Botnets are one of the top cyber threats to look out for in 2020, according to Forrester, and with a dispersed, remote workforce, many organizations may be more vulnerable than ever before. Botnet operations can become incredibly sophisticated, carrying out a wide range of illicit activities: collecting browser information, harvesting passwords, stealing login credentials from banking websites, or deploying ransomware.

One of the most infamous botnets is Trickbot, which has compromised over a million computing devices around the world since 2016. Earlier this month, ESET helped to disrupt Trickbot in a global collaboration with Microsoft and other partners.

ESET first detected Trickbot in late 2016, and it has since been recognized as one of the most prevalent banking malware families across the globe. The botnet has targeted several different industries – including education, real estate and government – but the most frequently targeted seems to be the financial sector. With its capabilities for stealing banking credentials and performing fraudulent transactions, Trickbot is a threat to financial data at any business, so businesses must be prepared to protect themselves against this threat.

Trickbot is extremely versatile, with a modular design that allows it to perform an array of malicious actions using a variety of plugins. ESET analyzed nearly 30 different plugins, of which over a third were infostealers. One of these, named injectDll, uses browser hooks to steal user credentials from banking websites, allowing Trickbot’s operators to perform fraudulent bank transfers and steal money from individuals and organizations. Another plugin, known as pwgrab, steals passwords from Filezilla, Microsoft Outlook and WinSCP. These are just two examples of the damage Trickbot could wreak on businesses once it has infested your systems.

A prolific distributor of ransomware – one of the largest threats to the upcoming US election – Trickbot is also a potential danger to election infrastructure. Operators of the botnet could infest a computer system used to report results or store voter rolls, sowing high levels of chaos and distrust among the electorate. The collaborative operation to disrupt Trickbot helped cut off key infrastructure, meaning that the botnet operators are no longer able to initiate new compromises or deploy ransomware as easily.

ESET telemetry shows Trickbot detection numbers plummeting in tandem with the disruption effort:

Figure 1: Trickbot detection numbers from July to October 2020

While the threat of Trickbot seems to have lessened for now, maintaining vigilance for other botnet attacks is still paramount. At the same time as Trickbot’s disruption, the rising detections in ESET telemetry for the Emotet botnet indicated a ramping up of Emotet’s activities, even downloading Trickbot, as well as Qbot, malware:

Figure 2: Emotet detection numbers from July to October 2020

The Emotet malspam campaign was recently bombarding users in Greece, Japan and Lithuania:

Figure 3: Countries most targeted by Emotet from July to October 19, 2020

Facing such a threat may seem like a daunting task, but there are a few ways businesses can protect themselves from botnet operations. Primarily, it is crucial to protect all endpoints with a security solution that has robust detection modules, such as ESET Endpoint Security. Businesses also need to ensure that their networks are always patched with the latest security updates to avoid falling victim to vulnerabilities that threat actors may exploit. Additionally, remote ports can provide an access point for hackers, so restrict access as far as possible – especially to remote desktop protocol (RDP) ports.

To find out more about ESET’s efforts to disrupt the Trickbot botnet, read ESET takes part in global operation to disrupt Trickbot on WeLiveSecurity.

Bratislava – Slovakia, October 21, 2020 – ESET, a global leader in IT and cybersecurity, today announces that its exclusive partner in Japan, Canon Marketing Japan Inc., has received the #1 ranking in the security products category of the Nikkei Computer’s customer satisfaction survey for the eighth year in a row.

Nikkei Business Publications, Inc. is the largest content provider in the country. The prestigious 2020 survey was completed by the IT departments of over 12,000 businesses and local governments, assessing providers across seven groups of criteria; Overall Satisfaction, Performance & Functionality, Reliability, Operability, Cost, Support and Intent to Renew. Respondents assigned satisfaction scores to their selected products on a scale from Satisfied to Dissatisfied for each sub-category. Final scores were calculated as an average of all given points in each respective sub-category.

Canon Marketing Japan Inc. won first place in the survey and is noted as particularly competitive in pricing, performance and functionality – having exceeded the industry average for the last five years. ESET’s portfolio of Endpoint Security solutions, a central part of Canon Marketing Japan Inc.’s security product portfolio, combines multi-layered antivirus capabilities with intuitive software and a low system footprint. The result is award-winning, comprehensive protection for organizations of all sizes.

Hiroya Kuroda, Country Manager at ESET Japan, commented, “We are extremely pleased for our Partner, Canon Marketing Japan Inc., and our products to be recognized in Japan for helping to support cutting-edge security services. The threat landscape faced by businesses today is ever evolving and marked by never-ending attacks. To stay ahead of the game, ESET has doubled its R&D investment worldwide over the past five years with almost 40 per cent of employees working in research and development. This has allowed us to protect our customers with industry-leading security solutions that are innovative, powerful, reliable and easy to use.”

Learn more about ESET Endpoint Security solutions here.

BRATISLAVA – The laureates of this year’s ESET Science Award will be decided by the International jury chaired by a Nobel laureate, Kip Thorne. An American physicist known for his work in gravitational physics and astrophysics, Thorne is one of the three scientists who were awarded the 2017 Nobel Prize in Physics. He entered the world of science fiction as an executive producer and scientific advisor on the movie Interstellar. Together with other members of the jury, he will select the laureates in two categories of the ESET Science Award: Outstanding Individual Contributor to Slovak Science and Exceptional Young Scientist in Slovakia under the Age of 35.

The International jury of renowned scientists is one of the pillars of the ESET Science Award. When evaluating finalists and selecting laureates, they assess various parameters of scientific work, such as current scientific research results and publications, measurable scientometric data, involvement in international scientific projects, communication and popularization, cooperation with other scientific disciplines, the principles of scientific ethics, the potential impact of scientific work on other areas of life, and as reference point for close collaborators or students.

The chair of the International jury in 2019 was the German biophysicist Erwin Neher, laureate of the Nobel Prize in Physiology or Medicine in 1991 for his development of the patch-clamp technique for detection of ion activity in the cell membrane. Kip Thorne will fill the role of chair on the International jury in 2020. He is known for his work in gravitational physics and astrophysics, with an emphasis on relativistic stars, black holes and gravitational waves. He and two other scientists were awarded the 2017 Nobel Prize in Physics for the first direct detection and observation of gravitational waves. Since his retirement, Thorne has taken new directions in his career, including film, where he was not only a consultant on the blockbuster movie Interstellar but also a co-author of its original concept.

The International jury consists of the following renowned scientists:

Hana Dvořaková is a Czech chemist and philanthropist who has dedicated her scientific career to the development of substances that can be used against the HIV virus. In 2013, she and her husband Dalimil founded the Experientia Foundation, which focuses on supporting young scientists in the field of organic, bioorganic and medicinal chemistry with the aim of making Czech chemistry among the world’s best.

Rolf-Dieter Heuer is an experimental particle physicist. Most of his scientific work is related to the study of electron-positron reactions, the development of experimental techniques, and the construction and operation of large detection systems. Professor Heuer was the Director-General of CERN from 2009 to 2015. More recently, he has served as the chair of the European Commission’s Group of Chief Scientific Advisors.

Ralf Riedel focuses on two main areas – molecular synthesis of advanced ceramics at ultra-high temperatures and their energy-related applications, and ultra-high-pressure synthesis of new materials.

Fiona Watt is a British scientist, internationally known for her work in stem cell research. She has explored the role of stem cells in maintaining the skin, which is constantly repaired and replaced throughout our lifetime. She has discovered factors that control how stem cells differentiate, shedding light on how this process might be disrupted in mouth and skin cancer.

Tibor Krisztin is a Hungarian mathematician working on dynamical systems and differential equations. Since 2000, he has been a professor at the Bolyai Institute of the University of Szeged, where he was also the director from 2011 to 2014.

The third category of the ESET Science Award, Outstanding Academic, is decided by a committee composed of representatives of Slovak universities. The award laureates will be announced via an online event on the ESET Science Award Facebook profile on Wednesday, October 14, at 1:30 pm (CEST).

Further information is available at www.esetscienceaward.sk.

BRATISLAVA – ESET, a global leader in cybersecurity, today announces it is ‘graduating’ from its participation in the VB100 and VBSpam tests, following a final assessment in August 2020 by Virus Bulletin (VB). The VB100 test was one of the first relevant global antivirus tests, as executed by the world-renowned independent testing and certification body Virus Bulletin. After 22 years of outstanding results, ESET is refocusing its testing participation to reflect the evolved cybersecurity landscape.

As the endpoint security provider with the highest number of awards in the VB100, and an 18-year passing streak from 2002 to 2020, ESET is immensely proud of its achievements. Highlights from ESET’s participation in the test include the very first test passed in May 1998, followed by a consistent performance since June 2002 of 0 false positives, a 100% WildList detection rate and solid product stability and performance.

Over the past 22 years, ESET has participated in 135 VB100 tests covering 23 operating systems, all the way from Windows 95 to Windows 10. All major ESET products have been evaluated across both the enterprise and consumer segments, including ESET Endpoint Security and ESET Internet Security.

Due to the increasing sophistication of cyber threats, along with our newly developed detection and prevention technologies, ESET will focus on advanced forms of testing that can help improve endpoint detection and response (EDR) capabilities, especially against the techniques employed by APT groups and Ransomware.

Juraj Malcho, Chief Technology Officer at ESET, commented, “Although our participation in VB100 testing has now come to an end, we are immensely proud of the results we have achieved over the last 22 years. It has been a privilege to be involved in one of the pioneering AV tests, and we value the insight and validation that has come over the last two decades.”

Ignacio Sbampato, Chief Business Officer at ESET, added, “ESET is the only Endpoint Security vendor that had 0 false positive and the top detection rate in any test or certification for 18 years in a row. Solid and successful test results are essential in maintaining our reputation for award-winning, cutting-edge cybersecurity solutions. It is our mission to provide a safe and secure technology experience for businesses and consumers around the world, and to ensure that we are one step ahead of potential threats. With the malware landscape becoming increasingly sophisticated, we look forward to engaging in some of the advanced evaluations that can strenuously test our EDR capabilities.”

Learn more about ESET’s award-winning solutions here.

BRATISLAVA – ESET researchers have analyzed a new version of Android spyware used by APT-C-23, a threat group active since at least 2017 that is known for mainly targeting the Middle East. The new spyware, detected by ESET security products as Android/SpyC23.A, builds upon previously reported versions with extended espionage functionality, new stealth features and updated C&C communication. One of the ways the spyware is distributed is via a fake Android app store, impersonating well-known messaging apps, such as Threema and Telegram, as a lure.

ESET researchers started investigating the malware when a fellow researcher tweeted about an unknown, little-detected Android malware sample in April 2020. “A collaborative analysis showed that this malware was part of the APT-C-23 arsenal – a new, enhanced version of their mobile spyware,” explains Lukáš Štefanko, the ESET researcher who analyzed Android/SpyC23.A.

The spyware was found lurking behind seemingly legitimate apps in a fake Android app store. “When we analyzed the fake store, it contained both malicious and clean items. The malware was hiding in apps posing as AndroidUpdate, Threema and Telegram. In some cases, victims would end up with both the malware and the impersonated app installed,” comments Štefanko.

After installation, the malware requests a series of sensitive permissions, disguised as security and privacy features. “The attackers used social engineering-like techniques to trick victims into granting the malware various sensitive rights. For example, permission to read notifications is masked as a message encrypting feature,” details Štefanko.

Once initialized, the malware can carry out a range of espionage activities based on commands from its C&C server. Besides recording audio; exfiltrating call logs, SMS and contacts; and stealing files, the updated Android/SpyC23.A can also read notifications from messaging apps, make screen and call recordings, and dismiss notifications from some built-in Android security apps. The malware’s C&C communication has also undergone an update, making the C&C server more difficult to identify for security researchers.

The APT-C-23 group is known to have used both Windows and Android components in its operations, with the Android components first described in 2017 by Qihoo 360 Technology under the name Two-tailed Scorpion. Since then, multiple analyses of APT-C-23’s mobile malware have been published. Android/SpyC23.A – the group’s latest spyware version – features several improvements making it even more dangerous to victims.

“To stay safe from spyware, we advise Android users to only install apps from the official Google Play Store, double-check the permissions requested, and use a trustworthy and up-to-date mobile security solution,” concludes Štefanko.

For more technical details about this spyware, read the blog post “APT-C-23 group evolves its Android spyware” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.