Research reports
1,224 reports from 387 publishers45 added in the past week
Added Sun 25 Oct
FishMonger’s arsenal upgraded: SprySOCKS for Windows
ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the…
Malware
Added Sat 17 Oct
ceranakeeper.pdf
No excerpt available.
Added Wed 23 Sep
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances
Cyberespionage has remained a constant feature of Russia’s war against Ukraine. ESET Research has long tracked Gamaredon, one of the most active Russia-aligned advanced persistent threat (APT) groups targeting Ukraine. The group, attributed by the Security…
State-sponsored
Killing me gently: Inside Gentlemen’s EDR killer framework
ESET researchers analyzed the robust EDR-killing toolset of the ransomware-as-a-service gang Gentlemen. Since the beginning of 2026, Gentlemen has emerged as one of the most active gangs in the ransomware ecosystem. The group distinguishes itself through a…
Ransomware
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET Research’s ongoing monitoring of FamousSparrow has borne fruit once again. Our previous public report on FamousSparrow revealed that this China-aligned APT group had developed two new versions of its custom backdoor named SparrowDoor. This time, we…
Malware
Added Sat 20 Jun
eset-apt-activity-report-q4-2025-q1-2026.pdf
MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS October 2025 – March 2026 Report ESET APT ACTIVITY REPORT OCTOBER 2025 - MARCH 2026 | 2 Contents Executive summary3 Attackers and targets5 China7 SteppeDriver: From Mongolia to Syria8 PhiliKit, a new implant in…
State-sponsored
eset-apt-activity-report-q2-2025-q3-2025.pdf
APT down – the North Korea files 17 Russia 18 RomCom uses WinRAR zero day 19 Gamaredon
State-sponsored
Added Wed 10 Jun
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
MalwareSupply chainMobile
Added Wed 20 May
FrostyNeighbor: Fresh mischief and digital shenanigans
This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise…
Added Fri 1 May
Added Wed 29 Apr
MuddyWater: Snakes by the riverbank
ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its…
State-sponsoredMalware
Added Wed 21 May 2025
ESET APT Activity Report Q4 2024-Q1 2025
WIPERS, PHISHING, AND UNPATCHED VULNERABILITIES October 2024 – March 2025 Report ESET APT ACTIVITY REPORT OCTOBER 2024 - MARCH 2025 | 2 Contents Executive summary� 3 Attackers and targets� 5 China-aligned groups � 6 China-aligned threat landscape in Europe� 7…
State-sponsoredPhishing
Added Wed 13 Nov 2024
ESET APT Activity Report Q2 2024-Q3 2024
PLATFORMS IN THE PURSUIT OF NEW PREY April 2024 – September 2024 Report ESET APT ACTIVITY REPORT APRIL 2024 - SEPTEMBER 2024 | 2 Contents Executive summary� 3 Attackers and targets� 5 China-aligned groups � 6 SoftEther VPN: A tool of choice for China-aligned…
State-sponsored
Added Fri 25 Oct 2024
ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities
IRAN-ALIGNED CYBERATTACKS: RISE IN DISRUPTIVE OPERATIONS October 2023 – March 2024 Report ESET APT ACTIVITY REPORT OCTOBER 2023 - MARCH 2024 | 2 Contents Executive summary� 3 Attackers and targets� 4 China-aligned groups � 5 Mustang Panda targets the cargo…
State-sponsoredVulnerabilities
Added Sat 20 Jul 2024
Hesperbot_Whitepaper.pdf
A new and effective banking trojan has been discovered targeting online banking users in Turkey, the Czech Republic, Portugal and the United Kingdom. It uses very credible-looking phishing-like campaigns, related to trustworthy organizations, to lure victims…
Malware
Added Sat 18 May 2024
ebury-is-alive-but-unseen.pdf
(eset):research WHITEPAPER Marc-Etienne M.Léveillé May 2024 Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain ESET | EBURY IS ALIVE BUT UNSEEN WHITEPAPER | 2 Contents Propagation� 7 Credential stuffing� 8…
Vulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.