Bratislava, September 29th, 2022 – ESET, a global leader in digital security, has announced the launch of its award-winning B2B solutions for Managed Service Providers (MSPs). Based in the heart of the European Union, ESET has been protecting their MSP partners across the globe since 2014, offering a dedicated MSP program. This launch represents a step forward in expanding the offering with XDR solutions, ESET Inspect and ESET Inspect Cloud -currently available to ESET’s enterprise business customers– which will be accessible via ESET’s MSP Administrator platform as used by current MSP partners.

ESET has been researching the cyber threat landscape and innovating digital security technology for decades and the new offering has been designed with both its customers and partners in mind. A combination of ESET’s long-standing use of machine learning and AI based technologies, its cloud reputation system called ESET LiveGrid, and the human expertise offered by the company’s tightly knit global community, powers the world’s most formidable multi-layered cyber threat prevention, detection and response technology – the ESET PROTECT platform powered by ESET LiveSense.

The new offering will allow current and prospective MSP customers access to a simplified and unified digital security platform, with MSP-optimized solutions which are easy to use, help minimize their daily operations, and allow MSPs to provide top-rated security to help solidify their own customers’ trust. This is accomplished without compromising efficiency on behalf of quality, because the new platform integrates balanced breach prevention, detection and response capabilities, and comprehensive threat intelligence. It is modular, adaptable, and continuously innovated with each system upgrade.

ESET’s solution is flexible and scalable in design, future-proofing the MSPs’ business model and helping clear security engineers’ overflowing helpdesk. In terms of making life easier for MSPs, ESET offers a flexible, self-service, zero-commitment billing model which keeps the pressure off and allows their MSP partners to ‘pay as they go’ monthly and for the subscriptions they actually need.

“At the very heart of ESET’s award-winning technology, we feel its paramount to protect progress – but not only ours and more significantly, the progress of our MSP partners. ESET allows MSPs to focus on what really matters, their own business and customers. In our minds, ESET and MSPs simply go together: superior protection of customers, flexible and easy to use product, and a business model tailored to MSP needs,” said Michal Jankech, VP for the MSP and SMB segment at ESET.

To read more about the offering, click here.

To find out more about what is XDR and why we need it in our cyber security lives, click here.

• ESET researchers discovered a previously unknown macOS backdoor that spies on users of compromised Macs.
• ESET has named the malware CloudMensis because it uses cloud storage services to communicate with the operators and uses the names of months as directory names.
• This macOS malware uses cloud storage as its Command and Control channel, supporting three different providers: pCloud, Yandex Disk, and Dropbox.
• CloudMensis can issue 39 commands, including exfiltrating documents, keystrokes, and screen captures, from compromised Macs.
• Metadata from the cloud storage services used reveal that the first Mac compromised by this recent campaign was on February 4, 2022.
• The very limited distribution of CloudMensis suggests that it is used as part of a targeted operation.

BRATISLAVA, MONTREAL — JULY 19, 2022 —  ESET researchers discovered a previously unknown macOS backdoor that spies on users of compromised Macs and exclusively uses public cloud storage services to communicate back and forth with its operators. Named CloudMensis by ESET, its capabilities clearly show that the intent of the operators is to gather information from the victims’ Macs by exfiltrating documents and keystrokes, listing email messages and attachments, listing files from removable storage, and screen captures.

CloudMensis is a threat to Mac users, but its very limited distribution suggests that it is used as part of a targeted operation. From what ESET Research has seen, operators of this malware family deploy CloudMensis to specific targets that are of interest to them. The use of vulnerabilities to work around macOS mitigations shows that the malware operators are actively trying to maximize the success of their spying operations. At the same time, no undisclosed vulnerabilities (zero days) were found to be used by this group during our research. Thus, running an up-to-date Mac is recommended to avoid, at least, the mitigation bypasses.

“We still do not know how CloudMensis is initially distributed and who the targets are. The general quality of the code and lack of obfuscation shows the authors may not be very familiar with Mac development and are not so advanced. Nonetheless, a lot of resources were put into making CloudMensis a powerful spying tool and a menace to potential targets,” explains ESET researcher Marc-Etienne Léveillé, who analyzed CloudMensis.

Once CloudMensis gains code execution and administrative privileges, it runs a first-stage malware that retrieves a more featureful second stage from a cloud storage service.

This second stage is a much larger component, packed with a number of features to collect information from the compromised Mac. The intention of the attackers here is clearly to exfiltrate documents, screenshots, email attachments, and other sensitive data. Altogether, there are 39 commands currently available.

CloudMensis uses cloud storage both for receiving commands from its operators and for exfiltrating files. It supports three different providers: pCloud, Yandex Disk, and Dropbox. The configuration included in the analyzed sample contains authentication tokens for pCloud and Yandex Disk.

Metadata from the cloud storage services used reveal interesting details about the operation, for example that it started to transmit commands to the bots as of February 4, 2022.

Apple has recently acknowledged the presence of spyware targeting users of its products and is previewing Lockdown Mode on iOS, iPadOS, and macOS, which disables features frequently exploited to gain code execution and deploy malware.

For more technical information about CloudMensis, check out the blogpost “I see what you did there: a look at the CloudMensis macOS spyware” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

Outline of how CloudMensis uses cloud storage services