Telekopye, again

In H1 2025, a new social engineering technique called ClickFix started reshaping the threat landscape, quickly becoming the latest craze among all kinds of threat actors and rising to #2 in ESET telemetry. In stark contrast to this surge, law enforcement disrupted two major infostealer-as-a-service operations: Lumma Stealer and Danabot. And of course, no threat report would be complete without ransomware—this time highlighted by dramatic, deathmatch-style infighting that brought down several players including the leading RansomHub. For more details, visit Welivesecurity.com and read the latest H1 2025 report – no paywall or registration required. Discussed: ClickFix and FakeCaptcha 1:05 Whack-a-hack, infostealer version 9:20 Ransomware deathmatch 18:40 Host: Aryeh Goretsky, ESET Distinguished Researcher Guest: Ondrej Kubovič, Security Awareness Specialist Read more @WeLiveSecurity.com and @ESETresearch on Twitter ESET Threat Report H1 2025

In the latest ESET Research Podcast, Aryeh Goretsky and Rene Holt dive into key findings from the APT Activity Report. UnsolicitedBooker, a China-aligned group, showcased relentless persistence by repeatedly attempting to compromise the same organization for several years with its MarsSnake backdoor. Meanwhile, tool-sharing among China-aligned actors like Worok continues to blur attribution, with overlapping activities involving groups such as LuckyMouse and TA428. On the Russia-aligned front, Sednit expanded Operation RoundPress to exploit multiple webmail platforms, Gamaredon kept up its relentless obfuscation efforts in Ukraine, and Sandworm unleashed its ZEROLOT wiper again, erasing critical files of its victims. Aryeh and Rene also discuss the financial schemes of North Korea-aligned groups and the noisy yet coordinated efforts of Iran-aligned actors. Listen to the full episode or download the report on WeLiveSecurity.com. Host: Aryeh Goretsky, ESET Distinguished Researcher Guest: René Holt, Security Awareness Specialist Read more at WeLiveSecurity.com and @ESETresearch on Twitter APT Activity Report Q1 2025

In H2 2024, the infostealer scene went through a shakeup leading to a reshaped top 10 with Formbook dethroning Agent Tesla, Lumma Stealer jumping the ranks by using a new tactic for its distribution, and both Redline Stealer and Meta Stealer losing ground after takedown. There’s also a novel attack vector that works for both Android and iOS devices, misusing technologies allowing mobile users to install apps directly from websites from mobile browsers. And let’s not forget the booming numbers of investment scams on social media, detected as HTML/Nomani. Of course, this podcast episode can only cover so much of the latest ESET Threat Report H2 2024. Visit WeLiveSecurity to read about other topics it covers. Host: Aryeh Goretsky, ESET Distinguished Researcher Guest: Ondrej Kubovič, Security Awareness Specialist Read more @WeLiveSecurity.com and @ESETresearch on Twitter ESET Threat Report H2 2024

Neanderthals hunting Mammoths are back. Of course, we’re not talking about some Jurassic-Park-like technology that resurrected them in a remote region. No, this episode of ESET Research Podcast returns to the malicious operation of dozens of cybercriminal groups (Neanderthals) targeting inexperienced users (Mammoths) on online marketplaces, using a malicious Telegram bot known as Telekopye. Discussing the topic, ESET Research Podcast host Aryeh Goretsky, and ESET malware researchers, Radek Jizba and Jakub Soucek, revisit and update the information ESET has gathered about the cybercriminal ecosystem, explain the most frequent scenarios used by the attackers and map out their expanded hunting grounds. For full info, read more in ESET’s recently published white paper on WeLiveSecurity.com. Host Aryeh Goretsky, ESET Distinguished Researcher Guests: Jakub Souček, ESET Senior Malware Researcher Radek Jizba, ESET Senior Malware Researcher Materials: Blogpost Telekopye transitions to targeting tourists via hotel booking scam Whitepaper Marketplace scams: Neanderthals hunting Mammoths with Telekopye

When describing state-backed threat actors, one would probably expect a super sophisticated, stealthy, group that can avoid all alarms and defenses with surgical precision. With Gamaredon, most of that goes out the window as this is one noisy, extremely active Russia-aligned group that does not care if defenders uncover its activities. However, it is also an actor that develops and improves its cyberespionage tools and techniques literally every day. If you want to know more about Gamaredon’s modus operandi, victimology, tooling, or estimated geolocation, then listen to the debate of ESET Researchers Robert Lipovský and Zoltán Rusnák. For full details, read more in ESET’s recently published white paper on WeLiveSecurity.com. Host Aryeh Goretsky, ESET Distinguished Researcher Guests: Robert Lipovský, ESET Principal Malware Researcher Zoltán Rusnák, ESET Senior Malware Researcher Materials: ESET blogpost on Gamaredon activity in 2022 and 2023 ESET white paper on Gamaredon activity in 2022 and 2023 SSU report on activities of Gamaredon

Some cybercriminals are sophisticated, cooperate with other attackers, and do everything to stay under the radar. Then there are threat actors like CosmicBeetle that lack the necessary skills set, yet still manage to compromise systems and even achieve “stealth” by using odd, impractical and overcomplicated techniques. If you want to know more about this crude and clumsy actor, listen to ESET senior malware researcher Jakub Souček talk about his research findings with our host Distinguished Researcher Aryeh Goretsky. For a detailed report on CosmicBeetle visit WeLiveSecurity.com. Host Aryeh Goretsky, ESET Distinguished Researcher Guest: Jakub Souček, ESET senior Malware Researcher Materials: CosmicBeetle steps up: Probation period at RansomHub

Telegram, with nearly a billion monthly users, is a juicy target for cybercriminals, especially if they can exploit a zero-day vulnerability. ESET malware researcher Lukáš Štefanko ran into such an exploit – which ESET named EvilVideo – being sold online. In the discussion with our podcast host ESET Distinguished Researcher Aryeh Goretsky, Štefanko describes the findings of his analysis, including which platforms were affected, what malware can be bundled with EvilVideo, and how Telegram developers reacted when ESET reached out to report the vulnerability. If you want to read more about EvilVideo or our other research findings, head to WeLiveSecurity.com. Host Aryeh Goretsky, ESET Distinguished Researcher Guest: Lukáš Štefanko, ESET Malware Researcher Materials: Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android PS: For those of our listeners who are attending the 2024 ESET Technology Conference and playing along with our game of capture the flag, the flag for the CTF challenge named “Radio Broadcast” is: podcasts_are_new_books.

In this episode, ESET Distinguished Researcher Aryeh Goretsky and his guest ESET Principal Threat Intelligence Researcher Robert Lipovsky detail recently discovered unusual adware called HotPage. This trojan caught attention of researchers by using a Microsoft-signed, yet vulnerable, kernel driver to inject and manipulate what victims see in their browsers. With its advanced technical means and targeting of Chinese internet cafes and gamers, it shows that even adware creators can invest extra time and effort to innovate their malicious products.   Host Aryeh Goretsky, ESET Distinguished Researcher Guest: Robert Lipovsky, ESET Principal Threat Intelligence Researcher Materials: HotPage: Story of a signed, vulnerable, ad-injecting driver

The I-SOON data leak has allowed us to identify FishMonger, a group notorious for the cyberattacks against Hong Kong universities back in 2019, as I-SOON. This contractor also developed a platform for tracking gambling activity, linking the group to Operation ChattyGoblin. MustangPanda conducted a series of attacks on cargo shipping companies in Norway, Greece, and the Netherlands, even compromising the ships’ systems. Since the Hamas-led attack on Israel in 2023, Iran-aligned groups have shifted focus to impact attacks. Visit WeLiveSecurity to read about other topics covered in the the latest ESET APT Activity Report. Host: Aryeh Goretsky, ESET Distinguished Researcher Guest: Robert Lipovský, ESET Principal Malware Researcher Read more @WeLiveSecurity.com and @ESETresearch on Twitter ESET Threat Reports and ESET APT Activity Reports

In 2023, ESET detected over 675,000 attempts to access malicious domains abusing the popularity of ChatGPT; some offer bring-your-own-key web apps that can steal OpenAI API keys. Apart from AI, in H2 the Cl0p ransomware gang exploited MOVEit software, causing a staggering $14 billion in damages. The IoT landscape faced the new Pandora botnet, compromising Android devices via malicious firmware updates or pirated content apps. Of course, this podcast episode can only cover so much of the latest ESET Threat Report H2 2023. Visit WeLiveSecurity to read about other topics it covers. Host: Aryeh Goretsky, ESET Distinguished Researcher Guest: René Holt, Security Awareness Specialist Read more @WeLiveSecurity.com and @ESETresearch on Twitter ESET Threat Reports and ESET APT Activity Reports