ESET has been successfully utilizing botnet tracking for years. 

When cybersecurity vendors invest heavily into sophisticated malware replication mechanisms studying real-life malware behavior in isolated environments, one may ask what the point of malware tracking is. What do we learn by extracting data from malicious code without it running or communicating with a command and control (C&C) server?

Using the Grandoreiro banking trojan as an example, ESET senior malware researcher Jakub Souček explained the pros and cons of botnet tracking and malware replication at the ESET Technology Conference 2024, an annual ESET conference discussing the best in ESET security and research.

If you want to know more about how ESET participated in the Grandoreiro disruption, check out our other blog discussing the case at length.

With malware tracking, researchers need to implement a dedicated program (parser) for the relevant malware family deployed on the targeted machine. With this tool, the malware is nothing more than an input to such a program.

Using a heuristic approach, code patterns, and analytical output, the parser extracts all interesting information from the malware sample without it running or communicating. It can also emulate the C&C protocol and lure even more information from the C&C server.

“At ESET, botnet tracking has proven to be an invaluable resource several times in recent years,” Souček said.

ESET researchers have utilized such tracking in cases like the Trickbot disruption, which infested over a million computing devices between 2016 and 2020, the pervasive malware family Emotet, and a large variety of infostealers and remote access trojans (RATs).

The ESET tracking system is designed with the following objectives in mind:

• Extraction of C&C server domains and IP addresses. These are routed toward automatic blocking. In some cases, ESET also emulates network traffic to obtain more data.
• Extraction of payloads, both embedded and downloaded. These are great candidates for automatic detection as well.
• The most significant benefit lies in the ability to extract any custom information researchers want, such as DGA configuration, C&Cs that may be used as backup only, mutex names, and license ID.
• In the case of banking trojans, ESET engines also extract a list of targeted banks.

The benefits of malware tracking are many – full power over the malware sample, no actual compromise occurring, anti-emulation techniques don’t work, and the processing speed depends only on the complexity of the used parser.

However, tracking is not suitable for every piece of malware. Heavy code protection breaks binary patterns, frequent code changes increase maintenance requirements, and setting up such tracking may be time-consuming.

“To summarize, tracking is a great option for analyzing large stable botnets when long-term data is needed, and the samples contain information researchers wouldn’t otherwise have access to,” Souček said.

Malware replication requires a dedicated machine that is deliberately compromised to observe malware behavior, ideally establishing a connection to a C&C server and analyzing their communication. In a best-case scenario, the C&C server replies with additional payloads or plugins and a list of targets in the case of banking trojans, for example.

Setting up such an environment is relatively fast and easy, the entire process doesn’t require heavy maintenance, and the main benefit is that malicious code protection (such as virtualization or heavy obfuscation) can be ignored.

On the other hand, the malware may wait quite a long time before reaching out to a C&C server and, while waiting, both time and processing power are wasted. It may also be quite difficult to see under the custom encryption layers in network communication.

When analyzing installed malware, evading all sandbox-detection mechanisms may be quite tricky. There is also a risk of unusual control flow, like restarting the machine, which further complicates automatic replication.

“In a nutshell, replication is great for unknown malware where we don’t really care about long-term data. It can also be extremely helpful in overcoming code protection techniques,” Souček explained.

When it comes to botnets, the Grandoreiro case shows the benefits of malware tracking over malware replication.

Needless to say, a reliable cybersecurity solution should use both to cover the complex threat landscape.

This heuristic and multilayered cybersecurity strategy is part of the ESET prevention-first approach, based on the idea of stopping malware before it does any harm. To achieve that, ESET developed sophisticated solutions minimizing the threat surface (i.e. all possible connection points or attack vectors that attackers can use to enter victims’ systems).

Let’s take botnets in general as an example. ESET technology has multiple tools at its disposal to stop them at different stages, such as:

Anti-Phishing – Botnets (including Grandoreiro) often spread via phishing messages containing malicious content or links redirecting users to phishing websites. ESET Anti-Phishing blocks web pages known to distribute phishing content.

Reputation & Cache – When inspecting a file or URL, before any scanning takes place, ESET products check the local cache for known malicious or whitelisted benign objects. This improves scanning performance.

ESET DNA Detections – These perform a deep analysis of the code and extract the “genes” responsible for its behavior. ESET DNA Detections can identify specific known malware samples, new variants of a known malware family or even previously unseen or unknown malware that contains genes that indicate malicious behavior.

ESET Botnet Protection –ESET Botnet Protection detects malicious communication used by botnets and, at the same time, identifies the offending processes. Any detected malicious communication is blocked and reported to the user.

ESET LiveGrid® – Whenever a zero-day threat is seen, the file is sent to ESETcloud-based malware protection system ESET LiveGrid® where the threat is detonated and its behavior is monitored. The results of this system are provided to all endpoints globally within minutes without requiring any updates. This approach has a significant positive impact on scanning performance and deflection of zero-day threats on all protected endpoints with active ESET LiveGrid®.

Malware tracking has been an irreplaceable tool in the hands of ESET researchers for many years, contributing to numerous disruptions of dangerous malware. This mechanism is not a rival to malware replication; quite the contrary – both represent different approaches, which can be used separately when needed or even complement each other.

However, malware analysis is still only a small fraction of ESET multi-layered cybersecurity focusing on prevention. ESET combines multiple technologies, AI and human expertise to deliver top-notch security and threat intelligence from which ESET partners and law enforcement authorities benefit greatly.

ESET levels up its Mobile Security app to be even more effective against phishing.

Smartphones have become an integral part of our social lives. From children to teens and on to adults and the elderly, globally, the average user now spends almost four hours daily staring at their mobile phone. There’s really no point in naming all the things people can use their mobile phones for. From social interaction to shopping, gaming, and so on… you know what they are capable of.

These capabilities, however, come at a price. The variety of things people can do on their mobile phones creates one huge, messy cyberthreat landscape with criminals trying to steal victims’ money, data, and identities, sometimes demanding a ransom for their return.

This blog will show you some real-life examples described by ESET researchers of what such threats look like. As you will see, some of them are no longer simple scams that can be easily spotted, but are instead sophisticated, multi-staged and AI-driven attacks that require much stronger defenses than a watchful eye and simple antivirus.

The long list of ESET research pieces on this topic demonstrates how carefully ESET studies these threats. And ESET experts are not just watching. More than ten years ago, ESET created award-winning multilayered protection against a multitude of Android security issues called ESET Mobile Security, which has been protecting millions of people around the globe. Now ESET is coming forward with improved Phishing Protection, extending threat coverage even more.

There are 4.8 billion smartphone users, which is more than half of the current global population of 8.2 billion people. Statista estimates the smartphone user base to reach 6.4 billion by 2029.

According to a 2024 survey conducted by the data management firm Harmony Healthcare IT, phone screen time increases with every generation. While U.S. baby boomers (people born from 1946 to 1964) spend 3.5 hours per day with phones in their hands, millennials’ use of phones is one hour longer, and Generation Z spends an average of 6 hours and 5 minutes on their phone daily.

And just as smartphone usage is rising, so is the total volume of detected Android malware, increasing from 1.7 million in July 2014 to 35.2 million as of July 2024, according to the AV-TEST Institute’s data.

While the usage of mobile phones grows, so does the increase in user susceptibility to phishing attacks. Global data gathered in 2022 shows that encounters of personal mobiles with phishing rose from 35.46% in 2020 to 53% in 2022, and the percentage of mobile users who tapped on six or more phishing links almost doubled from 14.3% to 27.6% within this time period.

Let’s see several of the latest examples of mobile threats, some covered by the latest ESET Threat Report (H1 2024).

ESET experts complemented the research conducted by Group-IB’s Threat Intelligence unit, describing the GoldPickaxe malware family available for both iOS and Android, targeting victims in the Asia-Pacific region.

This malware can steal a victim’s sensitive personal information from financial apps such as Digital Pension for Thailand despite a requirement that users record a brief video of their face from various angles using the front camera of their mobile device as a form of secure authentication.

To achieve that, threat actors steal victims’ biometric data and utilize AI-driven face-swapping services to create deepfakes.

Another example shows that scammers don’t hesitate to even target children. According to the latest Threat Report, ESET telemetry detected phishing scams abusing Roblox, a sandbox gaming platform very popular with kids and available on multiple operating systems (including Apple and Android). Roblox contains virtual currency named Robux that can be purchased with real money, which makes it attractive for cybercriminals. The Roblox community has created a long list of Roblox threats here.

Also, using ESET detection engines in combination with other sources, ESET researchers recently discovered espionage campaigns spreading fake apps or trojanized and reverse-engineered legitimate apps to Android users in Egypt and Palestine. Threat actors used dedicated phishing websites to distribute malicious apps impersonating legitimate chat apps, a job opportunity app, and a civil registry app.

Another recent malicious campaign uncovered by ESET researchers and run in the Czech Republic targeted clients at three Czech banks to facilitate unauthorized ATM withdrawals from the victims’ bank accounts.