Skip to content

Leveraging automation and UX to reduce admin decision fatigue on detection and response platforms

Multiple factors complicate admin decisions involving threat mitigation and remediation. Alert fatigue, from sifting through myriad detections and dashboard clutter all have costs: human, time, security, and financial. In response, ESET has engineered more clarity into our detection and response module, paying big dividends for budget holders and security admins alike.

New functions in ESET Inspect, the XDR-enabling component within our unified cybersecurity platform ESET PROTECT, assist security admins in correlating detections to related entities.

Image 1: Incident Creator displays multiple prioritized entities to reduce alerts and simplify admin decision points concerning mitigation and remediation options including: Timeline, Relation Graph, Detections, Computers, Executables, Processes, Incident.

Investigating incidents through the lens of these related entities supersedes the need to filter through large numbers of detections. And, only, when necessary, would the admin need to drill down deeper to the level of detections -related to the incidents- as well as the events that triggered those detections. 

Improved efficiencies around these tasks have been delivered in ESET Inspect via the new Incident Creator feature, which performs a correlation of detections and entities. This correlation enables IT security admins to visualize the relationships between multiple prioritized network entities by recognizing patterns across detections and entities, and intelligently grouping these critical clues into incidents.

Quick takeaway – ESET Inspect Incident Creator

The representation (image below) shows the correlation of entities (interactions between tools, files, and even systems) generated by the Incident Creator. In it, an admin can quickly determine the relationship between the detection of Filecoder malware, aka Ransomware, and other incidents detected by ESET PROTECT (our unified cybersecurity platform).

In this case, the admin viewing the dashboard can immediately gain an overview of what’s happening or what has already happened. They are provided with prioritized context concerning severity and other crucial information via a system of tags and alerts. Depending on the admin’s maturity, they might (for example) skip the MITRE ATT&CK linked tactics techniques and procedures, with their eyes drawn instead to the number of machines affected or detected executables.

At the center, we see a specific machine (wk-beach-head01.dem.lan) surrounded by a red circle denoting the severity (Red = Threat, Yellow= Warning, Blue= Info) of the detection. The admin can quickly identify a number of executables and related prioritized processes at work. Two executables stand out here: (c.) and (powershell.exe). These are highlighted in red in the image below.

The clear layout of the incident “Pane” (at right) allows a quick appraisal of the situation. With their eyes moving back to the Incident Creator graph, a pattern of lateral movement quickly emerges. The admin can see incidents that not only affect Windows machines, but also Linux (Ubuntu Server) and macOS machines with dedicated scripts.

The dashboard also clearly highlights both the abused legitimate tools (in blue) as well as dedicated malware scripts and executables* in (red). This literally helps connect the dots, a big plus with quick remediation and incident response phases but is also helpful with later forensic analysis.

*Another machine, osx1201, circled in Yellow (warning), is also located in relation to a critical executable.

The never-ending search for experience

Since neither detection and response tools nor the staff that operate them come cheap, companies logically demand concrete return on investment once detection and response is deployed. The Incident Creator capability thus supplies a notable boost to the analytic logic needed by admins, threat hunters, and SOC teams to raise security via improved configuration options, for example. These can be applied either to increase the detection sensitivity if they are more risk-averse, or to create exceptions suited to their specific environments to reduce noise. This ultimately requires staff to employ their knowledge and confirm the organization’s trust in solid events analysis and correctly prioritizing protection decisions.

An admin consulting a dashboard where the correlation between these factors is visualized becomes a faster learner, more confident, and a more competent defender. A defender that can look beyond the automated categories of monitoring and detection found in an endpoint protection product and track cyber threats where some imprint of misused human intelligence may lay.

Hiring vs. building a top-flight admin . . . at the right cost

Laying hands-on mature IT security staff/Security Operations Center (SOC) staff has become the number one job for many CISOs and their HR recruiters. Once candidates are located, there is the inevitable moment when the elephant in the room comes into view, and the question is asked if the candidate has enough practical experience with detection and response products and processes to make an impact.

The reasons for caution are widespread, but as much as detection and response tools are proven to provide a powerful set of insights into a network and its endpoints, their use is demanding. Experienced admins are even harder to secure than cost-effective products.

Identifying a product that pairs great visibility and usability, with proportionately low total cost of ownership (TCO) ratings and features supporting on-the-job maturation, becomes a critical part of the equation. Many of these critical attributes are explored at a high level by tests like AV-Comparatives recent Endpoint Prevention & Response (EPR) Test 2023. However, the features supplied by tools like ESET Inspect are what make or break the user experience for Security admins tasked with delivering and improving security on your network.

Closing the gap between the EDR skills and experience possessed by a top-flight admin, versus supporting and maturing a journeyman admin in evolving into a top-flight pro may be best addressed by providing them with the insight necessary to classify threats and prioritize mitigation. Best enabling your team in this regard means providing tools that reduce the burden of analysis and interpretation of data from the detection and response dashboard concerning network incidents and enabling less-experienced IT security admins to understand the relationships between multiple entities.

Human value-add

With more complex threats and attacks, only another human intelligence – that of a security defender – may be able to spot an attack before too much damage is done.
At the minimum, a defender armed with an XDR-enabling module like ESET Inspect with Incident Creator (graphing) is empowered to rapidly contextualize the severity of incidents within their increasing familiarity of the environment. That, and being provided with the right filtering of entities to reconstruct the sequence of steps that an attack followed from start to finish both raises their game and builds further experience and network context while supporting an ever-improving security trend.

Simply put, if the move to detection and response begins with an optimized dashboard that includes incident creation, then the resultant experience gains of your IT admins and steady progress made by your business toward better security will likely be worth the effort.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET partners with Dutch telecommunication & IT provider KPN

  • ESET and KPN join forces to protect their customers from unwanted, malicious, and fraudulent content
  • ESET NetProtect solutions provide network security for the whole household and IoT devices for KPN customers

BRATISLAVA, December 6, 2023 — ESET, a globally recognized leader in cybersecurity, today announces its strategic partnership with a Dutch company, KPN, the leading telecommunications and IT provider in the Netherlands. Through this collaboration, ESET introduces ESET NetProtect to KPN’s customers, a cutting-edge DNS Filtering solution designed to protect home networks, including IoT devices, against malware, phishing, and unwanted content.

KPN takes its customers’ security very seriously. In 2022, 15% of the Dutch population were victims of cybercrime, out of which, 50% were online scams and financial fraud, and hacking was experienced by 20% of recipients, which is why KPN and ESET are coming together to deliver the best solution to their customers. KPN, an internet service provider, wants to protect the traffic on its network and, ultimately, protect its customers by creating a safe and secure internet environment.

ESET NetProtect functions by filtering DNS (Domain Name System) before they are accessed by devices connected to household connections via routers. For KPN’s customers, the services are effortlessly activated with a single click through the user’s trusted internet provider, ensuring automatic protection for all connected devices.

This is particularly useful nowadays since households use both smart and IoT devices that cannot be secured by traditional security software and ESET NetProtect provides the protection for an uninterrupted experience. For devices with already installed protection, ESET NetProtect works as an additional security layer to the ecosystem.

ESET NetProtect is a formidable shield, preventing sensitive information, such as bank card details, from leaking via phishing or scam websites, leveraging DNS filtering to provide smooth and reliable protection. One of ESET NetProtect´s biggest advantages is its one-click activation. This creates a solution that is easy to use for all ages and cyber-knowledge groups, making security even more accessible. On top of that, this layer of security makes it harder for new threats (such as the use of AI in phishing, which makes malicious messages seem more believable and harder for the naked eye to recognize) to get through to the end user. This is especially important for parents who want to keep their children safe while online unsupervised. The solution also includes a monthly summary of malicious sites and thwarted cyber threats as well as Malware and Phishing Filter and Potentially Unwanted Content Protection.

Through the user-friendly management portal, end-users can easily configure ESET NetProtect settings for their connected devices, manage domain permitted and blocked lists, and generate security reports. This portal offers valuable insights into ESET’s protection mechanisms. All of these solutions were developed to protect devices linked to Telco and ISP networks, shielding them from a multitude of threats.

Reliable security, that is easy to use, is a priority, supported by local customer service and comprehensive protection that stays one step ahead of online threats. This is made possible through ESET’s extraordinary database of malware detections compiled from its global network of research and development centers.

Mária Trnková, Chief Marketing Officer at ESET, shared, “People and their security are the top priority for us at ESET. New emerging technologies are undeniably becoming an integral part of our day-to-day lives, however, the threat landscape is not falling behind. The threats are getting more sophisticated, which is even more important now, than ever before, to deliver easy-to-use reliable solutions, that can ensure our protection. With ESET NetProtect we have crafted such a solution and we are delighted to now protect KPN´s customers.”

Gijs Isbouts, VP of KPN Veilig: “Smart TVs, smart lamps or a smart (energy) meter,.. we are increasingly digitally connected and the number of smart devices in our homes has skyrocketed, so it feels like a mission for us to ensure that our customers really feel safe online. New times call for new solutions, and that is exactly what we are tackling here together with Eset. Our solution KPN Safe Network at Home, which we offer together with Eset, enables our customers to maintain control over their online security at home, without having to be technically skilled and the great thing is, that you enable it with just the click of a button.”

Read more about ESET NetProtect here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

When an employee’s social mindset becomes a threat to business

In today’s business environment, where innocent GIFs and shared documents can be weaponized, protecting cloud-based collaboration from the spread of malware should be a priority.

As our lives settle ever deeper into online environments and digital behaviors, cybercriminals are leveraging new vectors that allow for phishing, data theft, and spreading malware. Recent incidents show that mixing people’s professional and personal minds (an ever-present human factor) can create new weaknesses in a business’s cybersecurity.

Imagine your employees browsing their favorite social media platform on their personal time; they might find an interesting picture or emoji and its embedded link, which they then share — no one would mind such a distraction. Now, imagine your employees checking their various professional chats and threads; something between their personal and professional interests sparks their minds. Hence, they react by sharing an article, an interesting picture, or an emoji and its embedded link. This time, they share with their colleagues on a cloud-based platform such as Microsoft Teams . . . just for fun or even for professional inspiration.

A pretty common thing in an office, right? Well, bad actors can abuse even these everyday activities. Putting it simply, behaviors common to navigating and enjoying social media platforms can raise risks for business platforms, which have now become ubiquitous for small and medium businesses (SMBs) and enterprises alike.
Fortunately, multilayered ESET cybersecurity technology has an answer for such incidents with ESET Cloud Office Security (ECOS), which is now expanding beyond Microsoft 365 applications to include the Google Workspace.


Image 1. ECOS Dashboard with an overview of protected apps

Sharing reports, jokes, and malware

Let’s start with weaponized pictures, GIFs, and emojis. The technique of concealing a file, message, image, or video within another file, message, image, or video is called digital steganography, and it is nothing new in cybersecurity.

The first documented case of its use in a cyberattack dates back to 2011, when the Duqu malware was discovered. This malware gathers data about the infected device and transmits them back to the command-and-control (C&C) server hidden in a JPEG file meant to look like an innocent picture.

Since then, ESET researchers have analyzed numerous similar attacks.

In 2022, BleepingComputer reported about a new attack technique called GIFShell that allows threat actors to abuse Microsoft Teams for phishing attacks and executing commands to steal data using GIFs.

Using numerous Teams vulnerabilities, GIFShell allows an attacker to create a reverse shell. This technique tricks users into installing malware that connects the victim’s device to the attacker’s command-and-control server. After the connection is established, the command-and-control server delivers malicious commands via weaponized GIFs in Teams. These commands can, for example, scan the device for sensitive data and then exfiltrate the output, again, through GIFs retrieved by Microsoft’s own infrastructure.

Large cloud-based platforms like Microsoft 365 with its Teams app saw rapid growth during the pandemic and, by Q1 2023, had approximately 280 million users. With such growth and new online behaviors, the scope for abuse on large platforms has only grown.

However, increasing attention has been shown to these threat vectors by researchers. In June 2023, UK-based security services provider Jumpsec’s Red Team discovered an easy way to deliver malware using Microsoft Teams via an account outside the target organization. Even though Microsoft Teams has client-side protection preventing file delivery from external sources, Red Team’s members bypassed it by changing the internal and external recipient ID in the POST request of a message.

That way, researchers were able to fool the system into thinking that an external user was, in fact, an internal account. Specifically, they successfully delivered a command-and-control payload into a target organization’s inbox. If this attack had happened in a real-life environment, bad actors could have taken over the control of a business’s devices.

Users shielded via multilayered protection

To deal with threats coming from increasingly popular cloud-based applications, ESET created its Cloud Office Security (ECOS) solution. It is a powerful combination of spam filtering, anti‑malware scanning, anti‑phishing, and advanced threat defense capabilities able to mitigate even never-before-seen threat types.

With this multitenant and scalable product, businesses can protect their entire Office 365 suite, including Exchange Online, MS Teams, OneDrive, and SharePoint Online. For example, one of the things that ECOS does is that it scans all files transmitted through MS Teams and those uploaded or downloaded to SharePoint Online, scanning it regardless of who the author of the content is.

ECOS effectivity in numbers:

  • In the first ten months of 2023, ECOS detected and blocked over 1 million email threats, over 500,000 phishing emails, and over 30 million spam emails.
  • Thousands of never-before-seen detections were made by the cloud analysis component of ESET LiveGuard Advanced.
  • ECOS detected and stopped tens of thousands of threats in cloud storage and collaboration tools like OneDrive, Teams, and SharePoint.

In its latest offering, ESET goes even further, integrating ECOS with Google Workspace to protect users from the aforementioned threat types. This means that ESET now protects the major cloud email providers.

Adding more protection

The many functions outlined here are critical for security in large part because they scale easily and provide concrete improvements for businesses. However, ESET has sought to do even more for SMBs. In October 2022, ESET endpoint security solutions integrated with Intel® Threat Detection Technology (Intel® TDT), which went live for select vPro 9th Gen (and higher) powered laptops, with integrated functionalities providing improved hardware-based ransomware detection.

This year has seen further improvements to the integration with the higher performance of the newly launched 13th Gen Intel® Core™ processors, which further enable unique ransomware detections shared between ESET endpoint security and its layers, and Intel’s performance monitoring unit (PMU) sitting beneath applications, the operating system, and virtualization layers gathering CPU telemetry as threats attempt to execute.

This solution is especially advantageous for SMBs because it further expands the comprehensive nature of our multilayered solution without the need for any direct management.

Preparing for attacks doesn’t have to be complicated

Techniques that allow the breach of a business’s security through its employees and their (in-app) behaviors demonstrate that cybercriminals use every possibility to circumvent standard cyber defenses.

Via an ECOS’s easy-to-use dashboard, its Cloud Management Console, businesses can not only manage their security but also rapidly detect, assess, and respond to cyber incidents, making it a perfect solution for businesses of any size.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Predatory SpyLoan apps — loan sharks expand their range to Android, ESET Research finds

  • Deceptive SpyLoan apps analyzed by ESET researchers request various kinds of sensitive information from their users and exfiltrate it to the attackers’ servers. 
  • This data is then used to harass and blackmail users of these apps and, according to user reviews, was used even where a loan was not provided.
  • ESET telemetry shows a discernible growth in these apps across unofficial third-party app stores, Google Play, and websites since the beginning of 2023.
  • Malicious loan apps focus on potential borrowers based in Southeast Asia, Africa, and Latin America.

BRATISLAVA, KOŠICE — December 5, 2023 — This year, ESET researchers have observed alarming growth in deceptive Android loan apps, which present themselves as legitimate personal loan services, promising quick and easy access to funds. Despite their attractive appearance, these services are in fact designed to defraud users by offering them high-interest-rate loans endorsed with deceitful descriptions, all while collecting their victims’ personal and financial information in order to blackmail them. ESET products therefore recognize these apps using the detection name SpyLoan, which directly refers to their spyware functionality combined with loan claims. SpyLoan apps are marketed through social media and SMS messages, and are available for download from dedicated scam websites, third-party app stores, and also Google Play.

ESET is a member of the App Defense Alliance (ADA) and an active partner in the malware mitigation program, which aims to quickly find Potentially Harmful Applications and stop them before they ever make it onto Google Play. As an ADA member, ESET identified 18 SpyLoan apps and reported them to Google, who subsequently removed 17 of these apps from their platform. These apps had a total of more than 12 million downloads from Google Play before their removal. The final app listed changed its behavior; ESET therefore no longer detects it as a SpyLoan app.

Every instance of a particular SpyLoan app, regardless of its source, behaves identically due to its identical underlying code. It doesn’t matter whether the download came from a suspicious website, a third-party app store, or even Google Play — the users will experience the same functions and face the same risks, regardless of where they got the app.

According to ESET telemetry, the enforcers of these apps, who blackmail and harass their victims, even with death threats, operate mainly in Mexico, Indonesia, Thailand, Vietnam, India, Pakistan, Colombia, Peru, the Philippines, Egypt, Kenya, Nigeria, and Singapore. ESET researchers believe that any detections outside of these countries are related to smartphones that have, for various reasons, access to a phone number registered in one of these countries. There are currently no active campaigns targeting European countries, the USA, or Canada.

Apart from data harvesting and blackmail, these services present a form of modern-day digital usury, which refers to the charging of excessive interest rates on loans, taking advantage of vulnerable individuals. Victims of these apps claim the total annual cost (TAC) of such loans is much higher than stated, and the loan tenure is much shorter than stated. In some cases, borrowers were pressured to pay off their loans in five days, instead of the stated 91 days, and the TAC of a loan was anywhere between 160% and 340%.

“These malicious applications exploit the trust that users place in legitimate loan providers, using sophisticated techniques to deceive people and steal a very wide range of personal information,” says ESET researcher Lukáš Štefanko, who uncovered many of the SpyLoan apps. “It is crucial for individuals to exercise caution, validate the authenticity of any financial app or service, and rely on trusted sources. By staying informed and vigilant, users can better protect themselves from falling victim to such deceptive schemes,” he adds.

ESET Research has traced the origins of the SpyLoan scheme back to 2020. Once a user installs a SpyLoan app, they are prompted to accept the terms of service and grant extensive permissions to access sensitive data stored on the device. According to the privacy policies of these apps, if those permissions are not granted, the loan will not be provided. To complete the loan application process, users are also compelled to provide extensive personal information.

The data that is usually exfiltrated to the Command and Control (C&C) server includes the user’s list of accounts, call logs, calendar events, device information, lists of installed apps, local Wi-Fi network information, and even information about files on the device. Additionally, contact lists, location data, and SMS messages are vulnerable. To protect their activities, the perpetrators encrypt all the stolen data before transmitting it to the C&C server. While legitimate financial institutions are required to collect personal information about their customers, identity verification and risk assessment can be done using much less intrusive data collection methods. ESET Research believes the real purpose of the permissions requested by SpyLoan apps is to spy on their users and harass and blackmail them and their contacts

After such an app is installed and personal data is collected, the app’s enforcers start to pressure their victims into making payments, even if — according to the reviews — the user didn’t apply for a loan or applied but the loan wasn’t approved. Such practices have been described in the reviews of these apps on Facebook and on Google Play.

“There are several reasons behind the rapid growth of SpyLoan apps. One is that the developers of these apps take inspiration from successful FinTech — financial technology — services, which leverage technology to provide streamlined and user-friendly financial services,” explains Štefanko.

For more technical information about deceptive SpyLoan apps, check out the blog post “Beware of predatory fin(tech): Loan sharks use Android apps to reach new depths.” Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Heatmap of SpyLoan detections seen in ESET telemetry between January 1 and November 30, 2023

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Iran-linked OilRig attacks Israeli organizations with cloud service-powered downloaders, ESET Research discovers

  • Iran-linked advanced persistent threat (APT) group OilRig actively developed and used a series of downloaders with a similar logic throughout 2022. There are three new downloaders – ODAgent, OilCheck, and OilBooster – and newer versions of the SC5k downloader.
  • The targets, all in Israel, included an organization in the healthcare sector, a manufacturing company, and a local governmental organization. All targets were previously affected by multiple OilRig campaigns. 
  • The downloaders use various legitimate cloud services for command and control communications and data exfiltration; namely, Microsoft Graph OneDrive API, Microsoft Graph Outlook API, and Microsoft Office EWS API.

BRATISLAVA, MONTREAL — December 14, 2023 — ESET researchers analyzed a growing series of new OilRig downloaders that the group used in several campaigns throughout 2022 to maintain access to target organizations of special interest, all located in Israel. They include an organization in the healthcare sector, a manufacturing company, and a local governmental organization. OilRig is an APT group believed to be based in Iran, and its operations, as are these latest downloaders, are aimed at cyberespionage. The new lightweight downloaders – SampleCheck5000 (SC5k v1-v3), OilCheck, ODAgent, and OilBooster – are notable for using legitimate cloud storage and cloud-based email services for command and control (C&C) communications and data exfiltration, namely, the Microsoft Graph OneDrive or Outlook Application Programming Interfaces (API), and the Microsoft Office Exchange Web Services API.

“On par with the rest of OilRig’s toolset, these downloaders are not particularly sophisticated. However, the continuous development and testing of new variants, experimentation with various cloud services and different programming languages, and the dedication to re-compromise the same targets over and over again, make OilRig a group to watch out for,” says ESET researcher Zuzana Hromcová, who analyzed the malware along with ESET researcher Adam Burgher.

ESET attributes SC5k (v1-v3), OilCheck, ODAgent, and OilBooster to OilRig with a high level of confidence. These downloaders share similarities with the MrPerfectionManager and PowerExchange backdoors – other recent additions to OilRig’s toolset that use email-based C&C protocols – with the difference that SC5k, OilBooster, ODAgent, and OilCheck use attacker-controlled cloud service accounts rather than the victim’s internal infrastructure.

The downloader ODAgent was detected in the network of a manufacturing company in Israel – interestingly, the same organization was previously affected by OilRig’s SC5k downloader, and later by another new downloader, OilCheck, between April and June 2022. SC5k and OilCheck have similar capabilities to ODAgent but use cloud-based email services for their C&C communications. Throughout 2022, ESET observed the same pattern being repeated on multiple occasions, with new downloaders being deployed in the networks of previous OilRig targets: For example, between June and August 2022, ESET detected the OilBooster, SC5k v1, and SC5k v2 downloaders and the Shark backdoor, all in the network of a local governmental organization in Israel. Later, ESET detected yet another SC5k version (v3) in the network of an Israeli healthcare organization, also a previous OilRig victim.

OilRig has used these downloaders only against a limited number of targets, according to ESET telemetry, and all of them were persistently targeted months earlier by other OilRig tools. As it is common for organizations to access Office 365 resources, OilRig’s cloud service-powered downloaders can thus blend more easily into the regular stream of network traffic – apparently also the reason why the attackers chose to deploy these downloaders to a small group of especially interesting, repeatedly victimized targets.

OilRig, also known as APT34, Lyceum, Crambus, or Siamesekitten, is a cyberespionage group that has been active since at least 2014 and is commonly believed to be based in Iran. The group targets Middle Eastern governments and a variety of business verticals, including chemical, energy, financial, and telecommunications.

For more technical information about the latest OilRig downloaders, check out the blogpost “OilRig’s persistent attacks using cloud service-powered downloaders” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Timeline of OilRig’s downloaders

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×