ESET Research podcast

Threat Report H1 2023: Sextortion, usury and brute-force

In H1 2023, intrusion vectors were closing left and right. This forced many cybercriminals to search for alternative ways to compromise devices of their victims. While some of the attackers tried revisiting old routes such as brute-forcing MS SQL servers or distributing (AI-generated?) sextortion and text-based email messages, others kickstarted several Android apps running usury schemes. But there’s also good news. Emotet botnet went quiet after a month of dwindling and ineffective campaigning, and Redline stealer – a notorious malware-as-a-service – has been disrupted by ESET researchers and their friends at Flare systems. Of course, this podcast episode can only cover so much of the ESET Threat report. If you wish to learn about other topics it covers, visit WeLiveSecurity.
Discussed: Sextortion and text-based threats 1:46, brute force attacks on MS SQL servers 7:10, usury Android apps 9:20, Emotet activity 13:25, RedLine Stealer disruption 16:45.
Host: Aryeh Goretsky, ESET Distinguished Researcher
Guest: Ondrej Kubovic, Security Awareness Specialist
Read more @WeLiveSecurity.com and @ESETresearch on Twitter
ESET Threat Reports and ESET APT Activity Reports

MoustachedBouncer

What do Disco, NightClub, backdoors, espionage, and internet service providers in Belarus all have in common? They all are tied to the same MoustachedBouncer. It sounds like a bad joke, but it sums up some of the key findings of ESET’s latest research focusing on a recently discovered APT group. Listen to ESET Director of Threat Research Jean-Ian Boutin explain the intricacies of this threat actor to our host Aryeh Goretsky - and if that doesn’t satisfy your hunger for further details - then read the full thing on WeLiveSecurity.com.
Host:
Aryeh Goretsky, ESET Distinguished Researcher
Guest:
Jean-Ian Boutin, ESET Director of Threat Research
Materials:
MoustachedBouncer: Espionage against foreign diplomats in Belarus

Finding the mythical BlackLotus bootkit

Towards the end of 2022, an unknown threat actor boasted online that they created a new and powerful UEFI bootkit called BlackLotus. Its most distinctive feature? It could mysteriously bypass UEFI Secure Boot, a feature built into all modern computers to prevent them from running unauthorized software. What at first sounded like a myth turned into reality a few months later when ESET researchers discovered a sample that perfectly matched all the mentioned attributes of a UEFI bootkit known as BlackLotus. Listen to the fascinating story of ESET Malware Researcher Martin Smolár describing his threat hunt to our host ESET Distinguished Researcher Aryeh Goretsky. For more info about this research, read the blogpost on WeLiveSecurity.com.
Host:
Aryeh Goretsky, ESET Distinguished Researcher
Guest:
Martin Smolár, ESET Malware Researcher
Materials:
BlackLotus UEFI bootkit: Myth confirmed

How I (could’ve) stolen your corporate secrets for $100

What do you need to break into a corporate network? ESET’s latest research suggests that interest in secondhand computer hardware, a bit of time, and $100 is more than enough. In this episode, ESET Specialized Security Researcher Cameron Camp explains to host Aryeh Goretsky what secrets he found on secondhand routers bought online, what types of companies he would be able to penetrate with that information, and how to securely wipe devices before selling them. Cameron presented the topic at this year’s RSA Conference in San Francisco and published on WeLiveSecurity.com.
Host:
Aryeh Goretsky, ESET Distinguished Researcher
Guests:
Cameron Camp, ESET Specialized Security Researcher
Materials:
Blogpost Discarded, not destroyed: Old routers reveal corporate secrets
White paper How I (could’ve) stolen your corporate secrets for $100

The year of wipers

Since the Russian invasion on February 24th, 2022, Ukrainians have had to defend their data against an unprecedented number of data-wiping malware variants. While Russian threat actors seem like the obvious culprits, attributing these attacks to specific groups based on evidence is a different beast. In this podcast episode, ESET researchers Anton Cherepanov and Robert Lipovský explain to the host Aryeh Goretsky what pointed them to the crucial samples, how they pinned some of the attacks on the Russian cybergroup probably most notorious for NotPetya and Industroyer. The guests of this episode also offer their recollection of the events of February 23rd, 2022; compare HermeticWiper to its successors; and reveal the range of operating systems that were targeted as well as the level of success achieved by the attacks.
Host:
Aryeh Goretsky, ESET Distinguished Researcher
Guests:
Anton Cherepanov, ESET Senior Researcher
Robert Lipovský, ESET Principal Researcher
Blogposts:
A year of wiper attacks in Ukraine
Episode from March 2022: Past and present cyberwar in Ukraine
 

Threat Report T3 2022

In the last four months of 2022, Russia-aligned APT groups unleashed several data-destroying malware variants on Ukraine. Android detections grew rapidly, while most of the crimeware scene continued on a downward spiral. In this ESET Research Podcast episode, Aryeh Goretsky and Ondrej Kubovic explore trends in several threat areas, including ransomware, exploits used for initial access, and more. For additional security research topics, visit WeLiveSecurity.
Host: Aryeh Goretsky, ESET Distinguished Researcher
Guest: Ondrej Kubovic, Security Awareness Specialist
Read more @WeLiveSecurity.com and @ESETresearch on Twitter
Reports:
ESET Threat Report T3 2022
ESET APT Activity Report T3 2022

Tech in a digital vacuum

Let’s say your network access gets shut off from the rest of the world due to a catastrophic event. Whether it is a natural disaster, an armed conflict, a decision of an authoritarian regime or your connection is just squeezed to a trickle by overzealous network restriction and power grid issues; how secure will you be and for how long? In this episode of ESET Research Podcast, Aryeh Goretsky and Cameron Camp look at this scenario and its implications for the cybersecurity of one’s devices.
Host: Aryeh Goretsky, ESET Distinguished Researcher
Guests: Cameron Camp, ESET Specialized Security Engineer
Read more @WeLiveSecurity.com and @ESETresearch Twitter
Blogposts: 
How long would your tech work in a digital vacuum?
 

Threat Report T2 2022

Looking at the ESET telemetry data from May through August 2022, it seems like the cybercriminal scene has taken taking its foot off the pedal in almost every possible area. But what is the reason for the drop? We expand on the brutal decline in RDP brute-force attacks; changes observed around ransomware messaging and targeting, but we also mention one malware category, where the decline did not apply.
Host: Aryeh Goretsky, ESET Distinguished Researcher
Guests: Ondrej Kubovic, Security Awareness Specialist
Read more @WeLiveSecurity.com and @ESETresearch Twitter
Blogposts:
ESET Threat Report T2 2022