesting that it could have been developed by the same author(s) as Bootkitty. It deploys an ELF binary responsible for loading yet another kernel module unknown at the time of analysis.

“Bootkitty contains many artifacts suggesting that this is more like a proof of concept than the work of an threat actor.  Even though the current version from VirusTotal does not, at the moment, represent a real threat to the majority of Linux systems since it can affect only a few Ubuntu versions, it emphasizes the necessity of being prepared for potential future threats,” says ESET researcher Martin Smolár, who analyzed Bootkitty. “To keep your Linux systems safe from such threats, make sure that UEFI Secure Boot is enabled, your system firmware, security software and OS are up-to-date, and so is your UEFI revocations list,” he adds.

After booting up a system with Bootkitty in the ESET testing environment, researchers noticed that the kernel was marked as tainted (a command can be used to check the tainted value), which was not the case when the bootkit was absent. Another way to tell whether the bootkit is present on the system with UEFI Secure Boot enabled is by attempting to load an unsigned dummy kernel module during runtime. If it’s present, the module will be loaded; if not – the kernel refuses to load it. A simple remedy to get rid of the bootkit, when the bootkit is deployed as “/EFI/ubuntu/grubx64.efi”, is to move the legitimate “/EFI/ubuntu/grubx64-real.efi” file back to its original location, which is “/EFI/ubuntu/grubx64.efi”.

Over the past few years, the UEFI threat landscape, particularly that of UEFI bootkits, has evolved significantly. It all started with the first UEFI bootkit proof of concept (PoC) described by Andrea Allievi in 2012, which served as a demonstration of deploying bootkits on modern UEFI-based Windows systems, and was followed with many other PoCs (EfiGuard, Boot Backdoor, UEFI-bootkit). It took several years until the first two real UEFI bootkits were discovered in the wild (one of those was ESPecter in 2021 by ESET), and it took two more years until the infamous BlackLotus – the first UEFI bootkit capable of bypassing UEFI Secure Boot on up-to-date systems – appeared (in 2023 discovered by ESET).  A common thread among these publicly known bootkits was their exclusive targeting of Windows systems.

For a more detailed analysis and technical breakdown of Bootkitty, the first bootkit for Linux, check out the latest ESET Research blogpost “Bootkitty: Analyzing the first UEFI bootkit for Linux” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Bootkitty execution overview