# ESET research Published articles for ESET research. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Forgotten UEFI shims undermining Secure Boot DevFeed: [Forgotten UEFI shims undermining Secure Boot]() Original publisher: [Read original article]() Author: Martin Smolár Published: 2026-07-14T08:53:00Z Content type: news Language: en Sources: [WeLiveSecurity]() Topics: [Vulnerabilities]() Tags: [applications](), [boot](), [eset-research](), [linux](), [microsoft](), [os](), [patch-tuesday](), [software](), [systems](), [update](), [vulnerabilities]() ### AI overview ESET reported 11 outdated UEFI shim bootloaders that can bypass Secure Boot on systems trusting Microsoft's third-party UEFI certificate. Microsoft revoked the reported shim hashes in its June 2026 Patch Tuesday dbx update. ### Source excerpt ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities ## ESET Threat Report H1 2026 DevFeed: [ESET Threat Report H1 2026]() Original publisher: [Read original article]() Author: Jiří Kropáč Published: 2026-07-08T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Threat Research](), [Artificial Intelligence](), [Generative AI](), [Malware](), [Android](), [ClickFix](), [QR Code](), [ransomware](), [Social engineering](), [Endpoint Security & XDR](), [Security]() Tags: [ai](), [android](), [clickfix](), [code](), [eset-research](), [generative-ai](), [malware](), [ransomware](), [research](), [security](), [social-engineering](), [threat-report]() ### AI overview ESET's H1 2026 threat report describes attackers adapting established techniques across new platforms and behaviors. It highlights the expanding abuse of AI skills, PromptSpy Android malware using Google Gemini, the spread of ClickFix and QR-code phishing, and continued ransomware activity involving EDR killers. ### Source excerpt A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts. ## Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances DevFeed: [Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances]() Original publisher: [Read original article]() Author: Zoltán Rusnák Published: 2026-06-25T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Security Attacks]() Tags: [apt](), [cloud](), [dns](), [eset-research](), [infrastructure](), [messaging](), [powershell](), [social-media](), [storage]() ### AI overview ESET Research analyzes Gamaredon's 2025 cyberespionage activity against Ukrainian governmental and military institutions, including spearphishing, new malicious PowerShell tools, cloud-based data exfiltration, and concealed C&C infrastructure. ### Source excerpt ESET Research analyzes Gamaredon's new toolset and the group's growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate stolen data ## ESET takes part in Operation Endgame to disrupt Amadey and Stealc DevFeed: [ESET takes part in Operation Endgame to disrupt Amadey and Stealc]() Original publisher: [Read original article]() Author: Jakub Tomanek Tomáš Procházka Published: 2026-06-24T12:35:24Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Malware](), [Threat Research](), [Cybercrime](), [C2](), [High Profile Threats](), [Encryption](), [data](), [Statistics]() Tags: [analysis](), [data](), [encryption](), [eset-research](), [maas](), [malware](), [network](), [research]() ### AI overview ESET Research describes its contribution to Operation Endgame, a coordinated global effort that disrupted the Amadey botnet and Stealc infostealer. The article covers infrastructure tracking, technical and statistical analysis, malware configuration data, command-and-control servers, encryption keys, campaign identifiers, and affiliate-level activity within the malware-as-a-service ecosystem. ### Source excerpt ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights ## Killing me gently: Inside Gentlemen's EDR killer framework DevFeed: [Killing me gently: Inside Gentlemen's EDR killer framework]() Original publisher: [Read original article]() Author: Jakub Souček Published: 2026-06-18T09:46:32Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Endpoint Security & XDR](), [ransomware](), [Security](), [Cybercrime](), [Software]() Tags: [analysis](), [eset-research](), [europe](), [insights](), [ransomware](), [research](), [security](), [software](), [southeast-asia](), [techniques]() ### AI overview ESET Research analyzes Gentlemen's ransomware-as-a-service operation and its portfolio of EDR-killing tools. The article examines the in-house GentleKiller framework, third-party tools, shared defense-evasion techniques, and the group's rapid adoption of BYOVD exploits, using incident-level visibility and leaked internal data. ### Source excerpt ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen ## FishMonger's arsenal upgraded: SprySOCKS for Windows DevFeed: [FishMonger's arsenal upgraded: SprySOCKS for Windows]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-16T08:54:04Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Processes](), [telemetry]() Tags: [analysis](), [apt](), [backdoor](), [china](), [communication](), [drivers](), [eset-research](), [government](), [kernel](), [linux](), [malware](), [process](), [processes](), [telemetry](), [virustotal](), [windows]() ### AI overview ESET reports two previously undocumented Windows variants of the SprySOCKS backdoor attributed to FishMonger. The variants use TCP, UDP, and WebSocket communications; WIN_DRV uses a kernel driver to conceal artifacts and redirect specially crafted TCP traffic. ### Source excerpt ESET researchers have discovered SprySOCKS for Windows, FishMonger's backdoor weaponizing a kernel driver for advanced stealthiness ## OceanLotus: From external espionage to domestic targeting DevFeed: [OceanLotus: From external espionage to domestic targeting]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-11T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [networking]() Tags: [apt](), [attacks](), [backdoor](), [dns](), [eset-research](), [linux](), [supply-chain](), [telemetry]() ### AI overview The article analyzes OceanLotus's shift toward domestic espionage and two SPECTRALVIPER campaigns in Vietnam: a targeted supply-chain compromise of investor software and a prolonged intrusion against a construction corporation. ### Source excerpt A shift in operational pattern of the infamous Vietnam-aligned APT group ## ESET APT Activity Report Q4 2025-Q1 2026 DevFeed: [ESET APT Activity Report Q4 2025-Q1 2026]() Original publisher: [Read original article]() Author: Jean-Ian Boutin Published: 2026-05-28T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [High Profile Threats]() Tags: [apt](), [china](), [cybersecurity](), [eset-research](), [iran](), [virustotal]() ### AI overview ESET's report summarizes selected APT activity from October 2025 through March 2026, including China-aligned espionage, activity targeting government and strategic-technology entities, and changes in Iran-aligned activity during the war in Iran. ### Source excerpt An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2025 and Q1 2026 ## Webworm: New burrowing techniques DevFeed: [Webworm: New burrowing techniques]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-05-20T08:40:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [backdoor](), [Reconnaissance](), [Discord](), [GitHub](), [API](), [Microsoft](), [Bash](), [Virtual Private Network](), [Amazon S3]() Tags: [api](), [apt](), [backdoor](), [bash](), [china](), [discord](), [eset-research](), [europe](), [github](), [ip](), [malware](), [microsoft](), [s3](), [server](), [techniques](), [tools]() ### AI overview ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging. ### Source excerpt ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal ## FrostyNeighbor: Fresh mischief and digital shenanigans DevFeed: [FrostyNeighbor: Fresh mischief and digital shenanigans]() Original publisher: [Read original article]() Author: Damien Schaeffer Published: 2026-05-14T08:50:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [payload](), [C++](), [JavaScript](), [.NET](), [PowerShell](), [Deployment](), [CSS](), [SVG]() Tags: [c-plus-plus](), [css](), [deployment](), [eset-research](), [javascript](), [malware](), [net](), [payload](), [powershell](), [svg](), [techniques]() ### AI overview ESET researchers document new FrostyNeighbor cyberespionage activity targeting governmental, military, and key-sector organizations in Eastern Europe, especially Ukraine. The group continually evolves its compromise chains and tooling, using server-side victim validation and PicassoLoader variants written in .NET, PowerShell, JavaScript, and C++. ### Source excerpt ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group's continual cyberespionage operations ## Fake call logs, real payments: How CallPhantom tricks Android users DevFeed: [Fake call logs, real payments: How CallPhantom tricks Android users]() Original publisher: [Read original article]() Author: Lukas Stefanko Published: 2026-05-07T08:51:19Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Android](), [Google](), [App](), [Reddit]() Tags: [android](), [apps](), [data](), [eset-research](), [google](), [payments](), [scam](), [subscriptions](), [whatsapp]() ### AI overview ESET researchers investigated 28 fraudulent Android apps called CallPhantom that claimed to reveal call histories, SMS records, and WhatsApp call logs for any phone number. After users paid for subscriptions, the apps returned randomly generated data. The apps had more than 7.3 million cumulative downloads and were reported to Google, which removed them from Google Play. ### Source excerpt ESET researchers uncovered fraudulent apps on Google Play that claim to provide the call history "for any number" and had been downloaded more than seven million times before being taken down ## A rigged game: ScarCruft compromises gaming platform in a supply-chain attack DevFeed: [A rigged game: ScarCruft compromises gaming platform in a supply-chain attack]() Original publisher: [Read original article]() Author: Filip Jurčacko Published: 2026-05-05T08:55:27Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Threat Research](), [backdoor](), [LineageOS](), [Windows](), [High Profile Threats](), [C++](), [Shell](), [Python](), [Ruby]() Tags: [analysis](), [android](), [china](), [cloud](), [data](), [eset-research](), [gaming](), [government](), [logging](), [platform](), [supply-chain](), [voice](), [windows]() ### AI overview ESET researchers describe a ScarCruft supply-chain attack that trojanized Windows and Android components of a Yanbian-themed gaming platform. The BirdCall backdoor supports espionage capabilities including collecting data and documents, screenshots, and voice recordings. ### Source excerpt ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games ## GopherWhisper: A burrow full of malware DevFeed: [GopherWhisper: A burrow full of malware]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-04-23T08:59:18Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Go Language](), [C++]() Tags: [api](), [apt](), [backdoor](), [c-plus-plus](), [china](), [discord](), [eset-research](), [go](), [malware](), [microsoft-365](), [slack]() ### AI overview ESET Research describes GopherWhisper, a China-aligned APT group targeting a Mongolian government entity. Its largely Go-based malware toolset uses backdoors, injectors, loaders, and legitimate services including Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control and exfiltration. ### Source excerpt ESET Research has discovered a new China-aligned APT group that we've named GopherWhisper, which targets Mongolian governmental institutions ## New NGate variant hides in a trojanized NFC payment app DevFeed: [New NGate variant hides in a trojanized NFC payment app]() Original publisher: [Read original article]() Author: Lukas Stefanko Published: 2026-04-21T08:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [Android](), [ESET research](), [genai](), [Social engineering](), [App](), [servers]() Tags: [android](), [attacks](), [brazil](), [eset-research](), [genai](), [malware](), [payment](), [social-engineering](), [threat-report]() ### AI overview ESET Research reports a new NGate malware variant hidden in a trojanized Android NFC payment app called HandyPay. The malware relays payment-card NFC data, steals card PINs, and exfiltrates them to an operator-controlled server. The active campaign, targeting users in Brazil since around November 2025, distributes the app through fake lottery and Google Play websites; the code may have been assisted by GenAI. ### Source excerpt ESET researchers discover another iteration of NGate malware, this time possibly developed with the assistance of AI ## EDR killers explained: Beyond the drivers DevFeed: [EDR killers explained: Beyond the drivers]() Original publisher: [Read original article]() Author: Jakub Souček Published: 2026-03-19T09:55:08Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Endpoint Security & XDR](), [ransomware](), [Cybercrime](), [Encryption](), [telemetry](), [1Password in the browser]() Tags: [development](), [encryption](), [eset-research](), [ransomware](), [research](), [techniques](), [telemetry]() ### AI overview ESET researchers analyze nearly 90 EDR killers used in real ransomware intrusions, examining vulnerable-driver, anti-rootkit, script-based, and driverless approaches to disabling endpoint protection. The article explains how affiliates select and adapt these tools, why driver-based attribution can mislead, and how commercialized kits increase defense complexity. ### Source excerpt ESET researchers dive deeper into the EDR killer ecosystem, disclosing how attackers abuse vulnerable drivers ## Sednit reloaded: Back in the trenches DevFeed: [Sednit reloaded: Back in the trenches]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-03-10T09:58:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [apt](), [Cloud](), [obfuscation](), [PowerShell](), [Code](), [Network](), [Open Source]() Tags: [apt](), [attacks](), [backdoor](), [cloud](), [code](), [department-of-justice](), [eset-research](), [network](), [obfuscation](), [open-source](), [powershell](), [us]() ### AI overview This article examines the resurgence of Sednit, also known as APT28, and its modern espionage toolkit. It describes the BeardShell and Covenant implants, their use of legitimate cloud providers for command and control and resilience, PowerShell execution, obfuscation, and links to Sednit's earlier tools and operations. ### Source excerpt The resurgence of one of Russia's most notorious APT groups ## PromptSpy ushers in the era of Android threats using GenAI DevFeed: [PromptSpy ushers in the era of Android threats using GenAI]() Original publisher: [Read original article]() Author: Lukas Stefanko Published: 2026-02-19T10:30:20Z Content type: news Language: en Sources: [WeLiveSecurity]() Topics: [Android](), [Generative AI](), [Malware](), [genai](), [Cybercrime](), [Persistence](), [Encryption](), [Google]() Tags: [ai](), [android](), [encryption](), [eset-research](), [genai](), [generative-ai](), [google](), [malware](), [persistence](), [server](), [video]() ### AI overview ESET researchers report PromptSpy, an Android malware family that uses Google Gemini and generative AI to analyze the device screen and adapt malicious user-interface manipulation. The malware uses this capability to maintain persistence, while also providing remote access, blocking uninstallation, capturing lockscreen data, and recording video. ### Source excerpt ESET researchers discover PromptSpy, the first known Android malware to abuse generative AI in its execution flow ## DynoWiper update: Technical analysis and attribution DevFeed: [DynoWiper update: Technical analysis and attribution]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-01-30T10:28:38Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [Security](), [incident](), [data]() Tags: [analysis](), [blog](), [energy](), [eset-research](), [incident](), [malware](), [post](), [security]() ### AI overview ESET provides a technical analysis of DynoWiper, a data-wiping malware used against an energy company in Poland. The article compares the incident with the earlier ZOV wiper attack in Ukraine and attributes DynoWiper to the Sandworm threat group with medium confidence. ### Source excerpt ESET researchers present technical details on a recent data destruction incident affecting a company in Poland's energy sector ## Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan DevFeed: [Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan]() Original publisher: [Read original article]() Author: Lukas Stefanko Published: 2026-01-28T09:59:00Z Content type: news Language: en Sources: [WeLiveSecurity]() Topics: [App](), [data]() Tags: [android](), [app](), [attacks](), [clickfix](), [data](), [eset-research](), [monitor](), [pakistan](), [scam](), [social-engineering](), [whatsapp]() ### AI overview ESET describes GhostChat, an Android spyware app that poses as a dating chat platform to target people in Pakistan. Its hardcoded profile passcodes create a false sense of exclusivity while the app surveils devices and exfiltrates data; the investigation also links the activity to ClickFix and WhatsApp account-compromise attacks. ### Source excerpt ESET researchers discover an Android spyware campaign targeting users in Pakistan via romance scam tactics, revealing links to a broader spy operation ## ESET Research: Sandworm behind cyberattack on Poland's power grid in late 2025 DevFeed: [ESET Research: Sandworm behind cyberattack on Poland's power grid in late 2025]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-01-23T16:58:26Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Critical Infrastructure](), [apt](), [Malware](), [data]() Tags: [analysis](), [apt](), [critical-infrastructure](), [energy](), [eset-research](), [history](), [infrastructure](), [malware](), [research](), [security]() ### AI overview ESET Research attributes a late-2025 cyberattack on Poland's power grid to the Russia-aligned Sandworm APT group with medium confidence. The attack used data-wiping malware named DynoWiper, although no successful disruption has been identified. The article places the incident in the context of Sandworm's history of attacks on critical infrastructure, including the 2015 Ukrainian power-grid blackout. ### Source excerpt The attack involved data-wiping malware that ESET researchers have now analyzed and named DynoWiper ## Revisiting CVE-2025-50165: A critical flaw in Windows Imaging Component DevFeed: [Revisiting CVE-2025-50165: A critical flaw in Windows Imaging Component]() Original publisher: [Read original article]() Author: Romain Dumont Published: 2025-12-22T09:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Vulnerabilities](), [Windows](), [Exploit](), [Code](), [Library]() Tags: [analysis](), [cve](), [deep-dive](), [encoding](), [eset-research](), [jpeg](), [library](), [remote-code-execution](), [root-cause-analysis](), [vulnerability](), [windows]() ### AI overview ESET analyzes CVE-2025-50165, a critical Windows Imaging Component vulnerability in WindowsCodecs.dll. The flaw involves an uninitialized function-pointer dereference during JPG compression and re-encoding, and the article reassesses how difficult the vulnerability is to exploit. ### Source excerpt A comprehensive analysis and assessment of a critical severity vulnerability with low likelihood of mass exploitation ## LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan DevFeed: [LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan]() Original publisher: [Read original article]() Author: Anton Cherepanov Peter Strýček Published: 2025-12-18T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [.NET](), [enterprise deployment]() Tags: [apt](), [backdoor](), [browser](), [c-sharp](), [china](), [cloud](), [cloud-services](), [eset-research](), [google](), [japan](), [malware](), [microsoft](), [net](), [policy](), [techniques](), [windows]() ### AI overview ESET describes LongNosedGoblin, a China-aligned APT group conducting cyberespionage against governmental entities in Southeast Asia and Japan. The group deploys malware through Group Policy and uses tools including the NosyDoor backdoor and the C#/.NET NosyHistorian application. ### Source excerpt ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions ## ESET Threat Report H2 2025 DevFeed: [ESET Threat Report H2 2025]() Original publisher: [Read original article]() Author: Jiří Kropáč Published: 2025-12-16T09:50:45Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Threat Research](), [ESET research](), [Malware](), [ransomware](), [Android](), [Artificial Intelligence](), [ClickFix]() Tags: [2025](), [ai](), [android](), [clickfix](), [eset-research](), [malware](), [nfc](), [ransomware](), [research](), [threat-detection](), [threat-report]() ### AI overview ESET's H2 2025 threat report describes rapid changes in the threat landscape, including the emergence of AI-driven malware such as PromptLock, major shifts in malware distribution, growth in ransomware activity, and increasingly sophisticated Android NFC threats. ### Source excerpt A view of the H2 2025 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts ## MuddyWater: Snakes by the riverbank DevFeed: [MuddyWater: Snakes by the riverbank]() Original publisher: [Read original article]() Author: ESET Research Published: 2025-12-02T10:00:15Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [C++]() Tags: [analysis](), [api](), [apt](), [backdoor](), [c](), [c-c-plus-plus](), [c-plus-plus](), [critical-infrastructure](), [cryptographic](), [eset-research](), [iran](), [malware](), [memory](), [persistence](), [socks5](), [techniques](), [tools](), [windows]() ### AI overview ESET analyzes a MuddyWater campaign targeting organizations in Israel and Egypt that uses custom loaders, credential stealers, reverse tunnels, and the MuddyViper backdoor to evade defenses and maintain access. ### Source excerpt MuddyWater targets critical infrastructure in Israel and Egypt, relying on custom malware, improved tactics, and a predictable playbook