The who, where, and how of APT attacks – Week in security with Tony Anscombe

Video

This week, ESET experts released several research publications that shone the spotlight on a number of notable attacks and broader developments on the threat landscape

17 May 2024

This week, ESET experts released several research publications that shone the spotlight on a number of notable attacks and broader developments on the threat landscape.

First, their new APT Activity Report reviewed the key aspects of sophisticated attacks as investigated by ESET researchers from October 2023 to March 2024 and looked at the targeted countries and industry verticals, along with the initial access methods and sources of these attacks.

In another major research effort, ESET documented the Ebury attacks that involve one of the most advanced server-side malware campaigns and have compromised hundreds of thousands of servers over a period of at least 15 years – and have even come to encompass credit card and cryptocurrency theft.

In other research, ESET’s experts found two previously unknown backdoors – which they named LunarWeb and LunarMail – compromising a European ministry of foreign affairs and its diplomatic missions abroad. We believe that the Lunar toolset has been used since at least 2020 and is probably the work of the infamous Russia-aligned cyberespionage group Turla.

The above is barely a glimpse of what the research team has published this week – you can learn far, far more about these threats and wider trends in the video and especially in the blogs and papers above.