The days of simple and easily detectable malware are long gone. Recent campaigns by both OilRig and MuddyWater advanced persistent threat (APT) groups show that threat actors are constantly seeking new ways to hide their multistage malware attacks among files of commonly used cloud services. 

This presents a dilemma for managed service providers (MSPs) that rely heavily on cloud-based solutions. But how should MSPs defend against increasingly sophisticated attacks without the burden of trying to control every single stream of communication within the MSP environment?

A growing market and a growing threat

With the never-ending hunger for cloud-managed services, it is no surprise that the MSP market is constantly expanding, and business reports, such as MarketsandMarkets, expect further growth by around $100 billion U.S. dollars within the next five years.

Both MSPs and other outsourced business practices have proven to be the answer for countless companies seeking high-end solutions for reasonable prices. But there are two sides to every coin. Professional communications, services, and shared files all moving to the cloud has created a new breeding ground for sophisticated malware.

Threat actors deploying this malware are often profit-driven and/or state-sponsored APT groups using command-and-control (C&C) servers to communicate with compromised devices over targeted networks. When successful, these servers can issue commands to steal or encrypt data, spread malware, disrupt web services, and more.

To enable this approach, APT groups need to establish persistence within the targeted businesses, obfuscating malicious files and processes among legitimate ones.

A draft email you’ll never send … nor ever even wrote

ESET researchers have described recent attacks in detail while following the evolution of campaigns run by the OilRig group.

To avoid cybersecurity scanning tools, OilRig has not been deploying fully fledged malware but, instead, has scaled its attacks. While the initial attack vector of the recent campaigns remains unknown, presumably it was a phishing email. This email would contain a downloader that wouldn’t cause any specific damage but, as the name implies, is designed to secretly download additional malware from the internet. Several versions of these downloaders have been documented by ESET researchers.

Studying these downloaders, it is clear that OilRig is keenly focused on identifying new ways to obfuscate malware deployment using legitimate cloud service providers for C&C communication.

The first in the series, SC5k downloader, uses the a shared Microsoft Exchange email account and Microsoft Office Exchange Web Services API for C&C communication. Within this email account, the attackers create draft messages with hidden commands. Once the downloader infests a device, it will log in to the same account to receive both the commands and the payloads to execute. Its successor, OilCheck, works similarly but uses the Outlook mail API in Microsoft Graph. 

New versions of OilRig downloaders, ODAgent and OilBooster, communicate using the Microsoft Graph OneDrive API. They access a OneDrive account controlled by the attackers for C&C communication and exfiltration.

The evolution of malware-hiding capabilities was also recently noted in the case of another APT group linked to Iran called MuddyWater. 

In a separate MuddyWater campaign, described by DeepInstinct, the APT group reused previously known remote administration tools and hid them in the cloud-based content management system (CMS), called Storyblok, to host archives with compromised files.

ESET to help deal with the dilemma

The hiding capabilities of present-day C&C attacks have pushed businesses toward higher control over their network traffic. From standard network monitoring, it can go as far as individually authorizing any network connection.

However, the higher the control, the higher the workload on MSP admins and technicians who are already drained from a never-ending stream of alerts. So what do businesses choose: strict control that comes with alert fatigue or lower security standards that can result in a data breach?

With its MSP Program, ESET can help businesses deal with this dilemma. The program is based on the ESET PROTECT solution, which provides multilayered protection, and its higher tiers also integrate ESET Cloud Office Security (ECOS), which is designed to protect Microsoft 365 and Google Workspace applications.

ECOS — effectiveness in numbers*

• 750,000 email threats detected
• 360,000 phishing emails blocked
• 21 million spam emails captured

*7-month period in 2023

In fact, these ESET security solutions can disrupt the described C&C processes at several stages, which means that companies don’t have to focus on network control as much.

Anti-phishing protection

Though the initial attack vectors of OilRig and MuddyWater campaigns are unknown, both APT groups have successfully kicked off their campaigns with phishing emails in the past. ECOS prevents users from accessing web pages known for phishing once they click on the phishing link in the email.

Antimalware protection

ESET’s defense against malware eliminates all types of threats. Moreover, ECOS scans all new and changed files in OneDrive, Google Drive, Microsoft Teams, and SharePoint Online.

ESET LiveGuard Advanced

If ESET malware detection engines detect a never-before-seen type of threat, they pass the file to the ESET cloud-based sandboxing tool ESET LiveGuard Advanced for further assessment.

Multi-tenant

ECOS multi-tenant functionality allows you to protect and manage multiple Microsoft 365 and Google Workspace tenants from one ESET Cloud Office Security console.

Conclusion

The growth of cloud-based business practices has ushered in cloud-based cyberattack tactics that MSPs need to deal with. And the results can be dire. With their privileged access to business networks, compromised MSPs can also be dangerous for their clients by triggering a supply chain attack.

The good news is that you don’t need to face those threats alone. Since its foundation in 1992, ESET has developed a robust multilayered defense system capable of stopping C&C attacks at different stages and much more. ESET solutions are also available for MSPs as a part of the ESET MSP Program. Don’t be the weak link in supplier relationships. Be the strongest. 

A group of malware researchers recently discovered a new trojan variant of the notorious Mirai malware botnet. The story of Mirai has been a fascinating one, to say the least. From one of the most prevalent and widely detected threats dating back to 2016 to its many variants and global reach that never truly seems to die, the Mirai botnet has evolved to hijack consumer-grade Internet of Things (IoT) devices on and off for more than seven years. The creators have since been caught; however, Mirai-based botnets remain a threat as the code lives on. It has given birth to many variants and continues to mutate, resulting in the tale at hand today.

This new variant of the Mirai malware has been spotted infecting inexpensive the Android TV set-top boxes of millions of users. This new trojan is a new version of the “Pandora” backdoor that first appeared in 2015.

Its primary targets are budget-friendly Android TV sets, but ESET Mobile Security has been able to block it on both Android TVs and Android smartphones in over 30,000 instances since September 2023. The way it infects a device is by the user downloading a seemingly legitimate app to stream content. These apps can be downloaded from websites dedicated to smartphones, TVs, and Fire TV Sticks.

The apps themselves promise to provide a wide range of TV shows and movies for the user to watch for free, via a trial account or with a premium account. The specifics of this particular type of threat is that its malicious functionality doesn’t present visually to the user, and there are virtually no signs that any malicious activity is happening on the device, or signs that the app might be malicious. Even the permissions the apps asks for don´t appear to be intrusive.

One of the reasons people are tending to opt for cheaper streaming services and TV boxes may be the cost of living crisis, as well as the high prices associated with multiple mainstream streaming platforms. However, there are costs to users who try to get “a deal.” These cheaper hardware options are often manufactured quickly without much thought to their security, a feature they share with many other IoT devices. This leaves them more vulnerable to tampering, specifically the potential for firmware alterations. So, even for those who are conscious and selective about the apps that they install, the device might arrive to them with preloaded malware.

The importance of trusted security software

As we have established earlier, in this instance, to the naked eye, it is virtually impossible to realize whether or not a device has been infected. Furthermore, since users have no way of knowing if apps they’d like to use with their devices are malicious or not, they would have no reason to uninstall and delete them from their devices.

To avoid infection and worry, users can employ ESET Mobile Security (EMS), which is able to detect and block this and similar threats during the download process, even before installation occurs. This means that the threat never reaches the user. EMS can also be used to scan already existing apps and downloads to double-check that you haven’t bought the devil in disguise. In the case of a malicious app or download, EMS alerts users that malicious code has been detected — as seen on the picture below.

While it is always essential to stay alert, use of a security solution proves itself time and time again to be critical in combating the cyberthreats of today. It adds a layer of security, one that human vigilance cannot, and ensures you have a smooth, safe, and uninterrupted online experience.

A new smartphone may sound like the perfect Christmas present until there is malware hidden in the device or the person´s identity gets stolen.

Smartphones have become an inseparable part of our lives, allowing us to communicate, make transactions, play games, or read news on the go. These devices became so prevalent that average screen time for users around the world reached 3 hours and 46 minutes in 2023, according to the Independent. Given this number, it is no surprise that 22% of people in the US have asked for a mobile phone as a Christmas present in 2022, according to Statista’s Global Consumer Survey.

The joy of finding a new smartphone under the tree is undeniable. However, there are a few things you should keep in mind before you start using it.

1. Update software – keeping your software up to date is a crucial step in security as new updates fix bugs and vulnerabilities.
   
2. Review app permissions – check and manage app permissions to restrict access to sensitive information and only grant necessary permission for each app.
3. Review and customize privacy settings – go through the settings and customize them according to your preferences (or even better, security experts’ recommendations).
4. Use a reliable security solution – using a reputable security software is key to making sure your device stays healthy longer, so you can continue enjoying your gift for as long as possible.

There are other Christmas temptations than just sweets

With its holidays and festivities, the end of the year is often a period when cybercriminal activity surges. The most common threats around the holidays include online shopping scams, delivery phishing scams or even gift card scams and identity theft and much much more.

Sometimes scammers even create fake online stores offering Christmas sell-offs with the intent to steal your money and data. Most likely, they want to trick you into downloading malware or get hold of your personal data.

For example, in late 2022, the holidays celebrated in December led to increased phishing activity impersonating unspecified online shops. Moreover, when mobile game developers rolled out new releases before Christmas, attackers exploited the hype by uploading their modified malicious versions to third-party app stores, according to ESET Threat Report T3 2022.

In turn, ESET researchers observed a significant increase in Android adware detections by 57% in the last few months of 2022, having been driven by a staggering 163% increase in adware and a growth of 83% in HiddenApps detections.

These are just the campaigns that ESET researchers detected at the end of 2022. Your brand-new smartphone can also fall victim to a ransomware attack, it´s vulnerabilities can be exploited and don’t forget the “old-fashioned” physical theft. 

How to bring the Christmas joy back?

To protect your smartphone, stay vigilant when browsing the web or the app store and install a high-quality cybersecurity solution that protects against most of these threats. 

ESET Mobile Security (EMS) Premium for Android deals with all of the situations we outlined earlier. Besides Antivirus Scan and Adware Detector, which are part of the free version, ESET Mobile Security Premium also includes features that turn this solution into a complex, multilayered protection capable of deflecting a wide scope of attacks.

The long list of features includes Payment Protection, Anti-Phishing, Call Filter, Anti-Theft and much more. On top of that, the latest version, EMS 9, brings a new, redesigned, and simplified installation wizard.

All these juicy features now come with a generous price drop, making it a gift that keeps giving. From December 23rd to January 6th , the premium version of ESET Mobile Security will be 50% off. There is no need for a promotional code; the discount will automatically be added to your checkout! It couldn’t be easier.

Boost your smartphones security for a more connected and hassle-free holiday. Stay safe, not just during Christmas, but all year round. The gift of a smartphone is one that can keep on giving or taking. May your holiday season be filled with joy and your digital experiences be not only festive, but also secure.

Wishing you a merry Christmas and a digitally protected New Year!