Jiri Kropac

We are deeply saddened by the passing of David Harley, a brilliant cybersecurity expert, former ESET Senior Research Fellow, author and long-time Virus Bulletin contributor.

David's legacy spans decades of research, writing, and public speaking.

Rest in peace, David. You will be missed. 💙

Meta is earning a fortune on a deluge of fraudulent ads, documents show Meta projected 10% of its 2024 revenue would come from ads for scams and banned goods, and it internally estimates that its platforms show users 15 billion scam ads a day, company documents show.

Meta’s own researchers concluded that a third of the scams in the U.S. happen over its platforms and that fraudulent ads and those for banned products might contribute a tenth of its revenue. www.reuters.com/investigatio...

#ESETresearch identified an active campaign distributing #NGate – Android NFC relay malware used for contactless payment fraud – targeting Brazilian users.
It is available for download via fake Google Play sites mimicking 4 major banks and 1 e-commerce app. 1/4

#ESETresearch has released its latest APT Activity Report (Apr–Sep 2025): China-aligned groups targeted Latin America amid US-China tensions. Russia-aligned groups intensified ops against Ukraine & EU states. Full report: web-assets.esetstatic.com/wls/en/paper...

The targeted sectors include defense, metal engineering, and the UAV sector. The attackers left the keyword “drone” in their payloads, directly suggesting one of their goals. 3/9

#ESETresearch discovered a new wave of the well-known North Korea-aligned Lazarus campaign Operation DreamJob, now targeting the drone industry.
welivesecurity.com/en/eset-rese... 1/9

The dates of #Botconf2026 - The Botnet and Malware Ecosystems Fighting Conference have been confirmed for our
13th ed - Workshops (14th) & Conference (15th-17th) April 2026 in Reims, France

The CFP is online and ends on January 2nd 2026

https://www.botconf.eu/call-for-proposals/

Android #ToSpy, the spyware used in the other campaign, masquerades solely as the ToTok app. It is distributed through phishing websites impersonating app distribution platforms, such as the Samsung Galaxy Store. 3/6

#ESETresearch has identified two campaigns targeting Android users in the 🇦🇪. The campaigns, which are still ongoing, distribute previously undocumented spyware impersonating #Signal and #ToTok via deceptive websites. www.welivesecurity.com/en/eset-rese... 1/6

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability ESET Research discover a zero-day vulnerability in WinRAR being exploited in the wild in the guise of job application documents.

The same CVE was recently seen exploited in the wild by other groups (e.g., RomCom), and described by ESET Research in a blogpost - www.welivesecurity.com/en/eset-rese... 2/6

#ESETresearch has observed #Gamaredon exploiting CVE-2025-8088 (#WinRAR path traversal) in an ongoing spearphishing campaign. This vulnerability allows arbitrary file write via crafted RAR archives. 1/6

UK police arrest man linked to ransomware attack that caused airport disruptions in Europe | TechCrunch The U.K.s National Crime Agency said the investigation into the ransomware attack against Collins Aerospace is “in its early stages and remains ongoing.”

NEW: The U.K.'s National Crime Agency announced an arrest linked to the ransomware attack against Collins Aerospace, which caused disruptions at several European airports over the weekend.

The man is out on bail, and the agency said the investigation is “in its early stages and remains ongoing.”

Gamaredon X Turla collab ESET researchers reveal how the notorious APT group Turla collaborates with fellow FSB-associated group known as Gamaredon to compromise high‑profile targets in Ukraine.

#ESETresearch has discovered the first known cases of collaboration between Gamaredon and Turla, in Ukraine. Both groups are affiliated with the FSB, Russia’s main domestic intelligence and security agency. www.welivesecurity.com/en/eset-rese...
1/3

HybridPetya installs a malicious EFI application to the EFI System Partition, which then encrypts the Master File Table file, an essential metadata file with information about all files on the NTFS-formatted partition. 2/8

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes ESET researchers have identified a new threat actor targeting Windows servers with a passive C++ backdoor and a malicious IIS module that manipulates Google search results.

#ESETresearch uncovers GhostRedirector, a threat actor compromising Windows servers with a C++ Backdoor named Rungan and Gamshen, a native IIS malware www.welivesecurity.com/en/eset-rese... 1/6

We performed an internet-wide scan to complement ESET telemetry and identify additional servers affected by this threat: at least 65 servers have been affected by late June 2025, mostly in Brazil, Thailand, and Vietnam. 2/6

Rungan is a passive C++ backdoor capable of executing commands on the compromised server. 4/6

#ESETResearch has discovered the first known AI-powered ransomware, which we named #PromptLock. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes 1/7

Paper Werewolf атакует Россию с использованием уязвимости нулевого дня в WinRAR Кластер Paper Werewolf продолжает атаковать российские организации — на этот раз с использованием уязвимостей в WinRAR

This vulnerability was also exploited by another threat actor, independently discovered by the Russian cybersecurity company BI.ZONE, who claim Paper Werewolf began using CVE-2025-8088 on July 22, just a few days after RomCom did. 6/7
bi.zone/expertise/bl...

WinRAR on X: "📢In case you haven't noticed, we've released a new version! ⏫Update today!🚀 https://t.co/Rj4h5hnODw" / X 📢In case you haven't noticed, we've released a new version! ⏫Update today!🚀 https://t.co/Rj4h5hnODw

On July 24, we alerted the WinRAR team, which released version 7.13 just six days later. We advise all users to install the latest version as soon as possible. We would also like to thank the WinRAR team for its cooperation and quick response. 3/7 x.com/WinRAR_RARLA...

#ESETresearch has discovered a zero-day vulnerability in WinRAR, exploited in the wild by Russia-aligned #RomCom @dmnsch @cherepanov74 www.welivesecurity.com/en/eset-rese...
1/7

#ESETresearch joins Europol’s Cyber Intelligence Extension Programme (CIEP) 🤝 We are proud to announce ESET’s participation in the pilot phase of CIEP, a new initiative launched by Europol 's European Cybercrime Centre (EC3). 1/5

ESET first detected an attempt to exploit part of the execution chain on July 17 in🇩🇪. Here, the final #webshell payload was not delivered. The first time we registered the payload was on July 18 in🇮🇹. We have since seen active ToolShell exploitation all over the world. 2/5

#BREAKING #ESETResearch has been monitoring the recently discovered #ToolShell zero-day vulnerabilities in #SharePoint Server: CVE-2025-53770 and CVE-2025-53771. SharePoint Online in Microsoft 365 is not impacted. www.welivesecurity.com/en/eset-rese... 1/5

Unmasking AsyncRAT: Navigating the labyrinth of forks ESET researchers map out the labyrinthine relationships among the vast hierarchy of AsyncRAT variants.

#ESETresearch has mapped the labyrinth of #AsyncRAT forks, identifying the most prevalent versions of this open-source malware. While some variants are mere curiosities, others pose a more tenacious threat. www.welivesecurity.com/en/eset-rese... 1/7

Danabot was targeted by the #FBI and #DCIS, alongside #OperationEndgame led by #Europol and #Eurojust. ESET participated together with several other companies. We provided the analysis of the malware’s backend infrastructure and identified its C&C servers. 3/6

After years of dominance in #ESET’s top #infostealer statistics, the era of #AgentTesla has come to an end. It finished H1 2025 in fourth place, its numbers having decreased by 57%. The reason? It is no longer under active development. 1/4

Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft WASHINGTON — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) is designating Aeza Group, a bulletproof hosting (BPH) services provider, for its role in supporting c...

Aeza Group sanctioned in the US: home.treasury.gov/news/press-r...

It's the third Russian bulletproof hosting provider to get sanctioned this year

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war ESET Research discovers Operation Texonto, a disinformation/psychological operations (PSYOPs) campaign that uses spam emails to demoralize Ukrainian citizens with disinformation messages about war-rel...

ESET’s Matthieu Faou exposed “Operation Texonto”, a pro-Russian disinformation operation aimed at Ukrainian speakers. He shared the full breakdown at #CYBERWARCON.

Watch his talk >> www.youtube.com/watch?v=X5lL...

Read the research >> www.welivesecurity.com/en/eset-rese...

#IO #Cybersecurity

ESET Threat Report H1 2025: #ClickFix attacks surge 500%, SnakeStealer tops infostealer charts, and NFC fraud jumps 35x. Plus, chaos in the ransomware underworld and a new Android adware menace—Kaleidoscope. Dive into the full report: web-assets.esetstatic.com/wls/en/paper... #ESETresearch