BRATISLAVA – October 29, 2020 – ESET, a global leader in cybersecurity, has released its Q3 2020 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research – including previously unpublished ESET research updates. The report and its findings were exclusively presented during the “ESET European Cyber Security Day – Towards a Secure Post-COVID Future” virtual event.

After months of abusing the COVID-19 theme in their campaigns, cybercriminals appear to have returned to their usual tactics in the third quarter of 2020, the Q3 2020 Threat Report shows. An area where the risks remain particularly high, however, is remote work.

ESET telemetry showed further growth in attacks targeting Remote Desktop Protocol (RDP), which grew throughout H1. While the number of unique clients targeted rose by more than a third, the total number of attack attempts surged by 140%. “The continued rise in RDP attacks may be a result of the growing number of poorly secured systems being connected to the internet during the pandemic, or possibly other criminals taking inspiration from ransomware gangs in targeting RDP,” comments Jiří Kropáč, Head of Threat Detection Labs at ESET.

Other key trends observed in Q3 were the revival of cryptominers, Emotet returning to the scene after months of inactivity, and Android banking malware surging following the source code release of the notorious mobile banking trojan Cerberus.

The ESET Q3 2020 Threat Report also reviews the most important findings and achievements by ESET researchers. Among many other findings, they uncovered more Wi‑Fi chips vulnerable to KrØØk-like bugs, exposed Mac malware bundled with a cryptocurrency trading application, discovered CDRThief targeting Linux VoIP softswitches, and delved into KryptoCibule, a triple threat in regard to cryptocurrencies.

The exclusive research presented in the Q3 2020 Threat Report includes campaigns leveraging malicious MAXScripts, the spread of Latin American banking trojans to Europe, new activity of the TA410 threat group and a look into the updated arsenal of the Gamaredon Group.

Besides these findings, the report also recapitulates the many virtual talks held by ESET research specialists in Q3, introduces talks planned for the upcoming quarter and provides an overview of ESET’s contributions to the MITRE ATT&CK knowledge base.

For more information, check out our ESET Threat Report Q3 2020 on WeLiveSecurity.

Make sure to follow ESET research on Twitter for the latest news from ESET Research.

BRATISLAVA – 28 October, 2020 – ESET, a global leader in cybersecurity, has been recognized by TrustRadius with a 2020 Tech Cares Award. The award celebrates companies that have gone above and beyond to provide their communities, clients and frontline workers with support throughout 2020 and during the COVID-19 crisis. While over 100 tech companies were recognized, ESET was one of just two cybersecurity vendors to receive the award.

TrustRadius is the fastest growing review site and insights platform for businesses, helping buyers make better product decisions based on unbiased and insightful reviews. The review site launched the Tech Cares Award in response to the unique challenges that 2020 has posed for tech, and in recognition of the companies who have risen to meet the needs of those around them.

In collaboration with the scientific community in Slovakia, ESET developed the first testing kit for COVID-19 in Slovakia, donating 100,000 kits to the Slovak Republic. Recognizing the importance of education in light of rising cyber crime and a newly remote workforce, ESET launched extensive educational activities for both the general public and expert community around cybersecurity awareness, including Remote Desktop Protocol and VPN security, encryption and backup.

The Tech Cares Award recognizes companies that have contributed directly to combat the virus, either with their products, knowledge or financial support. The award is based on user feedback and TrustRadius community nominations. Users highlighted how the nominated organizations have acted selflessly in support of their customers throughout the pandemic, and the research team at TrustRadius individually vetted each nominee to ensure that their actions met the standard for outstanding conduct and support during the COVID-19 crisis.

This is the second time ESET has been recognized for activities undertaken during the COVID-19 outbreak. The What the Next Normal Will Be Post-COVID-19 report by leading IT market research and advisory firm, IDC, outlined the top 10 changes we can expect, inspired by the initiatives of industry leaders, and also highlighted the support ESET provided during the COVID-19 crisis.

Ignacio Sbampato, Chief Business Officer at ESET, commented, “ESET is immensely proud to have been recognized for the actions it has taken to support businesses and individuals during the COVID-19 pandemic. As a company, we endeavor to put people at the heart of everything we do – whether this is providing specialized educational resources for teachers or extending free trials of our products to support those who may be suffering financially. ESET cares deeply about the communities it serves globally, nationally, and locally and has created a Fund for Effective Diagnosis & Prevention of SARS-CoV-19, initially donating €300,000. We are honored to be among the few cybersecurity vendors to receive an award and will continue to work to give back to the community as we move forward through the Coronavirus crisis and into the future.”

“We are excited to announce our first-ever Tech Cares Award Winners,” said TrustRadius CEO Vinay Bhagat. “This pandemic isn’t just a test of fortitude. It’s an opportunity to distinguish yourself. We have been completely inspired by the way the B2B technology industry responded to COVID-19. So many companies pivoted with grace, leading to many of them standing out in our minds as major community contributors during this time. Not only do we feel that these companies are deserving of recognition — we also consider their example when deciding how we ourselves can find new ways to give back.”

To find out more about ESET’s initiatives during COVID-19, click here.

BRATISLAVA – ESET, a global leader in cybersecurity, has today launched new versions of its Windows security products for consumers. The new versions upgrade the protection in ESET Internet Security, ESET NOD32 Antivirus and ESET Smart Security Premium.

The wide range of security improvements cover malware detection, online banking, password security and smart home support – in line with ESET’s goal to create a safer digital world for everyone to enjoy. With the ever-increasing volume of reported cyberattacks, it is vital that users are secured in their online activities. These product updates address key issues, including online payments and banking-related threats, identity theft and leaking of personal information, stolen passwords and connected device security.

ESET is continuously improving its solutions to ensure that users are equipped with the very latest technologies in cybersecurity while keeping a low system footprint. The updates bring fine-tuning of the Host-Based Intrusion Prevention System and Advanced Machine Learning modules, along with a significant reduction in the size of the Machine Learning module.

Other key updates include the new Windows Management Instrumentation (WMI) and System Registry scanners capable of detecting malware that uses the WMI or the registry maliciously. The Connected Home module is also improved with better connected device detection and security issue troubleshooting.

Financial security is a top priority, and the upgraded Banking & Payment Protection features a special secured browser mode through which users can safely pay online. The new feature allows users to run any supported browser in secured mode by default. With secured mode on, the communication of the keyboard and mouse with the browser is encrypted to guard against keylogging. In addition, Banking & Payment Protection now also notifies users when Remote Desktop Protocol (RDP) is turned on to alert them about the danger of malware abusing RDP.

Finally, ESET Password Manager has been completely rebuilt with new functionalities such as remote logout from websites and remote clearing of browser history, and is available via both browser extensions and native mobile apps.

Commenting on the updates, Matej Krištofík, product manager at ESET, said, “As cyberthreats continue to evolve in sophistication and frequency, it is vital that consumers and their devices are protected on every level. Technology is at the center of our lives, from online banking to connected homes, so it is more important than ever that our personal technology is safe and secure. We are proud to offer our latest Windows security product updates to consumers, reflecting our dedication to consistently improve and innovate in order to provide a safe digital experience for all.”

To find out more about ESET’s home security products for Windows, click here.

Each year, around autumn, ESET releases a new version of its Windows offering for home customers. This year sees the arrival of the fourteenth version of the home Windows lineup, with a long list of new and improved features for users. With cyberattacks surging massively over the past few months, this update meets users’ need for comprehensive online security in times of uncertainty and increased threats.

Included in the updates are ESET Internet Security, an advanced security solution that brings rock-solid protection for modern web users; ESET NOD32 Antivirus, a fast and light solution that is perfect for gamers and everyday users who don’t want any interruptions; and ESET Smart Security Premium, a comprehensive product built without compromise for users who want it all, including extra data encryption and easy password management. With the aim of creating a safer digital world for everyone to enjoy, version 14 adds a series of new features to these products, along with improvements in malware detection, online banking and password security.

A crucial upgrade was made in the Advanced Machine Learning module, which now has better detection while retaining a tiny footprint. The improvements in the data selection and algorithm components will lead to increased detection of threats, including those transmitted via email. Synchronous Advanced Machine Learning in the Cloud, which runs more heavyweight detection models on cloud platforms, also brings considerable improvements for the detection of new malware.

Similarly, ESET is continually working to improve behavioral detection, with a focus on extending protection across system components that are typically abused by malware. To this end, the Host-Based Intrusion Prevention System, which utilizes advanced behavioral analysis to protect your system from malware and unwanted activity, has also been bolstered with further detection methods. This includes improved detection of ransomware and other malware using suspicious encryption and decryption API calls.

The update also provides users with new protection in the form of the Windows Management Instrumentation (WMI) and System Registry Scanner, which are capable of detecting malicious uses of the WMI and the system registry.

Finally, version 14 also brings changes to Banking & Payment Protection, including a “secured browser” mode through which you can safely pay online. This mode gives users the option to run any supported browser in secured mode by default; after it has been set up, the browser will always start in secured mode. The improved Banking & Payment Protection automatically protects users when banking online and when accessing web-based cryptocurrency wallets. The update encrypts the communication of your keyboard and mouse for safer transactions in your browser, and notifies you when Remote Desktop Protocol is on – a possible sign that malware is spying on you.

For more information about the full list of features included in ESET’s home Windows offering, please see here.

Botnets are one of the top cyber threats to look out for in 2020, according to Forrester, and with a dispersed, remote workforce, many organizations may be more vulnerable than ever before. Botnet operations can become incredibly sophisticated, carrying out a wide range of illicit activities: collecting browser information, harvesting passwords, stealing login credentials from banking websites, or deploying ransomware.

One of the most infamous botnets is Trickbot, which has compromised over a million computing devices around the world since 2016. Earlier this month, ESET helped to disrupt Trickbot in a global collaboration with Microsoft and other partners.

ESET first detected Trickbot in late 2016, and it has since been recognized as one of the most prevalent banking malware families across the globe. The botnet has targeted several different industries – including education, real estate and government – but the most frequently targeted seems to be the financial sector. With its capabilities for stealing banking credentials and performing fraudulent transactions, Trickbot is a threat to financial data at any business, so businesses must be prepared to protect themselves against this threat.

Trickbot is extremely versatile, with a modular design that allows it to perform an array of malicious actions using a variety of plugins. ESET analyzed nearly 30 different plugins, of which over a third were infostealers. One of these, named injectDll, uses browser hooks to steal user credentials from banking websites, allowing Trickbot’s operators to perform fraudulent bank transfers and steal money from individuals and organizations. Another plugin, known as pwgrab, steals passwords from Filezilla, Microsoft Outlook and WinSCP. These are just two examples of the damage Trickbot could wreak on businesses once it has infested your systems.

A prolific distributor of ransomware – one of the largest threats to the upcoming US election – Trickbot is also a potential danger to election infrastructure. Operators of the botnet could infest a computer system used to report results or store voter rolls, sowing high levels of chaos and distrust among the electorate. The collaborative operation to disrupt Trickbot helped cut off key infrastructure, meaning that the botnet operators are no longer able to initiate new compromises or deploy ransomware as easily.

ESET telemetry shows Trickbot detection numbers plummeting in tandem with the disruption effort:

Figure 1: Trickbot detection numbers from July to October 2020

While the threat of Trickbot seems to have lessened for now, maintaining vigilance for other botnet attacks is still paramount. At the same time as Trickbot’s disruption, the rising detections in ESET telemetry for the Emotet botnet indicated a ramping up of Emotet’s activities, even downloading Trickbot, as well as Qbot, malware:

Figure 2: Emotet detection numbers from July to October 2020

The Emotet malspam campaign was recently bombarding users in Greece, Japan and Lithuania:

Figure 3: Countries most targeted by Emotet from July to October 19, 2020

Facing such a threat may seem like a daunting task, but there are a few ways businesses can protect themselves from botnet operations. Primarily, it is crucial to protect all endpoints with a security solution that has robust detection modules, such as ESET Endpoint Security. Businesses also need to ensure that their networks are always patched with the latest security updates to avoid falling victim to vulnerabilities that threat actors may exploit. Additionally, remote ports can provide an access point for hackers, so restrict access as far as possible – especially to remote desktop protocol (RDP) ports.

To find out more about ESET’s efforts to disrupt the Trickbot botnet, read ESET takes part in global operation to disrupt Trickbot on WeLiveSecurity.