Deconstructing Mikroceen: Researchers uncover spying backdoor attacking high-profile targets in Central Asia

The analysis is the result of joint research between ESET and Avast

BRATISLAVA, PRAGUE – ESET recently teamed up with Avast to research a widespread and constantly evolving remote access tool (RAT) with the usual backdoor functionality that ESET has dubbed Mikroceen. In the joint analysis, the researchers uncovered Mikroceen being used in espionage attacks against government and business entities (from the telecommunications and gas industries) in Central Asia.

The attackers were able to gain long-term access to affected networks, manipulate files and take screenshots. Victims’ devices could execute various commands delivered remotely from command and control servers.

The researchers investigated the custom implementation of Mikroceen’s client-server model, purpose-built for cyberespionage. “The malware developers put great effort in securing the client-server connection with their victims. Their malware was leveraged ‘in the wild,’ as the operators managed to penetrate high-profile corporate networks. We also saw a larger attack toolset being used and constantly developed, which consisted mainly of variations in obfuscation techniques,” comments Peter Kálnai, who led the ESET arm of the joint research team.

Mikroceen is under constant development, and security researchers have seen it used with backdoor capabilities in various targeted operations since late 2017. Among the tools used by the attackers to move within the infiltrated networks, ESET and Avast researchers also identified Gh0st RAT, an older, yet infamous, RAT created around 2008. There are many similarities between Gh0st RAT and Mikroceen, with the main shift between the projects in securing the connection with a certificate.

For more technical details about Mikroceen, read the blog post Mikroceen: Spying backdoor leveraged in high profile networks in Central Asia on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.


About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Research discovers cyber espionage framework Ramsay

Bratislava, Montreal – ESET researchers have discovered a previously unreported cyber espionage framework they dub Ramsay. The framework is tailored for collecting and exfiltrating sensitive documents from air-gapped systems that are not connected to the internet or other online systems. Since the number of victims so far is very low, ESET believes that this framework is under an ongoing development process.

“We initially found an instance of Ramsay in a VirusTotal sample uploaded from Japan that led us to the discovery of further components and other versions of the framework along with substantial evidence to conclude that the framework is still in a developmental stage, with delivery vectors subject to fine testing,” says Alexis Dorais-Joncas, head of ESET’s Montreal-based research team.

According to ESET findings, Ramsay has gone through several iterations based on the different instances of the framework found, denoting a linear progression on the number and complexity of its capabilities. The developers in charge of infection vectors seem to be trying different approaches, such as using old exploits for Microsoft Word vulnerabilities from 2017 and deploying trojanized applications for delivery, potentially via spear-phishing. The three discovered versions of Ramsay differ in complexity and sophistication, with the latest third version being the most advanced, especially with regard to evasion and persistence.

Ramsay’s architecture provides a series of capabilities managed via a logging mechanism:

  • File collection and covert storage: The primary goal of this framework is to collect all existing Microsoft Word documents within a target’s file system.
  • Command execution: Ramsay’s control protocol implements a decentralized method of scanning and retrieving commands from control documents.
  • Spreading: Ramsay’s embeds a component that seems to be designed to operate within air-gapped networks.

“Especially noteworthy is how the architectural design of Ramsay, especially the relationship between its spreading and control capabilities, allows it to operate in air-gapped networks – meaning networks that are not connected to the internet,” says Dorais-Joncas.

Overview of discovered Ramsay’s versions

For more technical details about Ramsay, read the blog post Ramsay: A cyber espionage toolkit tailored for air-gapped networks on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET upgrades security management for organizations running Microsoft Azure

Bratislava – ESET has upgraded its Security Management Center for Microsoft Azure, providing organizations with complete, real-time network visibility and allowing them to oversee thousands of servers, desktops and mobile devices via a single pane of glass.

ESET Security Management Center for Microsoft Azure is a cloud-based management solution that gives businesses the capability to deploy, update and manage all ESET security solutions from a single console. The upgraded management console is ideal for both small and large organizations already utilizing Microsoft Azure, and requires no additional hardware or license fees.

The comprehensive solution enables businesses to easily manage all physical and virtual desktops and servers running on Windows, macOS and Linux, as well as supporting full Mobile Device Management (MDM) of Android and iOS devices. ESET Security Management Center seamlessly combines the management of multiple endpoint products, including ESET Enterprise Inspector and ESET Dynamic Threat Defense in one easy-to-use hub, also accessible via browser. This means organizations are equipped with multilayered protection that addresses the key tenets of a strong cybersecurity strategy: threat prevention, detection, assessment and response.

In addition, the solution features a fully customizable notification system, allowing users to configure notifications with the exact information they wish to be notified about.

Igor Hula, Product Manager at ESET, commented: “We are dedicated to providing our users with the very best in IT security, and our wide range of product offerings for a variety of platforms and devices exemplifies this. We believe every business should be equipped with cutting-edge technology in order to keep both their employees and customers safe and secure, and we are continuously improving and adapting our solutions to ensure this. It is vital that businesses of all sizes are supported by a comprehensive cybersecurity strategy – advanced and easy-to-use solutions mean businesses can focus on their goals, knowing they are securely protected.”

For further information on ESET Security Management Center for Microsoft Azure, please click here.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Internews and ESET develop security partnership to protect human rights defenders

Bratislava – Global nonprofit Internews has partnered with cybersecurity company ESET to distribute antivirus software to civil society and at-risk groups worldwide. The pilot project will protect more than 1000 devices, reaching a network of journalists, human rights groups, and members of civil society who are highly vulnerable to digital threats.

“These licenses will fill a critical gap among the most at-risk communities around the globe,” said Megan DeBlois, Information Security Advisor at Internews. “The consequences of online attacks against human rights defenders can be life altering — leading to silencing, arrests, or worse. We’re grateful to partner with ESET for helping us provide stronger protections to human rights defenders at such a vital time for information provision.”

Internews supports media organizations and other information providers globally with resources, training, and funding so they can deliver trustworthy and accurate information to local communities. This includes providing direct technological support to those working in some of the most restrictive regimes worldwide.

“We’re thrilled to be working with Internews to help better protect those on the front lines, the people providing information at this time of crisis,” said Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET. “First responders in human rights communities often operate with very limited resources while they face some of the most advanced and dedicated threat actors. It’s meaningful to all of us at ESET to be able to support these communities with high-quality tools and protections that might not be available to them otherwise.”

“This pilot project with ESET enables beneficiaries to access antivirus tools which are otherwise prohibitively expensive, limited to free-tier services, in short supply for NGO licenses, and/or reliant on advertising models,” said Jon Camfield, director of Global Technology Strategy at Internews. “While antivirus is not a cure-all or appropriate for all threat models, it is a critical tool for reducing risk.”

The Internews/ESET partnership is intended to strengthen connections between civil society and the private sector, enabling a greater exchange of ideas and needs from end users to tech developers. This connection is a core principle of Internews’ global technology efforts.

“Identifying and flagging malign actions helps improve security for everyone, not just the individual or group targeted,” said DeBlois. “As companies like ESET have greater visibility into the offensive tactics being deployed against civil society, they’re even better equipped to design effective defensive strategies to protect all users from these advanced threat actors.”

The initiative comes as cyberattacks are on the rise as more and more people move to operating online in response to the COVID-19 situation, and forms part of Internews’ broader work in ensuring vital information can reach all sectors of society at this crucial time.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Internews

For more than 35 years and in more than 100 countries, international nonprofit Internews has supported the work and safety of thousands of media professionals, human rights activists, and information entrepreneurs. In recent years, we have witnessed a growing imbalance of power between highly capable threat actors and the communities they’re targeting. Internews’ MONITOR Project applies lessons learned from industry to build networks of civil society organizations with the ability to detect, respond to, and share information around digital attacks for greater security resilience. Learn more: https://globaltech.internews.org/our-resources/monitor

ESET to support EU CERTs with free access to Threat Intelligence during COVID-19

Bratislava – ESET, a global leader in cybersecurity, has implemented measures to assist national Computer Emergency Response Teams within the EU (EU CERTs) in mitigating threats during the COVID-19 crisis. As a fellow EU-based vendor, ESET is dedicated to partnering with organizations across the EU to ensure that its citizens are safe and secure online.

To help protect the general public and infrastructure in their respective countries, ESET is offering public sector EU CERTs free access for six months to the ESET Threat Intelligence Data Feeds. The offering includes access to ESET’s Domain, URL, Malicious files and Botnet feeds.

The COVID-19 crisis has seen an increase in the number of digital threats, and it is vital that EU nations are equipped with the tools and resources needed to protect their citizens and systems against all potential threats. ESET Threat Intelligence is ESET’s threat reputation network. It uses information gathered from over 110 million sensors in order to share actionable threat intelligence with users.

Access to the ETI Data Feeds will enable the CERTs to monitor possible threats in order to mitigate the risk of an attack and strengthen their defenses. Collaboration is an essential part of threat intelligence and response, and ESET has reached out to 46 CERT institutions across the EU for partnership, with initial feedback very positive and several implementations already underway.

Ignacio Sbampato, Chief Business Officer at ESET, commented: “We believe everyone has the right to a safe and secure experience of technology, and this means that the public sector must be equipped with the resources to protect both its citizens and infrastructure. Unfortunately, there are malicious actors seeking to take advantage of the current crisis, and we are dedicated to assisting emergency response teams across the EU in mitigating and responding to these potential threats. As an EU-based organization, we hold the safety of our citizens close to our hearts, and we endeavor to do everything we can to support local CERT teams during this time.”

Learn more about ESET Threat Intelligence here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Science Award launches its second annual edition

Bratislava – At a time when the world is relying on scientists and science to help with the coronavirus pandemic, ESET Science Award is launching its second annual recognition contest. Its aim is to recognize outstanding scientists working in Slovakia and introduce them to the public, as well as to showcase the essential role that science plays in society. The international jury will once again be chaired by a Nobel Prize winner this year.

In 2019, ESET Science Award launched its second annual edition to recognize exceptional scientists and academics working in Slovakia. Laureates of the first award include chemist Ján Tkáč, molecular biologist Ľubomíra Tóthová, and bioinformatics scientist Tomáš Vinař.

One of the objectives of the ESET Science Award is to highlight the important role of science and scientists within society. “Today more than ever we, as a society, recognize that scientific knowledge can save thousands of lives and help us make better decisions,” says Richard Marko, CEO of ESET. “Results of a survey conducted before the launch of this year’s award show that as much as 86 percent of respondents agree that Slovakia needs stronger support for science and research. We believe that by recognizing outstanding personalities in science, we will be able to increase the public’s interest in the field, thus increasing the state’s support for it.”

The jury that decides on the laureates consists of world-renowned and respected representatives of science disciplines from around the world. The jury assesses the short-listed scientists in terms of the quality of their scientific work and research and how these overlap with society, with an emphasis on international standards. A complex evaluation process includes both quantitative and qualitative criteria, taking into account the analysis of professional work and its benefits for society, communication, and scientific ethics and integrity.

This year, a top-level evaluation process is to be overseen by an international jury chairman who is a Nobel Prize winner. As the award organizer, the ESET Foundation is hopeful that, despite the current situation with the coronavirus pandemic, it will be able to secure the chairman’s participation in person. “Accepting the award from a Nobel Prize winner has been an exceptional moment in my scientific career. Despite the laureates being decided by a high-quality international scientific jury, I am pleased that this award comes not only from scientific circles but also from the wider community. It symbolizes that society is slowly starting to recognize the role of science in people’s everyday lives,” says Jan Tkáč, the 2019 laureate in the main category, Outstanding Individual Contributor to Slovak Science.

Scientists, researchers, and academics working in Slovakia have until May 28, 2020, to submit an application for the ESET Science Award via the esetscienceaward.sk website. Like last year, this year’s award is to be split into three categories – Outstanding Individual Contributor to Slovak Science, Exceptional Young Scientist in Slovakia under the Age of 35, and Outstanding Academic. The award covers four scientific areas: natural sciences, medical and pharmaceutical sciences, technical sciences, and agricultural sciences. An award ceremony to announce the laureates is planned for October 14, 2020, subject to change based on the coronavirus pandemic situation. For more information, visit www.esetscienceaward.sk.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET investigates Grandoreiro, a trojan exploiting the coronavirus pandemic

BRATISLAVA, PRAGUE – As part of an ongoing series on Latin American banking trojans, ESET researchers take an in-depth look at Grandoreiro. This trojan targets users especially in Brazil, Mexico, Spain and Peru. Distributed almost exclusively through email spam, it has lately started to utilize fake websites capitalizing on the global coronavirus pandemic. Grandoreiro reveals a persistent effort from its authors to evade detection. Although ESET has seen Grandoreiro primarily distributed through spam, where the authors usually utilize a fake Java or Flash update, recently we have observed a shift to COVID19 related scams. The trojan was hiding in videos on fake websites promising information about the coronavirus. However, instead of playing, clicking the video leads to the download of a payload on visitors’ devices.Grandoreiro has been active since at least 2017 in Brazil and Peru, expanding to Mexico and Spain in 2019. As with other Latin American banking trojans in this series, Grandoreiro attacks its victims by displaying fake pop-up windows as a ploy to get them to divulge sensitive information.

The backdoor functionality of Grandoreiro includes manipulating windows; updating itself; capturing keystrokes; simulating mouse and keyboard actions; navigating browsers to chosen URLs; signing out and restarting machines; and blocking access to websites. Grandoreiro collects various information about affected machines and, in some versions, it also steals credentials stored in Google Chrome as well as data stored in Microsoft Outlook browsers.“For a Latin American banking trojan, Grandoreiro utilizes a surprisingly large number of tricks to evade detection and emulation. That includes many techniques to detect or even disable banking protection software,” says ESET researcher Robert Šuman, leading the team analyzing Grandoreiro. “They seem to be developing the banking trojan very rapidly. Almost every new version we see introduces some changes. We also suspect they are developing at least two variants simultaneously. Interestingly, from a technical point of view, they also utilize a very specific application of the binary padding technique that makes it hard to get rid of the padding while keeping a valid file,” adds Šuman.Unlike the majority of Latin American banking trojans, Grandoreiro utilizes quite small distribution chains. For different campaigns, it may choose a different type of downloader. These downloaders are often stored on well-known public online sharing services such as GitHub, Dropbox, Pastebin, 4shared or 4Sync.

For more technical details about Grandoreiro, read the blogpost “Grandoreiro: How engorged can an EXE get?” on WeLiveSecurity.com. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

GREYCORTEX CTO ON SECURING THE HOME-OFFICE NETWORK

The emergency provisions related to COVID-19 have been active for some time and more and more companies are allowing their employees to work from home. We asked Our Chief Technology Officer Vladimír Sedláček, a seasoned administrator of ICT, corporate systems, cybersecurity, and experienced developer, about his opinion on current affairs.

The Coronavirus pandemic impact is discussed everywhere, but few people seem to realize that despite all the physical risks, digital issues still present a significant problem. How do you see the current situation, and what do you consider to be the biggest risk in terms of virtual infections, and their possible outcome for companies?

It would be naive to assume that the global crisis would lead to a drop in cyberattacks or will result in a ceasefire. On the contrary. In nature, each weakened individual becomes prey. Regardless of any previous “ceasefire declarations”, we see an increase in the number of attacks and targeted at the SARS-NCov-2 situation. Obviously, we can expect contacts from faux health inspectors and money collectors. Even my inbox has received several phishing emails offering nano-silver infused masks. In addition to attacking the weakest part of cybersecurity – the user – we also see an increase in scanning; looking for vulnerable computers and security holes in firewalls or hastily constructed VPNs and remote desktop gateways. In the end, all of this contributes to latent disclosure of company secrets, production, and patent documentation, or personal data. Infiltration by extortion malware also becomes a threat and can mean a total production halt, as seen both last year and recently in some hospitals in the Czech Republic.

What do you see as the most common errors from employers and top management regarding data exposure; and how does the risk increase with massive deployments of quarantine provisions where most employees work from home?

Right now, the risk is increased by companies laying off contractors, often those working on infrastructure, promoting rotating furloughs, and allowing their administrators to work from home. This can cause a delay in necessary security patching and increased response time. Also, ad hoc suspension of certain user accounts can leave the access ripe for unauthorized access restores later. Last, but not least, some companies have allowed their employees to work from home using their home computers. VPN has thus become a gateway for free access directly into company networks, and to internal company systems, all thanks to home devices with uncertain security postures, possibly outdated operating systems, obsolete software, or a load of games full of spyware. These systems are being used by home-bound users surfing the web with local superuser rights. It is very similar to allowing the usage of personal devices (BYOD) and letting them directly connect into internal, as opposed to guest networks. A lot of companies do not, however, tackle the situation accordingly, and have not familiarized their employees with relevant security policies. Without in-depth employee training and without respecting the basic rules of cyber hygiene, internal data can leave the control of responsible people working with it. What has not received much attention so far is the risk of company device theft in conjunction with wiping such devices clean. Partly due to the fact that the employees “stay home” and are convinced that they have good visibility over their physical environment. However, thefts will happen, and the security angle will need to be tackled. I cannot understand why so few administrators allow internal networks to stay open, and who pay attention to their internal network traffic with only commonly used tools for network monitoring. Same tools that are deployed normally are themselves a potential attack target.

 

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.


About GREYCORTEX

Founded in 2016 in Brno, Czech Republic, GREYCORTEX helps organizations make their IT and OT operations secure and reliable with uses advanced artificial intelligence, machine learning, and data mining methods which detect advanced threats to security and risks to reliability that other solutions miss.

ESET researchers disrupt cryptomining botnet VictoryGate

BRATISLAVA, BUENOS AIRES – ESET researchers have recently discovered a previously undocumented botnet named VictoryGate. It has been active since at least May 2019, and is composed mainly of devices in Peru, where over 90% of the infected devices are located. The main activity of the botnet is mining Monero cryptocurrency. The victims include organizations in both public and private sectors, including financial institutions. Thanks to data obtained during this research and shared with the nonprofit Shadowserver Foundation, at least a portion of the botnet operation has been disrupted.

ESET researchers have been “sinkholing” several domain names that control the botnet’s actions, replacing them with machines that do not send the botnet’s slave computers the commands they expect, but simply monitor botnet activity. Based on this data and ESET telemetry, ESET estimates that at least 35,000 devices became infected with VictoryGate at one point or another during this campaign.

The only infection vector used for spreading VictoryGate is via removable devices. “The victim receives a USB drive that at some point was connected to an infected machine. It seemingly has all the files with the same names and icons that it contained before being infected. Because of this, the content will look almost identical at first glance. However, all the original files were replaced by a copy of the malware,” says ESET researcher Alan Warburton, who investigated the botnet. “When an unsuspecting user attempts to open one of these files, the script will open both the file that was intended and the malicious payload.”

Warburton also warns about the impact on victims’ machines: “There is very high resource usage by the botnet, resulting in a constant 90% to 99% CPU load. This slows down the device and can cause overheating and possible damage.”

According to ESET research, VictoryGate has made a much greater effort to avoid detection than in previous, similar campaigns observed in the Latam region. And, given the fact that the botmaster can update functionality of the payloads that are downloaded and executed on the infected devices from cryptomining to any other malicious activities at any given time, this poses a considerable risk. This is particularly true since many of the victims identified were in either the public sector or in financial institutions.

If you suspect your device may have been infected with this malware, you can use our free ESET Online Scanner to clean your machine. The first-stage module is detected by ESET security products as MSIL/VictoryGate.

The peak number of unique IP addresses connecting to the botnet command and control server per day.

For more technical details about the VictoryGate botnet, read the blogpost Following ESET’s discovery, a Monero mining botnet is disrupted on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.