The IT Nerd

ESET today announced that Tony Anscombe,  Cyber Security Evangelist at ESET, will be the emcee for the Developer Track: FullSTK at this year’s Collision Conference. With topics ranging from AI and privacy to future tech, Anscombe will introduce and shed light on a range of critical technology topics during the event, which brings together the product managers, data scientists, coders and engineers programming the future to talk tech. 

Tony Anscombe brings a wealth of experience to the stage as Cyber Security Evangelist at ESET, having spoken at renowned industry conferences such as RSA, Black Hat, Infosec, Gartner Risk and Security Summit, and the Child Internet Safety Summit. Most recently, Anscombe presented on cyber risk insurance, and published an industry whitepaper on the topic, for ESET World 2024, an annual event where global cybersecurity professionals, analysts and decision-makers come together to discuss technological advancements.  

During the FullSTK Developer Track, the following topics will be highlighted: 

• Future Tech: Explore the potential of superpositions and DNA enzymes in processing data at unprecedented speeds, the impact of identity orchestration on development, the future of ambient computing, and advances in AI and machine learning. 

• Security and Compliance: With the escalation of cyberwarfare and increasingly stringent legislation, discover new security tools and tactics. Learn what companies and nation-states can do to thwart sophisticated cyberattacks and stay ahead of technological advancements. 

• Privacy and Diversity in Data: Address the pressing ethics of AI technology, including opaque terms and conditions and algorithmic biases. Discuss how technology companies are advancing data privacy and fostering diversity to design complex AI systems free from bias. 

• The Role of the Engineer: Analyze how DevOps teams have led the way in remote work and the ongoing influence of engineers on the future of work. Investigate the challenges companies face in acquiring technically skilled workers and the implications of nearshoring talent. 

As a speaker, author, and recognized expert in the current threat landscape, security technologies, data protection, privacy, and internet safety, Anscombe’s insights are highly sought after and respected globally. He is regularly quoted in leading security, technology, and business publications such as BBC, The Guardian, The New York Times, and USA Today. Additionally, he has made broadcast appearances on Bloomberg, BBC, CTV, CBC, CP24, Global News, and CBS, establishing himself as a trusted voice in the cybersecurity domain. 

Don’t miss the opportunity to engage with Tony Anscombe and gain valuable insights during the FullSTK sessions at Collision Conference 2024. For more details, visit here: LINK. 

ESET has announced the establishment of its first local data centre in Canada, marking a significant milestone in its commitment to delivering unparalleled service and security to its customers across the country. 

The local data centre plays a crucial role in accelerating the delivery of ESET’s innovative cybersecurity solutions to Canadian businesses and individuals. By leveraging state-of-the-art technology and robust infrastructure, ESET will be able to deploy updates and patches more efficiently, ensuring that customers are always protected against the latest threats.

The launch of the new data centre represents a strategic investment in Canada’s cybersecurity infrastructure, enabling ESET to better serve its growing customer base with faster response times, enhanced data protection and improved overall performance.

The importance of a local data centre is critical with cybersecurity threats evolving rapidly. By housing critical data and infrastructure within Canada’s borders, ESET ensures compliance with local regulations and provides customers with peace of mind knowing that their sensitive information remains secure and protected.

ESET Canada remains dedicated to empowering Canadians to enjoy the full potential of the digital world without compromise. With the establishment of its local data centre, ESET reaffirms its position as a trusted partner in cybersecurity, committed to safeguarding the digital lives of individuals and businesses across the country.

Current ESET customers can rest assured that a local representative will reach out to discuss options available for transferring data.

 ESET today announced the launch of two new Managed Detection and Response (MDR) subscription tiers: ESET PROTECT MDR for small and medium businesses (SMBs) and ESET PROTECT MDR Ultimate for enterprises. These offerings are built on the foundation of ESET PROTECT Elite and ESET PROTECT Enterprise, offering businesses of all sizes the most comprehensive, AI-powered threat detection and response capabilities, in combination with expert human analysis and comprehensive threat intelligence.

ESET’s MDR offerings are designed to cater to the specific needs of both SMBs and Enterprises. To that end, ESET PROTECT MDR delivers a comprehensive cybersecurity package, offering 24/7/365 superior protection that addresses the most common challenges of small and medium-sized businesses. This includes modern protection for endpoints, email, and cloud applications, vulnerability detection and patching, and managed threat monitoring, hunting, and response. It addresses the cybersecurity talent shortages and ensures compliance with cyber insurance and regulations, offering a remarkable 20-minute average time to detect and respond, a comprehensive MDR dedicated dashboard and regular reporting for complete peace of mind.

For enterprises, ESET PROTECT MDR Ultimate offers continuous proactive protection and enhanced visibility, coupled with customized threat hunting and remote digital forensic incident response assistance. This comprehensive service is designed to support overstretched SOC teams, providing them with 24/7 access to world-class cybersecurity expertise. It ensures enterprises stay one step ahead of all known and emerging threats, effectively closing the cybersecurity skills gap, and facilitating expert consultations for incident management and containment in a fully managed experience.

ESET also sets itself apart with its own telemetry and unique global coverage, leveraging its detections and ESET Research to gather unique data about attacks, a competitive edge not offered by many players in the market.

Enhancements to the ESET business portfolio

Additionally, all ESET PROTECT subscription tiers, starting from ESET PROTECT Advanced, are now enhanced with ESET Mobile Threat Defense (EMTD). This new value-added, standalone module extends attack vector coverage to an organization’s entire mobile fleet, seamlessly integrating into the ESET PROTECT Platform for efficient management, ensuring comprehensive protection for mobile devices. EMTD also includes a Mobile Device Management (MDM) functionality, with added support for Microsoft Entra ID.

Moreover, ESET Server Security introduces a firewall specifically designed for Windows servers, and Vulnerability & Patch Management, offering manual patch management and a 60-second delay of application process kill.

For more detailed information about ESET and its updated portfolio, please visit the dedicated offering pages forSMBs and Enterprises. 

ESET researchers have discovered a cyberespionage campaign that, since at least September 2023, has been victimizing Tibetans via a targeted watering hole (also known as a strategic web compromise), and a supply-chain compromise to deliver trojanized installers of Tibetan language translation software. The attackers aimed to deploy malicious downloaders for both Windows and macOS to compromise website visitors with MgBot as well as a backdoor that has not been publicly documented yet; ESET has named it Nightdoor. The campaign by the China-aligned Evasive Panda APT group leveraged the Monlam Festival — a religious gathering — to target Tibetans in several countries and territories. Targeted networks were located in India, Taiwan, Hong Kong, Australia, and the United States.

ESET discovered the cyberespionage operation in January 2024. The compromised website abused as a watering hole (the attacker infests a website that the victim likely or regularly uses) belongs to Kagyu International Monlam Trust, an organization based in India that promotes Tibetan Buddhism internationally. The attack might have been intended to capitalize on international interest in the Kagyu Monlam Festival that is held annually in January in the city of Bodhgaya, India. The network of the Georgia Institute of Technology (also known as Georgia Tech) in the United States is among the identified entities in the targeted IP address ranges. In the past, the university was mentioned in connection with the Chinese Communist Party’s influence on education institutes in the U.S.  

Around September 2023, the attackers compromised the website of a software development company based in India that produces Tibetan language translation software. The attackers placed several trojanized applications there that deploy a malicious downloader for Windows or macOS.

In addition to this, the attackers also abused the same website and a Tibetan news website called Tibetpost to host the payloads obtained by the malicious downloads, including two full-featured backdoors for Windows and an unknown number of payloads for macOS.

“The attackers fielded several downloaders, droppers, and backdoors, including MgBot — which is used exclusively by Evasive Panda — and Nightdoor, the latest major addition to the group’s toolkit and that has been used to target several networks in East Asia,” says ESET researcher Anh Ho, who discovered the attack. “The Nightdoor backdoor, used in the supply-chain attack, is a recent addition to Evasive Panda’s toolset. The earliest version of Nightdoor that we’ve been able to find is from 2020, when Evasive Panda deployed it onto the machine of a high-profile target in Vietnam. We have requested that the Google account associated with its authorization token be taken down,” adds Ho.

With high confidence, ESET attributes this campaign to the Evasive Panda APT group, based on the malware that was used: MgBot and Nightdoor. Over the past two years, we have seen both backdoors deployed together in an unrelated attack against a religious organization in Taiwan, in which they also shared the same Command & Control server. 

Evasive Panda (also known as BRONZE HIGHLAND or Daggerfly) is a Chinese-speaking and China-aligned APT group, active since at least 2012. ESET Research has observed the group conducting cyberespionage against individuals in mainland China, Hong Kong, Macao, and Nigeria. Government entities were targeted in Southeast and East Asia, specifically China, Macao, Myanmar, The Philippines, Taiwan, and Vietnam. Other organizations in China and Hong Kong were also targeted. According to public reports, the group has also targeted unknown entities in Hong Kong, India, and Malaysia.

The group uses its own custom malware framework with a modular architecture that allows its backdoor, known as MgBot, to receive modules to spy on its victims and enhance its capabilities. Since 2020 ESET has also observed that Evasive Panda has capabilities to deliver its backdoors via adversary-in-the-middle attacks hijacking updates of legitimate software.

For more technical information about the latest malicious campaign of the Evasive Panda group, check out the blogpost “Evasive Panda leverages Monlam Festival to target Tibetans” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

ESET has been honoured with a prestigious Reseller Choice Award, named the Best Zero Trust Vendor.

ESET, a global leader in cybersecurity solutions, is thrilled to announce its latest accolade at the 17th Annual Reseller Choice Awards in Canada. ESET has been recognized as the Best Zero Trust Vendor, marking this win to be its 16th Reseller Choice Award. The recognition from resellers emphasizes ESET’s excellence in providing trustworthy and effective security solutions based on the principles of Zero Trust, reinforcing its position as a trusted leader in cybersecurity and meeting the evolving security needs of organizations in an era of increasingly sophisticated cyber threats.

Held in Toronto on February 1, 2024, the 17^th Annual Reseller Choice Awards hosted representatives from Canadian Managed Service Programs, Value-Added Resellers, Information Technology Solution Providers, Managed Security Service Providers and Information Technology Consultant vendors and distributors from across the country at an in-person gala to compete for awards in more than 50 categories. Accepting the award was Zoey Dimitrova-Chappell, Director of Marketing at ESET Canada. 

Every year, the Reseller Choice Awards aim to provide recognition for vendors and distributors in the IT sector. Winners are selected following a national survey of qualified vendors; those with the most votes from the channel community win.

For more than 30 years, ESET has been developing industry-leading IT security software and services for businesses and consumers worldwide. From a small, dynamic company, ESET has grown into a global brand with more than 110 million users in 202 countries and 13 international research and development centres — including one in Montreal.

The Reseller Choice Awards are organized by eChannelNEWS.com, the news media division of TechnoPlanet.

 ESET published their H2 threat report over the holidays that reveals latest malware trends as seen by ESET telemetry and from the perspective of ESET threat detection and research experts.

The second half of 2023 saw notable cybersecurity incidents, including the Cl0p group’s “MOVEit hack,” a kill switch affecting the Mozi IoT botnet, emergence of the Android/Pandora threat, AI-enabled attacks on tools like ChatGPT, increased Android spyware cases with SpinOk, persistent threats like JS/Agent and Magecart due to unpatched websites, and a rise in cryptostealers, particularly the Lumma Stealer targeting cryptocurrency wallets, highlighting the dynamic nature of the cybersecurity landscape.

Read the full report here.

Everyone’s talking about ChatGPT, Bard and generative AI as such. But after the hype inevitably comes the reality check. While business and IT leaders alike are abuzz with the disruptive potential of the technology in areas like customer service and software development, they’re also increasingly aware of some potential downsides and risks to watch out for.

In short, for organizations to tap the potential of large language models (LLMs), they must also be able to manage the hidden risks that could otherwise erode the technology’s business value.

How do LLMs work?

ChatGPT and other generative AI tools are powered by LLMs. They work by using artificial neural networks to process enormous quantities of text data. After learning the patterns between words and how they are used in context, the model is able to interact in natural language with users. In fact, one of the main reasons for ChatGPT’s standout success is its ability to tell jokes, compose poems and generally communicate in a way that is difficult to tell apart from a real human.

RELATED READING: Writing like a boss with ChatGPT: How to get better at spotting phishing scams

The LLM-powered generative AI models, as used in chatbots like ChatGPT, work like super-charged search engines, using the data they were trained on to answer questions and complete tasks with human-like language. Whether they’re publicly available models or proprietary ones used internally within an organization, LLM-based generative AI can expose companies to certain security and privacy risks.

5 of the key LLM risks

1. Oversharing sensitive data 

LLM-based chatbots aren’t good at keeping secrets – or forgetting them, for that matter. That means any data you type in may be absorbed by the model and made available to others or at least used to train future LLM models. Samsung workers found this out to their cost when they shared confidential information with ChatGPT while using it for work-related tasks. The code and meeting recordings they entered into the tool could theoretically be in the public domain (or at least stored for future use, as pointed out by the United Kingdom’s National Cyber Security Centre recently). Earlier this year, we took a closer look at how organizations can avoid putting their data at risk when using LLMs.

2. Copyright challenges  

LLMs are trained on large quantities of data. But that information is often scraped from the web, without the explicit permission of the content owner. That can create potential copyright issues if you go on to use it. However, it can be difficult to find the original source of specific training data, making it challenging to mitigate these issues.

3. Insecure code

Developers are increasingly turning to ChatGPT and similar tools to help them accelerate time to market. In theory it can help by generating code snippets and even entire software programs quickly and efficiently. However, security experts warn that it can also generate vulnerabilities. This is a particular concern if the developer doesn’t have enough domain knowledge to know what bugs to look for. If buggy code subsequently slips through into production, it could have a serious reputational impact and require time and money to fix. 

4. Hacking the LLM itself

Unauthorized access to and tampering with LLMs could provide hackers with a range of options to perform malicious activities, such as getting the model to divulge sensitive information via prompt injection attacks or perform other actions that are supposed to be blocked. Other attacks may involve exploitation of server-side request forgery (SSRF) vulnerabilities in LLM servers, enabling attackers to extract internal resources. Threat actors could even find a way of interacting with confidential systems and resources simply by sending malicious commands through natural language prompts.

RELATED READING: Black Hat 2023: AI gets big defender prize money

As an example, ChatGPT had to be taken offline in March following the discovery of a vulnerability that exposed the titles from the conversation histories of some users to other users. In order to raise awareness of vulnerabilities in LLM applications, the OWASP Foundation recently released a list of 10 critical security loopholes commonly observed in these applications.

5. A data breach at the AI provider

There’s always a chance that a company that develops AI models could itself be breached, allowing hackers to, for example, steal training data that could include sensitive proprietary information. The same is true for data leaks – such as when Google was inadvertently leaking private Bard chats into its search results.

What to do next

If your organization is keen to start tapping the potential of generative AI for competitive advantage, there are a few things it should be doing first to mitigate some of these risks:

• Data encryption and anonymization: Encrypt data before sharing it with LLMs to keep it safe from prying eyes, and/or consider anonymization techniques to protect the privacy of individuals who could be identified in the datasets. Data sanitization can achieve the same end by removing sensitive details from training data before it is fed into the model.
• Enhanced access controls: Strong passwords, multi-factor authentication (MFA) and least privilege policies will help to ensure only authorized individuals have access to the generative AI model and back-end systems.
• Regular security audits: This can help to uncover vulnerabilities in your IT systems which may impact the LLM and generative AI models on which its built.
• Practice incident response plans: A well rehearsed and solid IR plan will help your organization respond rapidly to contain, remediate and recover from any breach.
• Vet LLM providers thoroughly: As for any supplier, it’s important to ensure the company providing the LLM follows industry best practices around data security and privacy. Ensure there’s clear disclosure over where user data is processed and stored, and if it’s used to train the model. How long is it kept? Is it shared with third parties? Can you opt in/out of your data being used for training?
• Ensure developers follow strict security guidelines: If your developers are using LLMs to generate code, make sure they adhere to policy, such as security testing and peer review, to mitigate the risk of bugs creeping into production.

The good news is there’s no need to reinvent the wheel. Most of the above are tried-and-tested best practice security tips. They may need updating/tweaking for the AI world, but the underlying logic should be familiar to most security teams.

About ESET

For more than 30 years, ESET® has been developing industry-leading IT security software and services to protect businesses, critical infrastructure, and consumers worldwide from increasingly sophisticated digital threats. From endpoint and mobile security to endpoint detection and response, as well as encryption and multifactor authentication, ESET’s high-performing, easy-to-use solutions unobtrusively protect and monitor 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company that enables the safe use of technology. This is backed by ESET’s R&D centers worldwide, working in support of our shared future. For more information, visit www.eset.com or follow us on LinkedIn, Facebook, and Twitter (X).

ESET Research announced today the release of the report “Looking into TUT’s tomb: The universe of threats in LATAM,” which analyzes more than a dozen operations and various cybercriminal campaigns in Latin America. With evolving targeting strategies and techniques, these campaigns exhibit a high level of sophistication, specifically tailoring their approaches to exploit enterprise users, including government sectors. The predominant method of compromising victims is through phishing emails that deliver multiple malicious components.

In the paper, ESET Research looks back at various publicly documented campaigns targeting the LATAM region between 2019 and 2023; the vast majority of the detections surrounding these cybercriminal activities are in Latin America and are not associated with global crimeware. Since each of these operations has its own unique traits, and they don’t appear to be linked to a single threat actor, it’s highly likely that multiple actors are at play.

ESET analysis revealed a notable shift from simplistic, opportunistic crimeware to more complex threats. Notably, researchers have observed a transition in targeting, moving from a focus on the general public to high-profile users, including businesses and governmental entities. These threat actors continually update their tools, introducing different evasion techniques to increase the success of their campaigns. Furthermore, while the LATAM region contains the vast majority of victims, in some cases we have seen an expansion of these campaigns targeting countries outside the region, with the actors taking their crimeware business beyond Latin America and mirroring the pattern seen in banking trojans born in Brazil.

The precision and specificity observed in these attacks point to a high level of targeting, indicating that the threat actors have detailed knowledge about their intended victims. In these campaigns, attackers utilize malicious components like downloaders and droppers, mostly created in PowerShell and VBS. Regarding the tools used in these malicious operations in Latin America, ESET observations indicate a preference for remote access trojans.

For more technical information about “Operation King TUT: The universe of threats in LATAM,” read the blog post on WeLiveSecurity. 

ESET Research has released its analysis of Spacecolon, a small toolset used to deploy variants of Scarab ransomware to victims all over the world. It likely penetrates victim organizations through operators compromising vulnerable web servers or via brute forcing RDP credentials. Several Spacecolon builds contain many Turkish strings; therefore, ESET believes it is written by a Turkish-speaking developer. ESET was able to track the origins of Spacecolon back to at least May 2020, and its campaigns are ongoing. ESET named Spacecolon’s operators CosmicBeetle to represent the link to “space” and “scarab.” 

Spacecolon incidents identified by ESET telemetry encompass the globe, with high prevalence in European Union countries, such as Spain, France, Belgium, Poland and Hungary; elsewhere, ESET has detected high prevalence in Turkey and Mexico. CosmicBeetle appears to be preparing the distribution of new ransomware — ScRansom. Post-compromise, along with installing ransomware, Spacecolon offers a large variety of third-party tools that allow the attackers to disable security products, extract sensitive information and gain further access.

“We have not observed any pattern to Spacecolon’s victims besides them being vulnerable to the initial access methods employed by CosmicBeetle. Neither have we found any pattern among the targets’ areas of focus or size. However, to name a few (by type and geography), we have observed Spacecolon at a hospital and tourist resort in Thailand, an insurance company in Israel, a local governmental institution in Poland, an entertainment provider in Brazil, an environmental company in Turkey and a school in Mexico,” says ESET researcher Jakub Souček, author of the analysis.

CosmicBeetle probably compromises web servers vulnerable to the ZeroLogon vulnerability or those with RDP credentials that it is able to brute force. Additionally, Spacecolon can provide backdoor access for its operators. CosmicBeetle doesn’t make any considerable effort to hide its malware and leaves plenty of artifacts on compromised systems. 

After CosmicBeetle compromises a vulnerable web server, it deploys ScHackTool. ScHackTool is the main Spacecolon component that CosmicBeetle uses. It relies heavily on its GUI and active participation of its operators; it allows them to orchestrate the attack, downloading and executing additional tools to the compromised machine on demand as they see fit. If the target is deemed valuable, CosmicBeetle can deploy ScInstaller and use it to install ScService, which provides further remote access.

The final payload CosmicBeetle deploys is a variant of Scarab ransomware. This variant internally deploys a ClipBanker, a type of malware that monitors the content of the clipboard and changes content that it deems likely to be a cryptocurrency wallet address to an attacker-controlled address.

Furthermore, a new ransomware family is being developed, with samples being uploaded to VirusTotal from Turkey. ESET Research believes with high confidence that it is written by the same developers as Spacecolon, and ESET has named it ScRansom. ScRansom attempts to encrypt all hard, removable and remote drives. ESET has not observed this ransomware being deployed in the wild, and it appears to still be in a development stage.

For more technical information about Spacecolon and CosmicBeetle, check out the blogpost “Scarabs colon-izing vulnerable servers” on WeLiveSecurity.

ESET, the industry-leading cybersecurity software company, has released their latest Threat Report, which summarizes threat landscape trends seen in ESET telemetry from December 2022 through May 2023.

Here are a few highlights:

• The H1 2023 ESET Threat Report highlights the remarkable adaptability of cybercriminals: through exploiting vulnerabilities, gaining unauthorized access, compromising sensitive information, or defrauding individuals.
• Attackers developed new methods to attempt to bypass Microsoft security measures, including using weaponized OneNote files instead of Office macros. ESET researchers observed the comeback of so-called sextortion scam emails and an alarming growth of deceptive Android loan apps.
• ESET telemetry data also suggests that operators of the Emotet botnet have struggled to adapt, possibly indicating that a different group acquired the botnet.
• Leaked source code of ransomware families such as Babyk, LockBit, and Conti has been increasingly used in the development of new ransomware variants in H1 2023.
• The H1 2023 Threat Report covers December 2022 through May 2023, transitioning from a triannual to a semiannual release schedule.

The full report can be found here: https://www.welivesecurity.com/2023/07/11/eset-threat-report-h1-2023/