The US Department of Justice (DOJ) recently unsealed an indictment against employees of the Chinese contractor I SOON for their involvement in multiple global espionage operations. Those include attacks that ESET Research previously documented in its Threat Intelligence reports and attributed to the FishMonger groupRead More…
ESET researchers, during their regular monitoring of the cyberespionage operations of Winter Vivern, discovered that the group recently began exploiting a zero-day XSS vulnerability in the Roundcube Webmail server. In an XSS attack, malicious scripts are injected into otherwise trusted websites.Read More…
ESET Research has discovered a new cyberespionage group, MoustachedBouncer. It is named after its presence in Belarus and is aligned with the interests of the local government. Active since at least 2014, the group targets only foreign embassies, including European ones, in Belarus.Read More…
ESET researchers have discovered strategic web compromise (watering hole) attacks against high-profile websites in the Middle East, with a strong focus on Yemen. The attacks are linked to Candiru, a company that sells state-of-the-art offensive software tools and related services to government agencies.Read More…
ESET researchers have uncovered a new cyberespionage group attacking mainly hotels worldwide but also governments, international organizations, engineering companies and law firms. ESET has named this group FamousSparrow and believes it has been active since at least 2019.Read More…
ESET Research has discovered that more than ten different advanced persistent threat (APT) groups are exploiting the recent Microsoft Exchange vulnerabilities to compromise email servers. ESET has identified more than 5,000 email servers that have been affected by malicious activity related to the incident.Read More…
ESET research today announced that it has uncovered LightNeuron, a Microsoft Exchange backdoor that can read, modify or block any email going through the mail server, and even compose new emails and send them under the identity of any legitimate user of the attackers’ choice.Read More…
