Skip to content

Inside the World’s Largest Cyber Defense Exercise: Lessons from Locked Shields 2025 with Joseph Carson, Advisory CISO for Segura®

How do you prepare for the kind of cyberattack that could shut down a country?

This isn’t a theoretical scenario. NATO’s Locked Shields is the world’s most advanced live-fire cyber defense exercise. In 2025, nearly 4,000 cybersecurity experts from 41 nations came together to defend against more than 9,000 simulated attacks. These weren’t simple technical challenges. Participants were tasked with defending critical infrastructure – energy grids, financial systems, military communications – while simultaneously managing legal decisions, strategic communications, and crisis leadership.

Among this year’s participants was Joseph Carson, Segura®’s new Advisory CISO and Chief Evangelist, backed by Evandro Gonçalves, our Principal Solutions Architect & Presales Technical Lead, and Yago Lissone, our Security Analyst. Joseph’s experience on the front lines of Locked Shields 2025 offers critical insights into the future of cybersecurity defense and what organizations must do today to strengthen their resilience.

Before we share his first-hand account, here’s why Locked Shields remains one of the most important exercises for global cyber defense and why leaders like Joseph play a vital role in shaping modern security strategies.

‍

About NATO’s Locked Shields: Where Cyber Defense Meets Reality

Organized annually by NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE), Locked Shields is the largest and most sophisticated real-time cyber defense exercise in the world.

Each year, participants face a series of highly realistic cyberattacks designed to simulate the technical, operational, and strategic complexity of a full-scale cyber crisis. In 2025, the scenario focused on defending the fictional nation of Berylia, whose government, critical infrastructure, and military networks came under sustained attack.

Over two days, Blue Teams worked around the clock to prevent catastrophic failures in essential services while navigating political pressure, disinformation campaigns, and legal response challenges. The objective: test not only their technical defenses but their ability to lead through crisis under extreme pressure.

As Mart Noorma, Director of the CCDCOE, noted:

“In a world where cyber threats cross every border, Locked Shields proves that resilience in cyberspace is built together.”

‍

Meet Joseph Carson: A Global Leader in Cybersecurity Resilience

Joseph Carson is an award-winning cybersecurity professional with over 30 years of experience in enterprise security and critical infrastructure protection. As Segura®’s Chief Security Evangelist and Advisory CISO, he focuses on identity security and helping organizations build resilient cybersecurity strategies capable of withstanding today’s most advanced threats.

Joseph holds CISSP and OSCP certifications and actively advises governments, critical infrastructure sectors, and global enterprises on strengthening security postures against evolving cyber risks.

He is the author of the widely recognized Cybersecurity for Dummies, read by more than 50,000 professionals worldwide, and regularly contributes expert insights to leading publications including The Wall Street Journal, Dark Reading, and CSO Magazine.

With a passion for advancing cybersecurity as a people-first mission, Joseph helps organizations integrate technology, processes, and leadership strategies to drive long-term resilience. Now, at Segura®, he brings this field-tested expertise directly to organizations working to secure privileged access, protect identities, and stay ahead of the next critical threat.

‍

‍

Inside the Action: An Interview with Joseph Carson

We spoke with Joseph shortly after his return from Locked Shields 2025 to discuss his experience and the critical lessons every organization can apply from this global exercise.

Q: Could you describe your role and responsibilities during Locked Shields 2025?

Joseph Carson:
 “In Locked Shields 2025, I served as a Blue Team Defender with a specific focus as a subject matter expert on credential protection. My responsibilities included securing authentication systems, monitoring for potential credential abuse, and responding rapidly to any threats targeting user accounts. I was also on standby to provide urgent support to teammates across different domains, ensuring we could respond to critical incidents without delay.”

‍

Q: What were some of the key challenges your team faced during the exercise?

Joseph Carson:
 “One of the biggest challenges was maintaining situational awareness across multiple systems while under continuous and sophisticated attack from the Red Team. Coordinating responses in real time, especially during credential-based attacks or privilege escalation attempts, tested both our technical skills and our ability to communicate under pressure. The pace was relentless, and ensuring that team members had the right support exactly when needed was critical.”

‍

Q: How does participating in Locked Shields influence your approach to real-world cybersecurity strategies?

Joseph Carson:
 “Locked Shields reinforces the importance of preparation, collaboration, and agility in real-world cybersecurity. It highlights the need to build resilient systems that don’t just prevent attacks, but can recover and adapt quickly under pressure. The exercise has influenced my emphasis on incident readiness, credential hygiene, and fostering cross-team communication channels in professional environments.”

‍

Q: In your opinion, how does Locked Shields contribute to international collaboration in cybersecurity?

Joseph Carson:
 “Locked Shields is one of the most effective platforms for fostering international cybersecurity cooperation. It brings together experts from around the world to tackle realistic, high-pressure scenarios, forcing participants to rely on shared knowledge, trust, and rapid information exchange. It breaks down silos and encourages a collaborative mindset that’s essential for defending against modern, transnational cyber threats.”

‍

Q: What were your main takeaways or lessons learned from participating in Locked Shields 2025?

Joseph Carson:
 “My key takeaways from this year’s exercise include the power of coordinated teamwork, the need for clearly defined roles in incident response, and the critical importance of staying calm and focused during high-stress events. Holding back the Red Team was a testament to our preparation and collaboration. Each round of Locked Shields deepens my appreciation for collective defense and the importance of continuous learning in the field.”

‍

‍

Why This Matters for Today’s Cybersecurity Leaders

Locked Shields may be a simulation, but the risks it highlights are real. Privileged access remains the most common target for attackers in the modern threat landscape. The speed at which your organization can detect, respond to, and recover from incidents will determine whether a breach becomes a headline or a footnote.

One immediate action to prioritize? Tighten control over privileged credentials.

Review privileged accounts, eliminate unused credentials, and enforce strong authentication and rotation policies. As Locked Shields 2025 shows, even the most advanced defenses can falter if credential management is overlooked.

At Segura®, we are proud to have Joseph Carson helping shape our vision for a more secure future. His field-tested expertise directly informs how we help organizations strengthen privileged access controls, improve credential hygiene, and reduce the time it takes to detect and respond to advanced threats.

With the right controls in place, your team can move beyond constant firefighting and focus on bigger strategic initiatives, knowing your most critical accounts are protected.

Our mission is to help organizations take these critical first steps while building toward long-term resilience. Because in the next crisis, every second will count.

Ready to take control of your credentials before attackers do? → Talk to Our Team Today

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

DNS Tunneling Exposed: Why It’s Dangerous and Shockingly Easy to Exploit

While the first part of this series introduced the concept of DNS Tunneling, explaining how attackers exploit the DNS protocol to create covert channels, bypass security controls, and exfiltrate data, this follow-up delves into the underlying risks and practical realities that make DNS Tunneling a persistent and underestimated threat. Despite its technical complexity, executing a DNS Tunnel often requires minimal resources, leveraging widely available tools and overlooked gaps in network monitoring. In this article, we’ll explore why DNS Tunneling remains dangerous, how it contributes to data breaches and unauthorized access, and why many organizations fail to detect it until it’s too late.

Why is DNS Tunneling Dangerous?

DNS tunneling poses a significant security threat to organizations because it provides attackers with a stealthy channel for data and commands that often goes unnoticed. Since DNS traffic is critical for normal operations, network defenders and monitoring tools may not scrutinize it as closely as web or email traffic. This lack of scrutiny allows malicious DNS tunnels to blend in with legitimate DNS queries. The result is a covert avenue to bypass security controls: DNS tunnels can easily slip past firewalls, proxies, and intrusion detection systems by masquerading as routine DNS lookups.

The potential impacts of a successful DNS tunneling attack on a company are severe. Once a tunnel is established, attackers can perform data exfiltration, siphoning off sensitive information (customer data, intellectual property, credentials, etc.) in small encoded chunks via DNS without immediate detection. They can also maintain persistent command-and-control (C2) over compromised systems. Through the DNS tunnel, an attacker can issue commands to malware inside the network, instructing it to propagate, encrypt files for ransomware, and so on, and receive status updates or stolen data in response. Essentially, DNS tunneling can give an adversary a continuous foothold to remotely control infected machines. Furthermore, it can be used to deliver malicious payloads or malware into the network, for example, sending pieces of a malicious code that reassemble on the target, all hidden in DNS responses. According to security analyses, the risks of DNS tunneling include data breaches, unauthorized access to sensitive information, loss of intellectual property, and malware delivery, as well as enabling attackers to move laterally or further exploit the environment.

Another reason DNS tunneling is dangerous is the difficulty of tracing and attribution. The DNS queries used in tunneling often look like queries to obscure domains or subdomains, which might not immediately raise flags. They could be misinterpreted as legitimate, if somewhat unusual, DNS traffic. Detecting a DNS tunnel is non-trivial, it often requires specialized analysis of DNS query patterns, payload sizes, and frequencies that are outside the capability of standard network monitoring tools. BlueCat Networks notes that DNS tunneling “bypasses most filters, firewalls, and packet capture software,” making it especially hard to detect and trace its origin. An attacker using DNS tunneling can therefore quietly operate under the radar for an extended period, increasing the potential damage. In summary, DNS tunneling is dangerous because it turns a trusted protocol into a vehicle for covert malicious activity, often leading to serious breaches that are hard to discover until the damage is done.

Why DNS Tunneling is Relatively Easy to Execute

Ironically, one of the reasons DNS tunneling is so prevalent is that it’s relatively easy for attackers to pull off, especially compared to other covert channels. There are a few factors that contribute to this:

  • Pervasive DNS Access: DNS is required for almost all internet communications, so networks tend to permit DNS queries out to the internet by default. Port 53 (DNS) is “nearly always open on systems, firewalls, and clients” . Many organizations do not strictly limit what DNS servers can be queried or don’t inspect the contents of DNS packets. This means an attacker has a high chance that DNS traffic will be allowed egress from a target environment without being blocked. Even when an organization uses an internal DNS server, that server usually forwards queries it cannot resolve (like external domains) to upstream resolvers on the internet. Attackers can abuse this by querying their malicious domain – the query will traverse the internal DNS and go out to the attacker’s server. Unless specific egress rules or DNS filtering are in place, firewalls often treat DNS as an exception and let it pass uninspected, effectively punching a hole that attackers exploit.
  • Lack of DNS Monitoring: DNS traffic is often considered benign infrastructure traffic and may not be monitored by intrusion detection systems or endpoint security agents. Security teams focus heavily on web, email, and lateral movement traffic, while DNS may get overlooked. Adversaries favor DNS because it is an “always-open, overlooked and underestimated protocol” for communications . This common oversight in network defense makes DNS an attractive avenue, attackers know their DNS-based communications have a lower chance of triggering alerts.
  • Readily Available Tools: Perhaps most importantly, there is an abundance of open-source tools and frameworks that make setting up a DNS tunnel trivial. One doesn’t need to write custom code to leverage DNS tunneling; many publicly available projects can encapsulate traffic or messages into DNS queries. In fact, using these tools has become a common tactic for penetration testers and attackers alike. Unit 42 researchers point out that numerous tools available on GitHub allow attackers to create covert DNS channels “for the purposes of hiding communication or bypassing policies,” and these tools are not only freely available but also easy to use . In other words, an attacker with basic knowledge can download a DNS tunneling toolkit and get a working tunnel running in a short time, without needing to invent their own method. We will discuss some of these tools in the next section.
  • Misconfigurations and Weak Policies: Many organizations inadvertently make DNS tunneling easier by not enforcing strict DNS usage policies. For example, if endpoint computers are allowed to query any external DNS server (like 8.8.8.8) instead of being forced through the company’s DNS resolver, an attacker’s malware can directly query the attacker’s DNS server, completely bypassing internal controls. Even if internal DNS is used, if it is not configured to filter out suspicious domains or very long query names, it will dutifully forward along the attacker’s queries. Common firewall configurations may allow DNS to any destination, or lack advanced DNS protocol inspection. Such misconfigurations (or rather, default configurations) create an environment where implementing a DNS tunnel is as easy as sending out DNS queries to a domain, and there is little to impede the malicious traffic.

In summary, DNS tunneling is facilitated by the necessity and ubiquity of DNS itself. Attackers are basically piggybacking on a service that must be open and functional. Combine that with the wealth of easy-to-use tunneling tools available and often insufficient DNS oversight, and you have a recipe for a simple but effective attack technique. Even junior attackers can find tutorials and tools online to exfiltrate data via DNS.

Understanding the dangers and simplicity of DNS Tunneling is the first step in recognizing just how vulnerable many networks remain. The protocol’s trust-based nature, combined with its ubiquity and poor visibility in traditional security stacks, creates an ideal vector for covert communication and data exfiltration. As we’ve seen, even basic tunneling tools can bypass firewalls and proxies if DNS traffic isn’t properly inspected.

This is where SafeDNS provides a critical layer of defense. Our Protective DNS solution is equipped with advanced detection capabilities to identify and block DNS tunneling attempts in real time. By leveraging behavior-based analytics, anomaly detection, and continuously updated threat intelligence, SafeDNS helps organizations detect covert channels, stop data exfiltration, and enforce security policies at the DNS layer—long before threats reach endpoints. With full support for DNS encryption (DoH/DoT), SIEM integration, and policy-based filtering, SafeDNS enables secure DNS resolution while maintaining full visibility and control over DNS traffic.

In the next article, we’ll take a closer look at the performance characteristics of DNS Tunneling, how attackers balance speed, stealth, and reliability to maintain persistent access, and what that means for defenders monitoring DNS traffic.

Start your free trial of SafeDNS today and see how Protective DNS can help you close one of the most overlooked gaps in your cybersecurity stack.

 

 

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How to strengthen cybersecurity in construction and prevent attacks

Summary: Construction companies face rising cyber threats. Learn key risks, best practices, and how NordLayer helps protect projects, data, and infrastructure.

Cybersecurity risks affect every economic sector, and the construction industry is no exception.

Digital technology is embedded in how we build. From home building to delivering complex infrastructure, constructors rely on connectivity and data storage to manage material flows, coordinate projects, and communicate with clients.

Cyber-attacks can disrupt these critical functions, raising costs and, potentially, creating physical security risks.

This blog will look at cybersecurity for construction companies. We will discuss general cybersecurity risks that all companies must mitigate, alongside construction-specific risks that require targeted security solutions.

Why do construction companies face cybersecurity risks?

The construction industry consistently attracts cyber criminals for several reasons. Most importantly, construction firms have embraced digitalization. Companies store valuable financial and client information, the type of data that data thieves love to discover.

Construction companies also store infrastructure plans and project schematics. These data types appeal to threat actors linked to hostile states or terrorist collectives. Cyber-attacks on corporate archives could enable and amplify devastating strategic attacks.

Digital transformation has introduced IoT sensors, drone footage, Building Information Modeling (BIM) systems, environmental modeling, and many radical new technologies. Innovation boosts productivity but also creates new targets for cyber criminals.

Competitors are another source of cyber-attacks in the construction industry. Construction is a competitive world where businesses compete for contracts based on reputation and track record. Sabotage or data theft can ruin a firm’s chances of successful tenders.

What drives cyber-attacks on construction firms

Data security studies back up these concerns. PwC’s 2024 Cyber Threats report finds that 76% of cyber-attacks against construction companies are motivated by financial gain. But 12% are linked to espionage, and 9% are connected to sabotage.

Attacks are also becoming more frequent. The security consultancy Kroll reports that phishing attacks on construction companies doubled from 2023-24. With criminals introducing sophisticated new techniques, the threat landscape is becoming more complex and hazardous. Threat mitigation strategies are essential.

Understanding cybersecurity threats for construction companies

Every economic sector faces slightly different adversaries. Cybersecurity measures should avoid generic solutions and rely on knowledge about relevant threats. With that in mind, critical cybersecurity threats in the construction industry include:

Ransomware attacks

Ransomware is the most common attack type against construction industry targets. In these attacks, criminals deploy malware to encrypt victims’ devices. Malware then denies access to encrypted data until attackers receive ransom payments, typically in cryptocurrencies.

Ransomware attacks are more than a financial headache. They disrupt project timelines, putting completion at risk. Attackers may also extract data even if victims agree to pay.

 
 

Data breaches

Modern construction companies rely on data flows to monitor projects, maintain quality control, protect the environment, and ensure employee safety. Companies handle vast streams of financial and client data as well. All of this sensitive data can be useful for cyber attackers.

Criminals understand how to compromise construction industry targets with social engineering attacks and malware. Data breaches are inevitable without strong information security measures and employee training processes.

Supply chain attacks

Construction companies depend on complex networks of suppliers to provide material inputs, personnel, and digital services. But criminals can compromise vendors and launch cascading attacks against downstream clients.

This is why construction firms must integrate third parties into their cyber risk assessments. Partner companies represent vulnerable entry points for malicious actors, making robust access control systems essential.

Internet-of-things (IoT) attacks

IoT devices track equipment locations, monitor temperatures and pressure levels, track fleet performance, and provide early safety warnings against vibrations or toxins. These functions cut costs and improve productivity. However, IoT also introduces network security cyber risks.

Direct access to Internet-of-Things devices enables surveillance and data collection. Attackers can also combine IoT devices in botnets to launch denial-of-service attacks and damage network assets.

Moreover, IoT devices often lack native security measures. Companies struggle to update firmware and keep pace with emerging threat vectors. They may even rely on default passwords, opening the door to opportunistic attacks.

Physical security

The construction sector is particularly prone to physical security risks. Members of the public may gain unauthorized access to work sites, putting their safety at risk. Expensive on-site equipment requires security from theft or damage.

Even worse, hybrid cyber-physical attacks can compromise devices that protect work sites. For instance, attackers may use malware to damage air conditioning or dust extraction systems. Insider threats can also introduce malware via USB devices, giving outsiders access to IT systems.

Best practices to mitigate construction industry cybersecurity risks

A single ransomware attack could lead to missed deadlines, contractual fees, loss of personal information and crippling reputational damage. Given these risks, cybersecurity should be a top priority for all construction companies and third-party suppliers.

However, many constructors are poorly prepared for cyber threats. According to insurance firm Travelers, over half of construction companies lack endpoint security controls or post-breach response plans. The best practices below will help you fill those gaps and secure construction industry assets:

Best practices for cybersecurity in construction

Train employees to raise cybersecurity awareness

Phishing emails are the most common way for attackers to access construction industry networks. Clicking on malicious attachments or following fake links allows criminals to implant surveillance tools and launch ransomware attacks.

One of the most effective solutions to phishing risks is comprehensive employee training. Teach staff how to recognize dangerous emails and avoid unsolicited files or documents. Train employees to raise security concerns and follow password security best practices. And use phishing simulations to war-game real-world threats.

If you use IoT devices, training should cover updating firmware and ensuring security. Regularly reiterate the need to avoid default passwords and check devices.

Implement network security controls

Network security measures detect, assess, and neutralize cyber threats before they cause harm. Construction companies need robust firewalls, intrusion detection systems (IDS), and endpoint monitoring tools.

Uncontrolled access is another critical cybersecurity vulnerability. Use multi-factor authentication to request additional credentials for every login. Manage user permissions according to the principle of least privilege, allowing access to essential resources while blocking everything else.

Security teams must also update operational technology and network assets to minimize exploit risks. Attackers will leverage outdated firmware or operating systems. It’s essential to implement software updates and avoid using obsolete legacy systems.

Manage third-party security risks

Construction sector supply chains often become vectors for cyber attacks. This makes vendor and supply chain management a critical challenge.

Third-party risk assessment is critical. Assess vendors based on their cybersecurity controls and compliance records. Build cybersecurity into vendor contracts to encourage secure practices and prompt notification of security incidents.

Manage vendor access carefully according to Zero Trust security models. Assign sufficient privileges to carry out core tasks, without granting third parties extensive network access.

Follow an efficient incident response plan

Construction companies should assume that security incidents will occur. Security teams need a prepared incident response playbook to organize responses and safeguard sensitive information, such as client data or intellectual property.

Response plans should detect breaches, identify attack vectors, and determine the correct response. Depending on the nature of the threat, responses could entail system downtime, quarantine processes, or ongoing monitoring.

Response plans should also include data backup procedures. Regular backups of critical data allow construction companies to restore operations, even during ongoing ransomware attacks.

Ensure response plans meet regulatory compliance requirements (for example, notifying customers or regulators). Use response outcomes to improve security measures and cut future cybersecurity risks.

Managing IoT security

Secure Internet of Things devices with secure zones guarded by firewalls and access controls. Network segmentation allows authorized access and contains DDoS attacks or malware infections, effectively confining IoT attacks.

Extend IDS monitoring to IoT devices, and encrypt data transfers (such as monitoring data or video feeds).

Use industry frameworks to assist compliance

The construction industry does not fight cyber threats alone. For example, the National Institute of Standards and Technology (NIST) provides a Cybersecurity Framework to guide construction firms. Employ the framework as a checklist to source essential tools and implement security measures.

Construct a cybersecurity strategy with NordLayer

Digital transformation in the construction industry brings many benefits, but also comes with a price tag: increasing exposure to cybersecurity risks. NordLayer can help you manage those risks and enjoy the benefits of technological innovation.

NordLayer provides a comprehensive cybersecurity solution for manufacturing companies of all sizes, from single-building sites to nationwide construction enterprises.

Here is what NordLayer offers:

  • Zero Trust Network Access (ZTNA) enables you to restrict access to specific applications and prevent threats from spreading within the network.
  • Web Protection effectively blocks phishing links and sites.
  • Identity and Access Management (IAM) allows you to manage user identities and access for your employees and third parties with multi-factor authentication (MFA), biometric authentication, and Single Sign-On.
  • Cloud Firewall ensures granular access control and helps secure workflows across remote, hybrid, and on-site environments.
  • Endpoint security protects endpoints through traffic encryption and access control.

Cybersecurity should not compromise project delivery or data security. Contact NordLayer’s team to explore flexible and effective cybersecurity solutions for the construction industry.

 

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET participates in operation to disrupt the infrastructure of Danabot infostealer

  • ESET Research has been tracking Danabot’s activity since 2018 as part of a global effort that resulted in a major disruption of the malware’s infrastructure.
  • While primarily developed as an infostealer, Danabot also has been used to distribute additional malware, including ransomware.
  • Danabot’s authors promote their toolset through underground forums and offer various rental options to potential affiliates.
  • This ESET Research analysis covers the features used in the latest versions of the malware, the authors’ business model, and an overview of the toolset offered to affiliates.
  • Poland, Italy, Spain and Turkey are historically one of the most targeted countries by Danabot.

BRATISLAVA, PRAGUE — May 22, 2025 — ESET has participated in a major infrastructure disruption of the notorious infostealer, Danabot, by the US Department of Justice, the FBI, and US Department of Defense’s Defense Criminal Investigative Service. U.S. agencies were working closely with Germany’s Bundeskriminalamt, the Netherlands’ National Police, and the Australian Federal Police . ESET took part in the effort alongside Amazon, CrowdStrike, Flashpoint, Google, Intel471, PayPal, Proofpoint, Team Cymru and Zscaler. ESET Research, which has been tracking Danabot since 2018, contributed assistance that included providing technical analysis of the malware and its backend infrastructure, as well as identifying Danabot’s C&C servers. During that period, ESET analyzed various Danabot campaigns all over the world, with Poland, Italy, Spain and Turkey historically being one of the most targeted countries. The joint takedown effort also led to the identification of individuals responsible for Danabot development, sales, administration, and more.

These law enforcement operations were conducted under Operation Endgame — an ongoing global initiative aimed at identifying, dismantling, and prosecuting cybercriminal networks. Coordinated by Europol and Eurojust, the operation successfully took down critical infrastructure used to deploy ransomware through malicious software.

“Since Danabot has been largely disrupted, we are using this opportunity to share our insights into the workings of this malware-as-a-service operation, covering the features used in the latest versions of the malware, the authors’ business model, and an overview of the toolset offered to affiliates. Apart from exfiltrating sensitive data, we have observed that Danabot is also used to deliver further malware, which can include ransomware, to an already compromised system,” says ESET researcher Tomáš Procházka, who investigated Danabot.

The authors of Danabot operate as a single group, offering their tool for rental to potential affiliates, who subsequently employ it for their malicious purposes by establishing and managing their own botnets. Danabot’s authors have developed a vast variety of features to assist customers with their malevolent motives. The most prominent features offered by Danabot include: the ability to steal various data from browsers, mail clients, FTP clients, and other popular software; keylogging and screen recording; real-time remote control of the victims’ systems; file grabbing (commonly used for stealing cryptocurrency wallets); support for Zeus-like webinjects and form grabbing; and arbitrary payload upload and execution. Besides utilizing its stealing capabilities, ESET Research has observed a variety of payloads being distributed via Danabot over the years.  Furthermore, ESET has encountered instances of Danabot being used to download ransomware onto already compromised systems.

In addition to typical cybercrime, Danabot has also been used in less conventional activities such as utilizing compromised machines for launching DDoS attacks… for example, a DDoS attack against Ukraine’s Ministry of Defense soon after the Russian invasion of Ukraine.

Throughout its existence, according to ESET monitoring, Danabot has been a tool of choice for many cybercriminals and each of them has used different means of distribution. Danabot’s developers even partnered with the authors of several malware cryptors and loaders, and offered special pricing for a distribution bundle to their customers, helping them with the process.  Recently, out of all distribution mechanisms ESET observed, the misuse of Google Ads to display seemingly relevant, but actually malicious, websites among the sponsored links in Google search results stands out as one of the most prominent methods to lure victims into downloading Danabot. The most popular ploy is packing the malware with legitimate software and offering such a package through bogus software sites or websites falsely promising users to help them find unclaimed funds. The latest addition to these social engineering techniques are deceptive websites offering solutions for fabricated computer issues, whose only purpose is to lure victims into execution of a malicious command secretly inserted into the user’s clipboard.

The typical toolset provided by Danabot’s authors to their affiliates includes an administration panel application, a backconnect tool for real-time control of bots, and a proxy server application that relays the communications between the bots and the actual C&C server. Affiliates can choose from various options to generate new Danabot builds, and it’s their responsibility to distribute these builds through their own campaigns.

“It remains to be seen whether Danabot can recover from the takedown. The blow will, however, surely be felt, since law enforcement managed to unmask several individuals involved in the malware’s operations,” concludes Procházka.

For technical overview of Danabot and insight into its operation, check out ESET Research blogpost: “Danabot: Analyzing a fallen empire” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Worldwide Danabot detections as seen in ESET telemetry since 2018

Example of typical Danabot infrastructure

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Cyber Security Pro and ESET Cyber Security merge

Being a cybersecurity leader and a protector of your digital progress, ESET understands that to stay on top of this game requires endless innovation and improvement. This also applies to macOS, which many incorrectly perceive as a broadly secure operating system that doesn’t require additional protection.

To achieve the best possible protection for macOS users, ESET made a strategic decision to revamp its ESET Cyber Security solution protecting macOS devices and merge ESET Cyber Security Pro with the latest version of ESET Cyber Security. 

The importance of macOS security

It’s well known that macOS has held a reputation for having a more secure operating system due to several key factors. First, Apple keeps tight control over both hardware and software as macOS is designed to run exclusively on Apple’s own devices. This closed ecosystem allows Apple to implement stringent security measures.

Additionally, macOS is built on a Unix-based foundation benefiting from its permission-based architecture that restricts unauthorized access to system files. On top of that, Apple provides multiple built-in security features that collectively create a robust security environment.

However, the perception of macOS as a highly secure operating system does not mean that it is immune to malware. Cybercriminals are continually evolving their tactics, and macOS is not exempt from their efforts. Simply, the ever-increasing popularity of Apple devices has made them a more attractive target for attackers.

For example, ESET telemetry coming from macOS devices shows that password-stealing ware (PSW), which often targets credentials related to cryptocurrency wallets, increased by 127% in H2 2024. In a similar manner, ESET telemetry also detected a skyrocketing 320% increase in cryptomining malware targeting macOS users to abuse the computing power of their devices to make money.

What is happening to ESET Cyber Security for macOS?

To face current and upcoming threats to macOS users, ESET has been building an entirely new version of ESET Cyber Security with a completely overhauled architecture for enhanced functionality, stability, and future-proof performance.

Starting from scratch, ESET created a new code base allowing developers to focus on performance improvements and adding new features instead of increasingly demanding maintenance.

The latest version of ESET Cyber Security is included in ESET’s all-in-one protection for households — ESET HOME Security. It offers both higher performance and stability, network profiles, firewall, license-based features, and more.

All these changes mean that users can expect all the capabilities of the legacy ESET Cyber Security Pro and even more features in the near future.

Important dates and information

The end of sales for ESET Cyber Security Pro already took place November 15, 2024. Since then, users have not been able to purchase a new ESET Cyber Security Pro subscription. 

The End-of-Life date for ESET Cyber Security Pro is November 18, 2025. After this date, users can no longer renew, install, activate, or use our ESET Cyber Security Pro product. The application won’t be able to download new modules and will become inactive with a red error status (indicating modules are not up to date).

Users can already see a notification about the new version in the Update section of the application containing a download link to the latest ESET Cyber Security application.

For more information, please visit the ESET EOL website and the Support change for version 6 of ESET endpoint products for macOS.

Enjoy full protection

With improved macOS protection included in ESET HOME Security, you can rest assured that your smart home devices are fully protected from various kinds of attacks thanks to Antivirus & Antispyware, Firewall, Web and Email Scanning, Anti-phishing, and more. Users of the highest tier – ESET HOME Security Ultimate – get additional services, including ESET Identity Protection and ESET VPN.

As ESET developers have breathed new life into ESET Cyber Security, more exciting news is coming soon, so stay tuned for updates.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×