Skip to content

Boosting cyber health: How vulnerability and patch management decrease threat exposure

 

The topic of vulnerabilities remains significant as new exploits emerge, underscoring the need for continuous vigilance and proactive defense strategies. 

In a world that records on average at least 7,240 new vulnerabilities per quarter (based on 2023 data), patching critical vulnerabilities should be an immediate priority; otherwise, users might face anything from exposing confidential data all the way to opening their entire networks to ransomware or wiperware. The possible negative scenarios are unlimited.

Thus, focusing on your business’ cyber health matters, and with data breach costs climbing into several millions of dollars, patching all your devices/OSs grows considerably more critical.

A health check on vulnerabilities

First of all, doctors usually say that humans should support their health by ingesting a healthy dose of vitamins every day – lowering the chances of having compromised immune systems, leading to constant bouts of sickness. For organizations, the situation is much the same. Without investing in all-encompassing cybersecurity measures and awareness training, their body (business) will be left vulnerable to compromises (literally).

However, it seems that just like humans tend to underestimate their need for vitamins and health checks, so do businesses forgo important security checks and patching. There have been a plethora of cases where a business was breached due to a known vulnerability. For example, Equifax in 2017 was breached thanks to unpatched vulnerabilities1, which threat actors used to get their hands on the private records of 147.9 million Americans.

Overall, this catastrophic breach cost Equifax around 1.4 billion USD. For a smaller business, such costs, even in proportion to their revenues, would likely bury them completely. A larger enterprise might weather the storm, but there is a high chance that they could fold as well, and all because their patching was, well, “patchy.”

Recording vulnerabilities – are you immune enough?

The database of Common Vulnerabilities and Exposures (CVEs) recorded 28,961 vulnerabilities for 2023 alone, representing a 15% rise compared to the previous year. For Q1 2024, 8,697 have already been reported (for comparison, in Q1 2023 it was 7,015).

Endpoints such as servers or computers remain risky, as they can harbor unpatched systems and apps. The same research also highlights how ransomware gangs are becoming more skilled, using programming languages that can more easily cross-compile, simultaneously targeting Windows and Linux systems.

There’s an online myth that Linux is inherently more secure than other systems – since threat actors only target commonly used ones. Said myth is easily debunked though, as Linux is one of the most widely used systems globally. It makes up approximately 96% of web server infrastructure, while Android represents 72% of the global mobile market share.

Recently, ESET Research broke a story about the Ebury botnet compromising around 400K Linux servers for cryptocurrency theft and other criminal activities. ESET researchers have also exposed numerous OpenSSH backdoors, leading to the documentation of almost 21 Linux-based malware families with credential-stealing and backdoor functionalities. Additionally, threat actors target Linux-based high-performance computing (HPC) clusters with sophisticated malware like Kobalos.

Thus, threats targeting Linux-based systems are quite real and can pack quite a punch to the gut of business security.

The ABCs of vulnerability solutions

Why deal with vulnerabilities, specifically? For a business that could already consider its cyber posture “ready” or “full,” it could seem like its current security software can take care of everything.

That’s not an entirely accurate observation. Endpoint security products in and of themselves are usually made up of multiple layers guaranteeing strong protection – but that doesn’t mean that your endpoint product can protect against every single external threat. There’s a reason why detection and response or cloud security are a thing these days; it’s all about minimizing risk by shrinking the attack surface as much as one can.

Though security tools can remediate rather quickly (with ESET-managed services responding in as little as 20 minutes), every piece of a security stack plays a different and important part in the active protection process.

Keeping ahead of attackers by preventing them from finding that vulnerable spot is the key to your security. Said spots can be anywhere – in an app, device OS, or server infrastructure – presenting multiple potential entry points. However, the right vulnerability and patch management solution can provide the necessary tools to assess and provide patching opportunities for that unsecure spot – wherever it may be.

ESET Vulnerability and Patch Management (V&PM) – a healthy dose of vitamins

As illustrated previously, threat development is more flexible than before, and defenses need to be shored up to protect all devices that a business employs.

With ESET Vulnerability and Patch Management, which is now also offered as a separate add-on to ESET PROTECT Entry and ESET PROTECT Advanced, even the smallest firm can start its prevention-first journey, warding off tomorrow’s threats looking to infiltrate their premises.

The V&PM module is directly integrated into the ESET PROTECT Platform and is always on – making it easy to stay up to date – protecting against attacks, zero-days, and ransomware all at once. Thus, ensuring visibility and situational awareness, which the entirely new V&PM dashboard improves by giving instant overviews of the vulnerability and patching status across an entire business network.

Moreover, to answer the need for comprehensive vulnerability assessment and patching, ESET has expanded the V&PM module by adding further system treatment into its repertoire – now also covering Linux2 and macOS3.

For Windows and Linux servers, we understand that admins need full control, therefore, on these systems, the V&PM module is not automated and gives admins total control over the entire process, so that they don’t interrupt business workflows.

And if a security admin is growing suspicious about a particular system, on-demand vulnerability scanning will enable them to act quickly in case the need arises.

Sickness be gone!

With current security tools like the comprehensive ESET V&PM module, breaches traced to a vulnerability are no longer about bad luck – they are about inattentiveness and underestimation, both of which have enormous security and even existential consequences for organizations.

Upping the ante in this important area is compliance, with regulations such as NIS2 in Europe, and PCI DSS 4.0 globally, demanding transparent vulnerability disclosure and management. This all shouldn’t be surprising – with thousands of vulnerabilities being recorded quarterly, all it takes is one unpatched hole and tragedy awaits.

So please, take that health check and don’t underestimate your immune system – when you have those vitamins at hand, why not take them?

1The exploited vulnerability was related to a framework for creating web apps written in Java, enabling threat actors to run code remotely.

2Please check our website for desktop Linux compatibility.

3Additionally, Linux patch management, as well as operating system vulnerability scanning and patching in macOS, is on the roadmap.

For more information about ESET Vulnerability and Patch Management, please visit our page here.

Discover how V&PM helps in staying compliant with cyber insurance in our blog here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Research discovers new China-aligned APT group CeranaKeeper, which targeted the Thai government

  • ESET researchers discovered a new China-aligned advanced persistence threat (APT) group, CeranaKeeper, targeting governmental institutions in Thailand. Some of its tools were previously attributed to Mustang Panda by other researchers.
  • Massive amounts of data have been exfiltrated in the attack against the Thai government.
  • The group constantly updates its backdoors to evade detection and diversifies its methods to aid massive data exfiltration.
  • CeranaKeeper abuses popular, legitimate cloud and file-sharing services such as Dropbox, GitHub, and OneDrive to implement custom backdoors and extraction tools.
MONTREAL, BRATISLAVA — October 2, 2024 — ESET researchers have discovered several targeted campaigns against governmental institutions in Thailand, starting in 2023, where massive amounts of data have been exfiltrated. The campaigns misused legitimate file-sharing services such as Dropbox, PixelDrain, GitHub, and OneDrive in the process. Based on the findings, ESET researchers decided to track this activity cluster as the work of a separate threat actor, which ESET named CeranaKeeper. The numerous occurrences of the string “bectrl” in the code of the group’s tools inspired the name: a wordplay between the word beekeeper and the bee species Apis Cerana, or the Asian honeybee. ESET presented its findings about CeranaKeeper and the compromise in Thailand at the 2024 Virus Bulletin conference. The threat actor behind the attacks on the Thai government, CeranaKeeper, seems particularly relentless, as the plethora of tools and techniques used by the group keeps evolving at a rapid rate. The operators write and rewrite their toolset as needed and react rather quickly to avoid detection. This group’s goal is to harvest as many files as possible and it develops specific components to that end. CeranaKeeper uses cloud and file-sharing services for exfiltration and probably relies on the fact that traffic to these popular services would mostly seem legitimate and harder to block when identified. CeranaKeeper has been active since at least the beginning of 2022, mainly targeting governmental entities in Asia such as Thailand, Myanmar, the Philippines, Japan, and Taiwan. The Thai attacks leveraged revamped versions of components previously attributed by other researchers to the China-aligned APT group Mustang Panda, and later, a new set of tools that abuse service providers such as Pastebin, Dropbox, OneDrive, and GitHub to execute commands on compromised computers and exfiltrate sensitive documents.  However, the review of the tactics, techniques and procedures, code, and infrastructure discrepancies leads ESET to believe that tracking CeranaKeeper and MustangPanda as two separate entities is necessary. Both China-aligned groups could be sharing information and a subset of tools in a common interest or through the same third party. “Despite some resemblances in their activities like similar side-loading targets and archive format, ESET observed distinct organizational and technical differences between the two groups, such as differences in their toolsets, infrastructure, operational practices, and campaigns. We also noted differences in the way the two groups accomplish similar tasks,” explains ESET researcher Romain Dumont, who discovered CeranaKeeper. CeranaKeeper is likely using the publicly documented toolset called “bespoke stagers” (or TONESHELL), which heavily relies on a side-loading technique, and uses a specific sequence of commands to exfiltrate files from a compromised network. In their operations, CeranaKeeper deploys components known to be unique to the group and are deployed in their operations.  Furthermore, the group left some metadata in its code that provided ESET with insight into its development process, further solidifying our attribution to CeranaKeeper. After gaining privileged access, the attackers installed the TONESHELL backdoor, deployed a tool to dump credentials, and used a legitimate Avast driver and a custom application to disable security products on the machine. From this compromised server, they used a remote administration console to deploy and execute their backdoor on other computers in the network.  The group deployed a new BAT script across the network, extending their reach to other machines by exploiting the domain controller to gain Domain Admin privileges. In the attack against the Thai government, the attackers found and selected a couple of compromised computers of sufficient interest to deploy previously undocumented, custom tools. These support tools were used not only to facilitate the exfiltration of documents to public storage services but also to act as alternative backdoors. One notable technique the group uses is GitHub’s pull request and issue comment features to create a stealthy reverse shell, leveraging GitHub, a popular online platform for sharing and collaborating on code, as a C&C server. For a more detailed analysis and technical breakdown of CeranaKeeper’s tools, check out the latest ESET Research white paper “CeranaKeeper: A relentless, shape-shifting group targeting Thailand”  on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Secure Authentication: Put your cybersecurity helmet on

 
Roman Cuprik

Multi-factor authentication is a necessity, and now it’s easy to deploy. 

In ice hockey, where players collide with each other at 20 mph (30 km/h) and take shots at speeds of up to about 100 mph (161km/h), it is hard to imagine that players competed without wearing helmets until the late 1970s. Since then, this single piece of safety gear has significantly reduced injuries and prolonged careers of professional players.

This example shows that sometimes the solution to a painful problem can be quite simple. The same is true for authentication, which is among the favorite cyberattack vectors for adversaries. Relevant data confirms again and again that having a single password, no matter how strong, is not enough anymore. An additional layer of protection – multi-factor authentication (MFA) – significantly decreases the likelihood of successful attacks on user credentials.

Well-developed processes to secure employees’ authentication, in combination with password hygiene, are essential parts of any prevention-first approach that aims to stop attacks before they can do any harm to a business. In pursuit of this strategy, ESET incorporated its cloud-based MFA solution ESET Secure Authentication into ESET PROTECT Hub, a new unified point of entry to the ESET PROTECT Platform serving businesses that include MSPs with user, license, and hierarchy management tools.

Aiming for the corners

Just like ice hockey players tend to aim for the top corners of the net because of a high success rate, cybercriminals know that credentials are among the most vulnerable layers of businesses’ defense because of the human element involved.

For example, despite increasing global cybersecurity awareness among adults online, the password  “123456” remains the most-used credential.

And it’s not only a problem for the general public. Poor password hygiene is also observed among IT admins. Digging through more than 1.8 million pages identified as admin portals in 2023 revealed that 40,000 of them used “admin” as their password.

Knowing this, it is no surprise that the latest Verizon 2024 Data Breach Investigations Report found that 77% of basic web application attacks involved stolen credentials, 21% of them were the result of brute force (usually easily guessable passwords), and 13% of those attacks exploited vulnerabilities.

While businesses struggle with password laziness observed among their employees, adversaries improve their techniques to fool even those who are more tech savvy and vigilant. We can already see nefarious technical developments like AI-driven phishing or powerful high-end machines able to guess random six-characters-long passwords in a single day, despite the improved hashing methods used. Not to mention that users of older hashing methods can get breached instantly.

The importance of an MFA helmet

Luckily, most attackers targeting credentials behave like desperate players shooting pucks from their side across the whole rink toward their opponent’s net and hoping for the best. ”Spraying and praying” tactics are still prevalent among various cyberattacks; this is clearly demonstrated by Microsoft data published in 2023. Simple, cheap, and easily mass-produced password attacks still dominate the game. As a result, Microsoft deflects more than 1,000 password attacks per second(!) in its systems. Interestingly, they have noticed that more than 99.9% of accounts compromised didn’t have multi-factor authentication enabled.

Google found similar results in its older 2019 survey showing that adding just an another simple step of verification can block up to 100% of automated bots, 99% of bulk phishing attacks, and 66% of targeted attacks.

Last but not least: multiple or additional factors of authentication are now a standard compliance requirement, just like the helmet has become compulsory in ice hockey.

Automated attacks targeting credentials:

Phishing – Fraudulent messages, emails, or calls luring targeted users into giving their account details and passwords. Using the latest technology, including AI, it is increasingly easy to mass-produce these attacks and at the same time make them more believable.

Password spraying – Trying the most-used passwords, such as the word “password” or “1234,” against a huge number of accounts.

Dictionary attack – Trying a list of passwords derived from a dictionary of words against a valid account.

Brute force – An automated attack against a single account using all possible combinations for a password.

Breach replay or credential stuffing – pervasive reuse of exposed credentials from previous data breaches against many accounts.

Get protected with no sweat

Available in higher tiers of the ESET PROTECT solution for businesses, ESET Secure Authentication provides an additional layer of security against common credential attacks.

It protects both regular employees and IT admins logging into business ecosystems, mitigates the risk of stolen and compromised credentials, keeps attackers from accessing corporate data, and helps businesses with cybersecurity compliance.

And the best part: reducing complexity, smooth installation and operation. The deployment takes around 10 minutes in the cloud; ESET Secure Authentication doesn’t need dedicated hardware – it’s cloud-based, easily scalable, and, what is more, ESET oversees maintenance and upgrades.

Stay safe with ESET

Exploiting valid accounts is still the path of least resistance for cybercriminals, according to IBM X-Force Threat Intelligence Index 2024, and despite effective protection being available, many companies still don’t use it.

Witnessing rapid-fire strikes from cybercriminals against business accounts every second, it’s time to “put a helmet on”. With ESET PROTECT, businesses can not only enjoy multilayered and AI-powered protection against all kinds of sophisticated attacks, but also take a proactive, prevention-first approach and easily deploy MFA to defend their precious accounts against massive automated attacks.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Attention! Alert fatigue can result in severe burnout

 

Sometimes there is just so much work to do that we lose focus and begin to miss some crucial details, leading to a degradation in efficiency, performance, and output – resulting in a complete burnout. This is especially true for IT jobs, where burnout rates are high due to an insurmountable amount of tasks. 

In cybersecurity, alert fatigue is one major sign of burnout, which can enormously influence the state of a business’s cybersecurity. Knowing about the symptoms and ways to ameliorate any possibility of it happening is paramount for the continuing well-being of your business and employees.

What is alert fatigue?

Alert fatigue is a sign of many things, but mostly, it is a sign of an incoming burnout. Be it because of complex interfaces, faulty security software rife with false positives, or low bandwidth to handle incoming alerts, especially in cybersecurity, it is easy to become overwhelmed.

Solutions like Extended Detection and Response (XDR) can be helpful but can also be very demanding, as they require trained eyes to operate. Likewise, Security Information Event Management (SIEM) is very useful, but it can be hard to discern what is or isn’t important, and the incoming traffic of logs can overwhelm even the most skilled professional.

What this results in is a constant demand for one’s attention, increased levels of stress, and a possible distaste for more in-depth investigation of incidents due to the number of reports, which, coupled with other calls for attention at work, can heavily increase one’s workload. Imagine it as a constant need to be alert and attentive. Repeat this several times and, voilá, burnout is achieved.

Demanding workloads

Curiously, a question can be raised whether it is truly the workload that drives alert fatigue, or if it is the result of cybersecurity tools not being up to the task of lightening the human touch.

A case can be made for the need to lower the burden on business IT generalists (staff), since they often also fill in other roles as (aside from having to protect the company from external threats) they also manage the networks and devices used by the employees, among other tasks.

It is not usually a single person managing all the previously mentioned tasks, but that doesn’t mean that individuals in a team cannot suffer burnout; the demands can be high, their bandwidth low, and working on repetitive chores is one way to waste time and achieve insanity. On the flip side, excessive boredom at work can also lead to the same result.

Complex software

For IT specialists, a bane of their existence is bad, buggy, or overly complex software that makes work many times harder. This is why the current trend is to simplify user interfaces and graphics, or add a bit of automation to highlight only the most relevant points.

This is easy to see when looking at the evolution of operating systems or widely used apps – during the 2010s, most companies decided to simplify and make interactions with their prospective parts easier than before (a good example is the iOS 7 update or Windows 11 compared to previous releases). ESET did the same with the ESET PROTECT Platform, introducing a simple and easy-to-use dashboard for ESET PROTECT to make the work of IT security operators more manageable.

What’s more, this design philosophy has driven the company to design features such as the ESET AI Advisor or ESET Vulnerability and Patch Management, addressing the elephant in the room – complex security doesn’t need to be a burden as, believe it or not, being frustrated with security is a great way to weaken it.

Managing burdens and reducing complexity

There is always some way to make work easier, and there always are solutions that exist as an answer to some deficiencies or weak points of others. For example, overburdened or small business IT teams can opt to outsource their security to managed security service providers (MSSPs), lowering the chance of fatigue as a result of cybersecurity-related work.

Cannot cope with the number of detections coming from your extensive business infrastructure? Look for a Managed Detection and Response (MDR) solution that can help any business leverage the added skills and knowledge of an experienced cybersecurity vendor, upscaling their quality and state of protection.

Not every business can afford to increase the size of their IT teams, especially during times when there is a lack of professionals, and those that are available can be very expensive to hire. And if the current specialists are already struggling, why lose them because of burnout?

Apart from outsourcing, there are also some techniques individuals can use to ward off alert fatigue or burnout in general:

  • Take breaks: Overworking yourself is a surefire way to experience burnout sooner rather than later, so try to space yourself and take breaks. 15 minutes every two hours is the recommended amount for office workers, with 8 hours of sleep, of course.
  • Automate some tasks: Oftentimes, people do not know about specific tools that can make their lives easier by employing automation. For example, ESET PROTECT lets admins automate certain tasks, such as OS and product updates, scanning, computer shutdowns, freeing up the bandwidth of security admins. Likewise, the AI-native power of ESET PROTECT’s modules, including ESET AI Advisor in ESET Inspect, can ensure fewer capacity-induced stressors, increasing productivity and efficiency.
  • Look for comprehensive simplicity: Having an easy-to-use interface presenting lots of important data on a single pane of glass is a great way to make IT work more effective, so look for products that, instead of overwhelming you, offer comprehensive protection with simple usage patterns.
  • Learn to delegate: A common complaint of senior IT professionals is that delegating work is hard, as they cannot be sure of the quality of their peers’ work, so they opt to do it instead of focusing on more high-level tasks. However, everyone has a limited bandwidth, and not delegating tasks to others can overwhelm even the best senior employee.
  • Outsource: Cannot cope with all those IT tasks? Consider outsourcing at least your IT security to an MSSP, offloading the IT teams’ burden at least partially, making it harder to burn out. Alternatively, supercharge your current security with an MDR service that can also aid your compliance-related requirements.

As a side note, burnout does not strictly need to be caused by work; there can be many additional factors, such as anxiety from human interaction, depression, or anything coming from the external environment that can have an impact on the human psyche. In those cases, also consider coaching as it might help cope with some problems that not even a job change might solve.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Research investigates the Gamaredon APT group: Cyberespionage aimed at high-profile targets in Ukraine and NATO countries

  • ESET Research examined the operations of Russia-aligned advanced persistent threat (APT) group Gamaredon, which is currently the most engaged APT group in Ukraine.
  • The majority of Gamaredon’s cyberespionage attacks are directed against Ukrainian governmental institutions.
  • ESET saw a few attempts to compromise targets in several NATO countries – namely Bulgaria, Latvia, Lithuania, and Poland – but no successful breaches were observed.
  • Gamaredon notably improved its cyberespionage capabilities, and developed several new tools in PowerShell, with a focus on stealing valuable data – from email clients, instant messaging applications such as Signal and Telegram, and web applications running inside internet browsers.
  • ESET Research discovered PteroBleed, an infostealer that also focuses on stealing data from Ukrainian military system.
BRATISLAVA — September 26, 2024 — ESET Research examined the operations of Gamaredon, a Russia-aligned APT group that has been active since at least 2013 and is currently the most engaged APT group in Ukraine. Gamaredon has been attributed by the Security Service of Ukraine (SSU) to the Russian 18th Center of Information Security of the FSB, operating out of occupied Crimea. ESET believes this group to be collaborating with another threat actor that ESET Research discovered and named InvisiMole. The majority of Gamaredon’s cyberespionage attacks are directed against Ukrainian governmental institutions. However, in April 2022 and February 2023, ESET also saw a few attempts to compromise targets in several NATO countries, namely Bulgaria, Latvia, Lithuania, and Poland, but no successful breaches were observed. Gamaredon is using ever-changing obfuscation tricks and numerous techniques used for bypassing domain-based blocking. These tactics pose a significant challenge to tracking efforts, as they make it harder for systems to automatically detect and block the group’s tools. Nevertheless, during ESET’s investigation, ESET researchers managed to identify and understand these tactics and kept track of Gamaredon’s activities. The group has been methodically deploying its malicious tools against its targets since well before the 2022 invasion began. To compromise new victims, Gamaredon conducts spearphishing campaigns and then uses its custom malware to weaponize Word documents and USB drives accessible to the initial victim, expecting them to be shared with further potential victims. During 2023, Gamaredon notably improved its cyberespionage capabilities, and developed several new tools in PowerShell, with a focus on stealing valuable data – from email clients, instant messaging applications such as Signal and Telegram, and web applications running inside internet browsers.    However, PteroBleed, an infostealer ESET discovered in August 2023, also focuses on stealing data related to a Ukrainian military system – and from the webmail service used by a Ukrainian governmental institution. “Gamaredon, unlike most APT groups, does not try to be stealthy and remain hidden as long as possible by using novel techniques while conducting cyberespionage operations, but rather, the operators are reckless and do not mind being discovered by defenders during their activities. Even though they do not care so much about being noisy, they still put in a lot of effort to avoid being blocked by security products and try very hard to maintain access to compromised systems,” explains ESET researcher Zoltán Rusnák, who investigated Gamaredon. “Typically, Gamaredon attempts to preserve its access by deploying multiple simple downloaders or backdoors simultaneously. The lack of sophistication of Gamaredon tools is compensated by frequent updates and the use of regularly changing obfuscation,” adds Rusnák. “Despite the relative simplicity of its tools, Gamaredon’s aggressive approach and persistence make it a significant threat. Given the ongoing war in the region, we expect Gamaredon to continue in its focus on Ukraine,” he concludes. For a more detailed analysis and technical breakdown of Gamaredon’s tools and activities, check out the latest ESET Research white paper “Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Seven-day moving average of unique machines attacked in Ukraine

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.