ESET Research discovered two previously unknown backdoors—which we named LunarWeb and LunarMail—that compromised a European ministry of foreign affairs and its diplomatic missions abroad, primarily in the Middle East.
ESET researchers have discovered a cyberespionage campaign that, since at least September 2023, has been victimizing Tibetans via a targeted watering hole (also known as a strategic web compromise), and a supply-chain compromise to deliver trojanized installers of Tibetan language translation software.
ESET researchers discovered a cyberespionage campaign against a governmental entity in Guyana. Named Operation Jacana by ESET, we believe with medium confidence that it is linked to a China-aligned threat group.
ESET researchers have discovered the WinorDLL64 backdoor, one of the payloads of the Wslink downloader. The targeted region, and overlap in behavior and code, suggest the tool is used by the infamous North Korea-aligned APT group Lazarus.
ESET Research has been analyzing multiple campaigns since last year and some of the campaigns were attributed to the Gelsemium cyberespionage group, and the security company was able to track down the earliest version of their main malware, Gelsevirine, to 2014.
