BRATISLAVA – August 19, 2020 – ESET, a global leader in cybersecurity, has been highly commended in the KuppingerCole Market Compass 2020 report. The report analyzed ESET’s Endpoint Protection, Detection and Response solutions, including ESET Endpoint Security and ESET Enterprise Inspector, praising ESET for its universal coverage.

KuppingerCole Analysts is an international and independent analyst organization that supports companies, corporate users, integrators and software manufacturers in meeting both tactical and strategic challenges. The Market Compass provides an overview of a market segment and the vendors in the Endpoint Protection, Detection & Response (EPDR) market. It covers the trends that are influencing this market segment and the essential capabilities required of solutions in this space and provides ratings on how well the solutions meet expectations. 

ESET achieved high scores across all categories, achieving the third highest number of strong positives out of a total 17 vendors, with top scores in six out of nine criteria and the rest being evaluated as positive. KuppingerCole assesses vendor solutions on nine key criteria – Security, Interoperability, Usability, Deployment, Malware Protection, Threat Hunting, Automated Responses, Secondary EPP and Common Functions – with strong positive as the highest possible rating.  

In addition to broad support for a variety of operating systems, KuppingerCole cites ESET’s rare technical capability of being able to scan the Unified Extensible Firmware Interface (UEFI) as a core strength. ESET is further commended for its complete suite of detection and protection techniques, and excellent implementation of multiple, advanced ML algorithms for discovering malicious activity patterns. As one of the very few vendors on the market, ESET leverages Windows AMSI, and provides a Script Scanner, Advanced Memory Scanner and Ransomware Shield. The report also highlights ESET’s contribution to mapping the MITRE ATT&CK framework in order to facilitate analysis of malicious actors. KuppingerCole also commend ESET Enterprise Inspector’s support of interactive live querying and memory analysis with automated response options like network isolation of suspect nodes, process termination, moving/deleting files and running scripts.  

ESET Enterprise Inspector, ESET’s own proprietary solution for targeted attacks and advanced persistent threats, was previously evaluated in the KuppingerCole Executive View Report 2020. The report highlights ESET’s practice of publishing threat intelligence discoveries for the benefit of the community, and the additional detailed security analysis and threat research gained from ESET’s powerful cloud-based reputation system, the global LiveGrid®. ESET Enterprise Inspector can also generate attribution theories with high confidence levels, with customers having flexibility in creating rules for detection thresholds and alerting, filtering out certain conditions that may occur so as to reduce false positives, or customers themselves can design rules for assignment of attributes and even edit event attributes during investigations.  

Ignacio Sbampato, Chief Business Officer at ESET, commented, “At ESET, we are dedicated to providing cutting-edge security solutions for businesses, and we are proud to be continually recognized by expert analysts for our advanced software solutions. The digital threat landscape is constantly evolving and adapting, and it is vital that organizations and their systems are adequately protected. Reports such as the KuppingerCole Market Compass are vital in holding us accountable to the high standards we set for our solutions, and our dedication to keeping enterprises and their data safe and secure around the world.”

To find out more about ESET’s Endpoint Detection and Response solution, click here.

BRATISLAVA, PRAGUE –  ESET researchers yet again look into notorious Latin American banking trojans. This time they’ve explored Mekotio, a banking trojan targeting Spanish- and Portuguese-speaking countries: mainly Brazil, Chile, Mexico, Spain, Peru and Portugal. Mekotio boasts several typical backdoor activities, including taking screenshots, restarting affected machines, restricting access to legitimate banking websites, and, in some variants, even stealing bitcoins and exfiltrating credentials stored by the Google Chrome browser.

Mekotio has been active since at least 2015 and, as with other banking trojans ESET has investigated, shares common characteristics for this type of malware, such as being written in Delphi, using fake pop-up windows and containing backdoor functionality. To look less suspicious, Mekotio tries to impersonate a security update using a specific message box.

There are many technical details Mekotio is able to access from its victims, including information about the firewall configuration, administrator privileges, the Windows OS version, and a list of anti-fraud products and antimalware solutions installed. One command even tries to cripple the victim’s machine by attempting to remove all files and folders in the C:\Windows tree.

“For researchers, the most notable feature of the newest variants of this malware family is its use of an SQL database as a C&C server and how it abuses the legitimate AutoIt interpreter as its primary method of execution,” elaborates Robert Šuman, the ESET researcher leading the team of investigators focused on Mekotio.

The malware is predominantly distributed via spam. Since 2018, ESET researchers have observed 38 different distribution chains used by this family. Most of these chains consist of several stages and end up downloading a ZIP archive – a well-known behavior of Latin American banking trojans.

“Mekotio has followed a rather chaotic development path, with its features being modified very often. Based on its internal versioning, ESET believes there are multiple variants being developed simultaneously,” adds Šuman.

For more technical details about Mekotio, read the blogpost “Mekotio: These aren’t the security updates you’re looking for…” on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

Countries affected by Mekotio