ESET INDUSTRYREPORT ON
GOVERNMENT:
Targeted but not alone

TABLE OF CONTENTS
1

APT groups, cybercriminals and the need for resilient IT security for government2

APT attacks in Europe: A growing menace to government3

IT security and government: Parallels between targeted institutions

4

EmissarySoldier: Malicious activities of LuckyMouse APT group in 2020

5Regulatory radar: Critical cues for cybersecurity posture in the EU and US

6

Endpoint detection and response: A counterbalance to persistent threats

7

Endpoint detection and response at ESET

3 -6

7 -9

10 - 13

14 - 16

17 - 20

21

22

www.eset.com

2

1

APT GROUPS, CYBERCRIMINALSAND THE NEED FOR RESILIENT
IT SECURITY FOR GOVERNMENTINTRODUCTION
Despite the pitfalls in making predictions during a pandemic, we can be confident
cyber-risks for government bodies will continue to grow, evolve, and require
even greater focus and resources to mitigate. Government, like industry, isfacing the fact that its productivity tools are being turned against its interestsand its ability to protect and provide essential services, ensure economic stability,and even maintain cultural and societal cohesion.
The path to “digital by default”
Of course, these heightened risks come at a time
when government bodies and businesses are still
navigating a course through the coronavirus
pandemic, adding to what is already a complex
operating environment for those responsible for IT
infrastructure and security. While there aredifferences between the functions of different
government bodies, the overall trend is that theattack surface is expanding. This is reinforced by thefact that government bodies are edging toward
digital services that are so straightforward andconvenient that all those who can use them will

Andy GarthGovernment Affairs Leadchoose to do so.
These elements include further rollout of citizenfacing systems, moving to the cloud, increasing useof third-party suppliers and service providers, andrapid onboarding of many users due to home orwww.eset.com

3

APT groups, cybercriminals and the need for resilient IT security for government

hybrid work becoming part of the new operating model.

an increase in the targeting of widely used applications.

Being implemented at pace, these elements add to theIn early 2020, for example, the XDSpy APT group operators

challenge of maintaining system resilience in the face ofcrafted an email purportedly from the Belarussiansustained and evolving threats from advanced persistentauthorities that claimed to confirm the first cases of

threat (APT) groups and cybercriminals. Throw in keeping

coronavirus in Belarus. However, not only was this a work

an eye on the regulatory scene and operating withinof disinformation making its rounds on social media

tight budgets, and there is certainly plenty to keep a CISO

networks, but it also contained a link to a piece

awake at night.

of malware.

COVID-19

Cyberespionage

Coronavirus lockdowns and the subsequent surge of

The traditional nemeses of government bodies are

employees accessing both company and institutional

believed to be state actors looking to steal sensitive datadata, as well as IT infrastructure, from home did little toand increasingly seeking to embarrass, undermine, anddampen the interests of cybercriminal gangs and nation-

disrupt in order to secure their political and economic

state actors. Indeed, both groups exploited thisobjectives. Such contests between states regularly

tumultuous period to pursue their respective goals, often

happen in the gray zone where they can engage eachwith increased intensity and persistence. For example,

other under the premise of plausible deniability. Now

during the pandemic, RDP attack attempts in particularwithin this traditional cyber-sport, we see in the economic

increased by 768% between Q1 and Q4 2020.

sphere—a constant high-priority target—a significant
uptick in pursuit of purloining intellectual property,

Other threats detected by ESET specifically leveraging

including the targeting of vaccine developers and their

COVID-19 as a topic of interest include the mimicking of

supply chains. These activities brush up against, if notgovernment ser vices; for example, a “Canadianoutright crash into, governments’ ability to protect andGovernment” contact tracing app. Amid COVID-19

provide services to citizens.

lockdowns, steady servings of phishing with “official
Colombian Government” email correspondence and wateringWith the attackers seeking to steal data or influence

hole attacks on Southeast Asian governments courtesy

events in the real world, the gamut of the public sector,of OceanLotus, among others, have seen the interface

from national to local, should now adapt its posture to

between government and its citizens under assault.

factor in targeting by these state actors—not merely astargets of criminal groups or lone hackers. State actor

With pressure already on governments to mitigate healthactivity is increasing, yet there will be some bodies who

impacts from COVID-19, reports abound of cyberattacks

think they would be unlikely targets of these actors.

affecting service delivery to citizens, data theft, or the

Unfortunately, all too often—given interconnectivity—

compromise of strategic national infrastructure. Somestate vs. state contests in one area of the globe haveof the most prominent of late include the SolarWinds

inadvertently affected systems in countries andOrion hack, the Microsoft Exchange exploitation, attacks onorganizations unrelated to those contexts. So, becoming

the Centreon IT infrastructure monitoring tool, deliberatecollateral damage in these growing battles in cyberspacetargeting of healthcare systems in France and Germany,is a genuine risk.

and increased attacks on schools, universities, andeducation IT platforms.

One example of an APT group that at times seems to act
rather boldly, making no efforts to hide, is Gamaredon,

Looking at the data and overall trends, we expect APT

whose modus operandi includes the use of templategroups and cybercriminals to continue to hone theirinjectors targeting ever-popular applications liketactics that capitalize on COVID-19-related concerns andMicrosoft Word and Excel, and mass-mailing macros inwww.eset.com

4

APT groups, cybercriminals and the need for resilient IT security for government

the near ubiquitous Microsoft Outlook to target, for

The emerging connection ultimately saw another botnet

example, individuals at various Ukrainian institutions. By

disruption in January 2021, against one of the longest-homing in on legitimate tools used across government

lived and most pervasive malware threats, Emotet. Led

and businesses, Gamaredon is ver y effective atby Europol, this large-scale disruption operation included

fingerprinting a machine, understanding what sensitive

a number of national law enforcement agencies acrossdata is available, and then spreading throughout theEurope and North America.

network. We have recently documented the group’s moveto custom-developed malware.

With stakes this high, security staff tasked with defending
service provision and internal processes are also

With impressive tools that include fileless malware, such

sandwiched between staying vigilant for state actors

as a custom open-source PowerShell loader to thwart

and constantly facing maturing tactics, techniques, anddetection, or its LightNeuron malware tailored to wreak

procedures from APT groups. Furthermore, thehavoc on the now all-too-preyed-upon Microsoft

emergence of this organized criminal industry with clear

Exchange servers, the Turla APT group is mainly interested

product and service offerings demonstrates innovationin high-profile targets such as government bodies andand drive among attackers. These groups have moved

defense companies. Not to rest on its laurels, Turla createdbeyond assessing potential victims and obtaining thea new version of Crutch, which we documented in Q4

largest payout to maximizing the sale of data on now

2020, that monitors external drives and abuses cloudwell-established criminal marketplace platforms.

storage for command and control communications.
Furthermore, via persistence, these groups can often
spend weeks or months inside targeted systems

Ransomware:Innovation and steady pressure

conducting reconnaissance, harvesting data, andeventually deploying ransomware. While for some it will bea means to top up their funding, for others, the objective
is more about undermining the host government andIn the strata where state-sponsored actors blend withthe services it oversees. Despite many governments openly

APT groups more criminal in nature, we can view thestating they do not pay ransoms, they can still be victimized—

shift toward targeted ransomware attacks as an indicator

including via “spray and pray” techniques – which canof growing concern to government bodies and the

be distracting and resource intensive to deal with and,businesses that they engage with. In addition, theif successful, equally devastating.

phenomenon of several criminal groups working incooperation to gain entry, steal or encrypt data, arrange
payment, and launder the proceeds stands asa clear worry.

Supply-chain attacks scaling rapidly

ESET’s October 2020 collaboration with Microsoft, NTT

Supply-chain disruption, whether by accident or by

Ltd, and multiple law enforcement agencies to disrupt

design, can be traced to antiquity, as can its protection

Trickbot botnets revealed complex activity that included

or improved resilience. However, digitization and theoperators moving from attempting to steal money fromcollaborative benefits derived from third-party providers

bank accounts to compromising whole organizations

have in turn increased the risk of supply-chain attacks.

with Trickbot and then using it to execute Ryuk to demanda ransom to unlock the affected systems. Interestingly,

The DiskCoder.C (aka NotPetya) attack in 2017as Trickbot activity tapered off, rising detections in ESET

demonstrated this well, when the regionally populartelemetry for the Emotet botnet signaled a ramping up of

M.E.Doc accounting software used by a number ofactivities, including even downloading Trickbot.

businesses and their partners along a supply chain was
weaponized to disrupt users’ businesses. However,collateral damage—anticipated or not—impacted major

www.eset.com

5

APT groups, cybercriminals and the need for resilient IT security for government

global businesses, ironically many involved in logistics

And while a lot of attention is paid to hacker attacks, inserving the world’s physical supply chains. Fast-forward

its 2020 Cost of Insider Threats: Global Report, Ponemon

three years, and instead of weaponized accounting

Institute revealed that the number of reported incidents

software, we’ve encountered a very large persistencecaused by insiders increased by 47%, from 3,200 in 2018

campaign in the SolarWinds Orion hack. The attack

to 4,716 in 2020. Many of these breaches are due to humanimpacted thousands of users across that platform anderror, but some are insider attacks by disgruntled employees.

opened up the potential for widespread criminal and APTThis can include data theft, physical damage, and deletiongroup activity across the board.

of accounts—for revenge, personal profit, or to further
the interests of a new employer or even a state actor.

ESET researchers have uncovered several other supply-

Such attacks, particularly by those with administrator

chain attacks over the past several months, from theprivileges, are harder to detect without an endpoint

Lazarus group using hacked security add-ons, to Operation

detection and response tool or other advanced detection

Stealthy Trident attacking region-specific chat software

solutions manned by expert staff.

for businesses, Operation SignSight, used to compromisea government certificate authority, to Operation
NightScout, a hacked Android emulator.

Home, the newnormal workplace

Targeted but not alone
In the current dynamic security environment, it is more
impor tant than ever not to overestimate yourcybersecurity capability. Cyber-risk is increasing, notdecreasing. Regular reviews, testing, and attack scenario

Home and hybrid working have significantly increased

exercises are increasingly essential to help you fend off

the risks for all employers and hence government bodies.

attacks and quickly contain incidents. Due to the skills

It is clear that these arrangements will endure andand tools available to state-backed actors, risks born ofcontinue to be a source of concern as some form of

being targeted or from collateral damage now requireongoing hybrid working becomes part of the operatingcomplex multi-layered defenses, active monitoring, up-model post-COVID-19. From a system security point of

to-date threat intelligence, and an ever more educatedview, the home environment can feel more like the Wild

security team.

West with “homesteads” and “outposts” more exposedto cyberattacks from a seemingly ever-growing crop of

Expanding your understanding of the ever-evolving

increasingly sophisticated cyberbandits looking to rustle

threats will help you not only to better protect your own

up some action.

systems but also to better inform your stakeholders,businesses, and citizens who look to government bodies

It is estimated that 23% of cybersecurity breaches are due

for guidance. In a year of much disruption and sadness,to human error. Attackers often take advantage of natural

one of the positive trends in cybersecurity, as much as

instincts to click (in milliseconds) on links masqueradingin the fight against coronavirus, is the emergence andas legitimate. However, some of the largest breaches

importance of a strong partnership between government

have been through the actions of experienced IT

and the private sector to tackle these challenges. ESET

professionals— who should have known better—including

welcomes this and looks forward to working with its

via connecting BYO devices, misconfiguring cloud

government partners to better secure a safer digital world.

systems, and other poor practices. Of course, increased
staff training and strengthening processes are essential
to embed the required security behaviors as instinctive.

www.eset.com

6

2

APT ATTACKS IN EUROPE:A GROWING MENACE TO
GOVERNMENTDo the past half year’s attention-grabbing attacks conducted by APT groups
signal business as usual, or an emerging trend in supply-chain attacks?
In the past six months, a rash of notable advanced
persistent threat (APT) attacks have been revealed,
targeting countries across the European continent,from France to Eastern Europe and the Balkans, andacross verticals, from government and military
entities to private companies.
An example of APT activity discovered by ESET isa new version of Crutch, a previously undocumented
backdoor and document stealer belonging to theinfamous Turla APT group. ESET researchers saw
Crutch in the network of a ministry of foreign affairs
in a European Union country. Another discovery wasactivity by Gamaredon, an adversary group known

Robert Lipovský
Senior Malware Researcher

for its relentless targeting of governmentalorganizations in Ukraine – which updated its malware
arsenal through 2020.
In the following text, we’ll take a closer look at twoother examples: XDSpy, an APT group that managed
to stay under the radar for nine years, and Sandworm,
which is one of the most dangerous APT groups
in operation.
We’ll also discuss the role supply-chain attacks play inthe arsenals of various threat actors, a subject that has
been grabbing even more attention than usual since
the SolarWinds hack made international headlines.

www.eset.com

7

APT attacks in Europe: A growing menace to government

XDSpy – Stealing
government secrets since 2011

Of particular interest are two instances where the XDSpy
operators used the COVID-19 theme in their spearphishingcampaigns. In February 2020, they spread the malware

Probably the most interesting characteristic of the XDSpy

through an email stating that the first cases of COVID-19

APT group is that it went largely unnoticed for nine years.

had been discovered in Belarus, even though this was aThis espionage group has been active since 2011, and its

few weeks before the first official cases in the country

activities were undocumented until an advisory from thewere actually registered. The following photograph ofBelarusian CERT in February 2020.

the malicious email circulated on social networks as partof an unexpected disinformation campaign.

Over the years, the group compromised many government
entities, including militaries, Ministries of Foreign Affairs,

Then, in September 2020, the operators used the official

and private companies in Eastern Europe and the Balkans.

Russian government COVID-19 website rospotrebnadzor.

According to ESET telemetry, the targets of XDSpy wereru as a decoy to download XDDown, the main malware

located in Belarus, Moldova, Russia, Serbia and Ukraine.

component responsible for downloading additional plugins.

In terms of functionality and architecture, XDSpy uses
a typical cyberespionage toolset consisting of a main
downloader module that downloads additional plugins
to carry out the desired actions. During our research, we
discovered plugins used for exfiltrating files from the

Exaramel backdoor
in France: Another Sandworm
supply-chain attack?

main C: drive or from external drives, taking screenshots,and extracting saved passwords from various applications,

When it comes to the notorious Sandworm APT group,

such as web browsers and email programs. One of thecertainly, the most significant news in the past six months

plugins, called XDLoc, is used to gather nearby SSIDs

was the US Department of Justice indictment of six Russian(Wi-Fi access point names), most likely to geo-locate

GRU officers for their alleged roles in the group’s many

victimized machines.

attacks.

XDSpy operators use spearphishing emails in order toAside from the geopolitical aspect, defenders should becompromise their targets. The emails display a slightaware that, even though Sandworm’s most infamous

variance, as some contain an attachment, while others

attacks were dated between 2015 (the first Ukrainian

contain a link to a malicious file. The first layer of thepower grid attacks) and 2018 (Olympic Destroyer), thismalicious file or attachment is generally a ZIP or RAR

dangerous group is still very much active in 2021.

archive. At the end of June 2020, the operators steppedup their game by using a vulnerability in Internet Explorer,

In February 2021, France’s national information security

CVE-2020-0968.

agency ANSSI released a report revealing an intrusionwww.eset.com

8

APT attacks in Europe: A growing menace to government

campaign targeting the Centreon IT monitoring software,

but actually aren’t), are becoming a major trend. In fact,which resulted in the breach of a number of Frenchin Q4 2020 alone, ESET uncovered likely as many supply-

organizations. The campaign lasted from 2017 until 2020

chain attacks as the whole sector saw annually just a few

and affected mostly IT providers, especially web hostingyears back: the case of Lazarus abusing the WIZVERA

providers. Two backdoors were discovered on compromised

VeraPort software used by government and banking

systems: the P.A.S. webshell and (much more interestingly)

websites in South Korea; Operation StealthyTrident,

the Exaramel backdoor.

compromising the Able Desktop chat software used byseveral Mongolian government agencies; and Operation

Exaramel is the work of Sandworm (more specifically,

SignSight, compromising the distribution of signinga subgroup that ESET tracks as TeleBots) and was thesoftware distributed by the Vietnamese government.

piece of evidence that allowed us to attribute theMore recently, in Q1 2021, ESET also uncovered Operation

infamous Industroyer to the same APT group, based on

NightScout, a supply-chain attack targeting online

code similarities.

gaming communities.

With the recent SolarWinds hack in mind, and the fact

Considering how difficult it is to detect and preventthat Sandworm is known for conducting supply-chain

supply-chain attacks and how much APT actors andattacks in the past—remember the M.E.Doc compromise

cybercriminals have to gain from them, the number ofleading to the NotPetya outbreak?—the cybersecurity

such attacks is only expected to grow in the near future,industry was immediately curious about details of theboth in Europe and globally.

Centreon compromise.
For that reason, keep in mind the following
According to Centreon, the compromise was not the result

recommendations to reduce the risks that stem fromof a supply-chain attack. Instead, the campaign exploitedvulnerable software supply chains:

installations of out-of-date versions of its IT monitoring• Know your software—keep an inventory of all open-

software, not the company itself.

source and proprietary off-the-shelf tools used by yourorganization.

The fact that this was not a supply-chain attack is• Keep an eye out for known vulnerabilities and apply

a positive finding, as finding otherwise would indicate

patches as soon as they are available; indeed, attacks

a serious compromise with potentially far-reaching

involving tainted updates should by no means

consequences. However, another fact still remains true:

discourage anybody from updating their software.

Organizations have been using vulnerable versions of• Stay alert for breaches impacting third-party

Centreon IT monitoring software, and attackers havetaken advantage of that in order to compromise them.

software vendors.
• Drop redundant or outdated systems, services
and protocols.
• Assess your suppliers’ risks by developing an

Future outlook

understanding of their security processes.
• Set security requirements for your software suppliers.
• Request regular code audits and inquire about security

The past six months have shown that it’s business as
usual for APT groups—including highly sophisticated ones
like Sandworm, less erudite (but still capable of staying
under the radar and likely achieving their goals) ones like
XDSpy, and everything in between.

checks, and change control procedures forcode components.
• Inquire about penetration test s to identif ypotential hazards.
• Request access controls and two-factor authentication(2FA) to safeguard software development processes

Supply-chain attacks, while not all as earthshaking as
the SolarWinds hack (or other occurrences, such as therecent Centreon case, that smell like supply-chain attacks

and build pipelines.
• Run security sof tware with multiple layers
of protection.

www.eset.com

9

3

IT SECURITY AND
GOVERNMENT: PARALLELS
BETWEEN TARGETEDINSTITUTIONS

To be CISO of a cybersecurity company is to be in a unique position. And, while
there is inherent benefit in working with a board that intrinsically understands
the technical aspects of security, cybersecurity companies are no less a target(indeed, they could be a prize) for cybercriminals. This second point, knowing
we are a target, is where I believe our experience most strongly intersects withthat of government organizations. This key point has remained constant overmy 10 years as CISO at ESET and is a main driver in evolving our security posture
to meet the ever-changing demands of the online environment.
The reality of our status as a target also has strong
relevance to our company’s security culture, growthand business model. Governments face a similar
challenge. They are clear targets, their adversaries
will not be readily eliminated, and mitigation of theworst symptoms of the tactics and techniques foundon the threatscape dictate everything from security
policy and resource allocation to culture andstrategic growth.
Questions about how to evolve can be answered
both from the point of view of ESET and from thatof the wider information security world. Since I am
more intimately acquainted with ESET, it is far easier

Daniel Chromek
CISO/Section Leadto address the “how” from that perspective. ESET isa company whose business has grown quite
dramatically during my tenure. On the other hand,
it is a close-knit community in which a lot of activities
needed standardization and a proper governanceframework in order to streamline internal processes,
communication and the exchange of information.

www.eset.com

10

IT security and government: Parallels between targeted institutions

In particular, standardization and governance at ESET

security and visibility against the “Big Brother” worries

supported us in shifting focus from protecting primarily

held by our colleagues. ESET’s owners were privacy-aware

consumer and SMB clients toward enabling significant

and remain so. We also understood early on the possible

growth in the enterprise segment. It is this pursuit that

impact on staff morale. So, we agreed to configure ESET

has added new pressure to document information

culture early on as that of a positive security company,

security, comply with distinct directives and regulations,persuading everyone, including management, that using

and enhance our capabilities to address enterprisefear, uncertainty and doubt tactics simply do not work

customers’ questions and reservations when implementing

and could result in losing the respect of colleagues acrosssecurity solutions in their environments. Categorically ,the organization.

all governments are facing rapid demand to digitize
services, improve internal processes—and to formalize

I raise this because all of us, you and I included, face

both through improved governance. Similar to the ESETa similar choice: balancing security and visibility withexperience, the journey involved with formalization ofanother component—trust. This need became painfully

processes (and culture) via governance reflects maturity

clear in 2020, the year that gave us COVID-19 and thatand ambition to reach new markets; in the case oftransported ESET, and likely all of us, to a security future

governments—improved growth, better service provision

few of us entirely expected. To succeed in security in theand national or local cohesion.

COVIDian era, a few basics have to be done right. These
go beyond trust and include the practical aspects of
security that need minding by CISOs in 2021. Please find

Implications of maturationmine below:
1. Keep basic principles running 			Of course, the challenges around governance were being

in work-from-home mode

faced well before we reached our current level of“Getting back to basics” is always good advice inmaturity—and with growth of the company, they haveinformation security. It also applies to 2021, when we

only become more complex. As such, deploying security

hopefully enter a post-COVID world. Patching, backups

controls in a complex IT environment requires more timeand endpoint protection are areas that are importantand more resources than before. Therefore, our internal

regardless of where employees work, whether in the

security section grew significantly and now consists ofoffice or from home. Expansion and management of staff

multiple teams focusing on various aspects of security.

VPN accounts to provide more secure access to anorganization’s platforms, along with many otherSuffice to say that the internal security division needs toprecautions, are here to stay. Considering a Zero Trustbe very well prepared, as presentations to management

security approach or a “trust but verify” narrative might

can quickly morph into technical deep dives. The last

be helpful when addressing remote work specifics. Keeptime we had this type of deep dive, it was related to ouran eye on these and look to optimize.

vulnerability management tool’s risk score parameterand the formula behind it so that management could

2. Grow the organization in regulated areas

understand whether it was suitable for reporting. This

While I can only speak for ESET, we see accelerated growth

included a debate on how the presence of an exploit inin security-related regulations all over the world. This will

malware kits can raise the risk score above traditional

likely increase exponentially with the already rapid

CVSS scores. Whether it was 12 years ago when I joined

digitization being accelerated by COVID. For example, thethe co-founders in discussing our security policies or

NIS Directive (and the NIS2 Directive) impacts both ESET

today, going deep remains a cultural phenomenon deeply

as a cybersecurity provider and many of ESET’s clients,

rooted at ESET.

especially those in regulated industries or those thatprovide direct services to government. So, it makes sense

Of course, even before I took on the CISO role, we hadthat we engage together to create shared approaches.

many very skillful employees and needed to balancewww.eset.com

11

IT security and government: Parallels between targeted institutions

Just last year, amid rolling COVID lockdowns, ESET anda solution seems to be by asking the following questions:its products entered new regulatory territory with theWhat is the risk? What is the risk if our security teamlaunch of our cloud services like ESET PROTECT Cloud.

cannot dedicate resources to support the businessThis brought its own complexities, with ESET again

initiative? What is the risk that a particular audit’s findingneeding to comply with the NIS Directive and ESET’s

won’t be closed? What is the risk of…you name it! Risk

partners having to navigate local laws regulating the use

can be used as a single measure of determining theof cloud-based security software. So, while having topriority of competing activities.

comply with a single regulation like the NIS Directive may
not be pleasant, it is still a more straightforward task thanaligning with multiple regulations and standards requiredby government, industry and enterprise customers.

4. Increase the maturity 				of your software development life cycle
In the enterprise world, it is quite common to have bothinternal and outsourced development teams that build,

To face these challenges, a good approach is to establish

customize and maintain critical systems, products oran information security management system (e.g., ISOservices. A problem that can thus arise in the face of27001) to manage your core information security

multiple security standards being used in the software

processes and then systematically add the rest of thedevelopment life cycle is the expectation of applying

security controls you need to bring your organization up

a waterfall model. However, with a strong push on rapid

to speed with compliance. ISO 27001, as well as theagile development and deployment ongoing in the

Building Security In Maturity Model (BSIMM), can help

industry, it is simply not viable to apply a waterfallorganizations develop and maintain good documentation

approach to DevOps activities any longer.

of their security management system and internal
controls, which is a must to prove compliance.

ESET’s approach is to define DevOps security activities,
related to both development and operations, and to

3. Balance resources to support various businessinitiatives while preserving team sanity

engage in patient discussion with development teams
as to how to include these activities in their methodologies

I believe we struggle with this point as an industry. Likely,

and work procedures. The goal: to identify what should

the main problem faced by any mature security program

be delivered by internal security experts, versus security

is its relationship with so many activities within thechampions within the diversity of development teams,

organization; simply, it is difficult to give priority to theand how to automate as much as possible.

truly important activities. Reporting and measurement
add another level of complexity—we should track risks,
audit findings and incidents; gather feedback and lessons

5. Prepare and respond to the 				growing complexity of attacks

learned; identify compliance gaps; etc., even though

Looking at Verizon’s data breach reports over the years

sometimes it feels like we are being asked to compare

clearly suggests that attacks are getting worse. We don’t

what is incomparable. This same challenge is certainly

know what kind of vulnerabilities may be exploited next,

relevant for government organizations too as they strive

what kind of tools attackers will use, or what their goals

to strike a balance between the security of internalare. But what we can do is to prepare for them: bothmechanisms and external services with reporting—all oftechnically, via layered controls, and organizationally, withwhich needs to be both compliant and functioning practically.

incident response team capability, skills and overall maturity.

But there are at least two ways to achieve equilibrium.

The situation brought on by COVID-19 has been a good

The first is by way of business priority. If business canreminder of how quickly things can change. The

identify their priorities, then it is easy to shift internal

accelerations COVID brought to ESET are likely similar

security resources to them. If, however, business cannot

to those experienced by other organizations. My chief

identify their priorities (whether overall or comparedtakeaways from this experience would be:with other business unit priorities), the key to findingwww.eset.com

12

IT security and government: Parallels between targeted institutions• To put more focus on asset categorization and endpoint

Targeted but diligent

visibility as employees are working from home, outsideof an organization’s on-premises network.

Yes, we remain targeted, but having a solid foundation,• If leveraging cloud-based services, to prioritize proper

including the components mentioned above and a deep

configuration, access management and resource

focus on governance, enables us to focus on specificallocation, among other cloud security measures.

problems like forensic evidence, and gathering andreworking these findings into our own products. This is

From our own experience, we’ve noticed a clear growth inwhere our expertise in malware research most clearlyattacks, especially Business Email Compromise (BEC), thatintersects with product development. Using ESET

demanded more of our attention than usual. We are lucky,

Enterprise Inspector in combination with our coreas our endpoint portfolio includes a solid anti-malware

detection technologies, we can simultaneously protect

engine, a cloud-managed sandboxing solution—ESET

the business and constantly evolve our systems, culture

Dynamic Threat Defense—against emerging threats, and an

and processes to meet the challenges of the moment.

endpoint detection and response solution—ESET EnterpriseInspector—that provides a ton of visibility into endpoints andboosts our incident response capabilities. Furthermore, we
also have an easy-to-use Data Loss Prevention solution via
our technology alliance with Safetica.

www.eset.com

13

4

EMISSARYSOLDIER: MALICIOUS
ACTIVITIES OF LUCKYMOUSEAPT GROUP IN 2020

LuckyMouse has compromised government networks and private companies(telco, media and banks) in Central Asia and the Middle East
LuckyMouse, also known as APT27 and Emissary
Panda, is a cyberespionage group that is best known
for its regular use of watering hole, or strategic web
compromise, attacks. The group has breached not
only multiple government networks in Central Asiaand the Middle East, but also transnationalorganizations such as the International Civil Aviation
Organization (ICAO).
In its latest analysis of LuckyMouse, ESET Research
discovered a set of malicious activities that took
place in 2020 and in which the operators mainly
used the SysUpdate (aka Soldier) toolkit. ESET has
named this set of activities EmissarySoldier.

Matthieu Faou
Malware Researcher

In order to compromise victims, LuckyMouse
typically uses watering holes, compromisingwebsites likely to be visited by its intended targets.
LuckyMouse operators also perform network scans
to find vulnerable internet-facing servers run by
their intended victims. While the group generally
uses already known exploits to compromise
unpatched servers, ESET saw LuckyMouse among
the threat groups likely leveraging the Microsoft
Exchange vulnerabilities while they were still zerodays to conduct attacks on email servers.

www.eset.com

14

EmissarySoldier: Malicious activities of LuckyMouse APT group in 2020

Once LuckyMouse operators gain a foothold on a machine,code execution vulnerabilities were found in this application.

they will deploy one of their custom post-compromise

While ESET doesn’t have proof that these exploits were

implants, SysUpdate or HyperBro. An interesting similarity

used, we did observe LuckyMouse components being

among their toolkits is that they all employ DLL search

deployed through the internet information services (IIS)

order hijacking to thwart detection.

instance that was also serving Microsoft SharePoint.

image: According to ESET telemetry, LuckyMouse targeted the following entities in 2020

The Middle East is currently a hotbed for many espionage

LuckyMouse has a specific way of installing its implants—

groups, and LuckyMouse has been very active there asusing a so-called trident model—in its SysUpdate toolkit.

well. It is very common to find multiple threat actors on

The trident model features a legitimate application

the same machine or at least in the same network. In

vulnerable to DLL hijacking, a custom DLL that loads thethis region, LuckyMouse predominately focuses on

payload, and a raw Shikata Ga Nai-encoded binary payload.

governmental entities. The operators are probably trying
to obtain insights about the current geopolitical situation.

Overview of the trident modelOn the contrary, most of their targets in Central Asia are
private companies (telco, media and banks). This shows

Typical of many financially motivated—but also espionage—a strategic interest in the economic situation of the region.

threat actors, LuckyMouse employs offensive security
tools. Thus, while the group mainly uses custom backdoors,

LuckyMouse maintains a quite large network infrastructure

ESET researchers have seen several other tools in somewith VPN nodes, staging nodes and command and control

intrusions, including:(C&C) nodes. During the EmissarySoldier campaign, ESET
observed 16 different staging and C&C nodes.

• JuicyPotato, a privilege escalation tool;• Mimikatz, a tool to extract various Windows secrets,

ESET researchers also noticed that some of the compromised

including passwords; andmachines were running Microsoft SharePoint, which was• nbtscan, a NetBIOS scanner.

reachable from the internet. In 2019 and 2020, several remotewww.eset.com

15

EmissarySoldier: Malicious activities of LuckyMouse APT group in 2020

The SysUpdate toolkit itself, which was the focus of thisof tracking down such a slippery customer is by deploying

latest deep dive into LuckyMouse activity, is relatively

an endpoint detection and response (EDR) solution that

new, with the first samples having been discovered in

can identify suspicious events happening in a network.

2018. Since then, the toolkit has been through various

LuckyMouse was increasingly active throughout 2020,

development stages. In contrast with previous samples,seemingly going through a retooling process in whichthose used in 2020 showed major improvements andvarious features were being incrementally integrated

added functionalities, including the implementation of

into the SysUpdate toolkit. This may be an indicator thatmultiple C&C communication protocols and small

the threat actors behind LuckyMouse are graduallyrefactoring of already implemented features.

shifting from using HyperBro to SysUpdate.

SysUpdate components are divided into a set of binaries,

HyperBro is a much older toolkit that has caught

each with a specific operational purpose. In particular,significantly more attention from the threat intelligence

the trident model components of SysUpdate consist ofcommunity in recent years, with considerable evidence

a benign application like GUP.exe, which acts as the initialsuggesting it has also been adopted by several APT

loader for the next component, a DLL, which in turn actsgroups. On the other hand, SysUpdate has not received

as a loader for the next component, the Stage 1 payload

much attention, with few public reports mentioning

itself. These three components are dropped to an

it—most likely, it has only been deployed in a relatively

arbitrary location on initial access to a compromised

small number of operations.

system, a pattern that seemed to be recurrent in theactivity monitored across different victims located inMonitoring LuckyMouse and the tools used in its recent

different regions.

campaigns remains a priority. A reminder of why occurredjust as ESET researchers were wrapping up this investigation,

As the SysUpdate toolkit is highly modular, it gives its

with the threat group leveraging vulnerabilities in Microsoft

operators the flexibility to provide malicious capabilities

Exchange to attack email servers and install the SysUpdateon demand, as well as pull back and limit the exposure

toolkit. This point of intersection provides a strong case forof malicious artifacts at will. For this very reason, ESET

governments and business alike to tighten up security on

researchers did not retrieve any malicious modules, andinternet-facing servers, further collaborate on security

they expect this to be a recurrent challenge in analyzing

strategy, and build capacity and maturity in the use of

future operations that employ SysUpdate. The best way

EDR tools.

www.eset.com

16

5

REGULATORY RADAR:CRITICAL CUES FORCYBERSECURITY POSTURE IN
THE EU AND US

Society’s reliance on technology, and the emergence of those who seek to misuseit, have led to increasing attempts by governments around the globe to regulate
cyberspace. In doing so, governments are broadly attempting to deter bad
actors, both state-sponsored and criminal, through powers to pursue and levy
penalties; protect critical national infrastructure, personal information, security
and defense assets; and build societal resilience by ensuring government bodies,businesses and other organizations recognize their responsibilities and are held
accountable. In parallel, governments aim to educate citizens as to the scopeof cybersecurity risks and needed mitigations.
At a supranational level, the United Nations is trying
to secure agreement on the application of international
law to state activity and build on 11 norms of responsible
behavior in cyberspace agreed in 2015. The European
Union’s 2018 GDPR regulation quickly becamea reference point for countries seeking to strengthen
privacy and security regulation. Both the EU and US(under the new Biden administration) are expected to
set the tone for the increased regulation of cyberspacein the years ahead.

Andy GarthGovernment Affairs LeadIn the absence of a global standard or agreement, theregulatory picture is rather fragmented. Presently,
regulation is predominately driven at the national, stateand industry sector levels. This fact, combined withthe pace of innovation and legislative complexities, hasleft most governments with palpable security
challenges and many struggling to keep up.

www.eset.com

17Regulatory radar: Critical cues for cybersecurity posture in the EU and US

Given the broad scope of cyberspace and differences innational approaches, for brevity, CISOs and policy makers

European Union:
Cybersecurity Certification

should keep an eye on the following areas to identify
critical cues for future compliance and security posture.

The EU Cybersecurity Act of 2019, now in force, granted
a permanent mandate to the EU Agency for Cybersecurity(ENISA), including the new key role of setting up andEuropean Union: NIS2 Directive

maintaining a cybersecurity certification framework.
This framework will provide EU-wide certification
schemes with a comprehensive set of rules, technical

In December 2020, the EU published the draft text of therequirements, standards, and procedures, providing

NIS2 Directive, which significantly expands the number

assurance to users based on the level of conformity withof entities and sectors required to take strengthened

the agreed requirements.

measures to enhance cybersecurity. The text is currently
progressing through the legislative scrutiny process.

Further, these certification schemes represent agreements
at the EU level on the evaluation of the security properties

Once a final text is agreed, on member states will haveof information and communications technology (ICT)

18 months to implement the directive. The impacts willproducts or services. Briefly, these will attest ICT products

be felt in the EU and beyond. The proposed NIS2

and services in terms of:

Directive will:• categories of products and services covered;• Introduce more stringent supervisory measures;• cybersecurity requirements;• Impose stricter enforcement requirements, including• the type of evaluation; andharmonized sanctions regimes across member states;• the intended level of assurance.

• Establish information sharing and cooperation on
cyber-crisis management at national and EU levels;• Mandate the creation of national strategies that ensure
the resilience of critical entities;• Obligate the carrying out of national risk assessments;and• Aim to strengthen the security of supply chains.

ENISA and the European Commission will be assisted
and advised by:• European Cybersecurity Certification Group (ECCG);• the Stakeholder Cybersecurity Certification Group(SCCG); and• European Cybersecurity Industrial, Technology andResearch Competence Centre (ECCC).

When adopted, the NIS2 Directive will apply alongsidesector-specific legislation, such as the proposed “Directive

In particular, the ECCC is expected to become the mainon the Resilience of Critical Entities.” This sector-specificinstrument for investing in cybersecurity research, highdirective aims to protect critical infrastructure and willtech and innovation. This overall mission will feed into

complement the NIS2 Directive to the extent in which

the following objectives:

it will likely impose cybersecurity risk management andnotification obligations of at least an equivalent effect

1. Carry out procurement of products and solutions.

to the obligations set out in the NIS2 Directive.

2. Provide financial support and technical assistance tostart-ups and SMEs.
3. Suppor t research and innovation based on
a comprehensive research agenda.
4. Drive high cybersecurity standards, especially in thefield of skills development.
5. Facilitate cooperation between civil and defense
spheres with regard to dual technologies (in relation
to the European Defence Fund).

www.eset.com

18

Regulatory radar: Critical cues for cybersecurity posture in the EU and US

initiatives. Indeed, Vice President Kamala Harris has
a strong record in privacy enforcement, as witnessed by
the amended and strengthened California Online Privacy
Protection Act (CalOPPA) during Harris’s time as
California’s state attorney general. Also, several Obamaera staffers who contributed to the consumer bill areback in the driving seat.
As the pandemic continues, there will likely be considerable
focus on healthcare providers and agencies that have been

Tony Anscombe
Chief Security Evangelist

party to contact tracing, testing and vaccination. Currently,
some of the processes for collection of personal data may
not be as scrutinized due to urgency and medical need. It
should be expected, however, that this latitude will likely
be removed and the cybersecurity requirements for such

US privacy regulations
and evolving cybersecurity laws

data will be strengthened and enforced.
This is also true globally, where the internet creates anenvironment that breaks down international barriers,

Following the EU’s enactment of GDPR in 2018,

given that everything is accessible in the same cloud.

implementation of data privacy regulations also began

Privacy legislation is not a set and done process; it’s an

to gain pace at the state government level in the United

evolving process that is likely to require continualStates. Legislators in California passed the California

modif ication, especially when considering new

Consumer Privacy Act in 2018 (CCPA) and implemented

technologies such as artificial intelligence, the Internet

it in 2020. At the end of 2020, California’s Proposition 24

of Things and other advancements in technology. There

was passed, meaning the California Privacy Rights Act

is a need for standardization and harmonization within(CPRA) will become effective in 2023. The CPRA makes

and among states, countries, and continents across thesignificant additions to the CCPA—which itself could be

globe. All consumers should be awarded the same data

seen as falling short of GDPR in some areas, although inprivacy rights by companies and organizations regardlessothers it went further. These include:of their location. Privacy legislation is undoubtedly a topic• the concept of household data in addition to merelythat will remain a priority for legislators.

individual data as emphasized in the GDPR;• extending protection to Californian residents evenwhen outside the state for temporary or transitory

Cybersecurity laws in the US

purposes;• the right to opt out of the sale of personal data to

While there are all-encompassing cybersecurity laws inthird parties. Companies must include a “Do Not Sell

the US, typically legislation is dependent on the sector

My Personal Information” link on website home pages.

of a business or organization, although some legislation

While similar protections exist under the GDPR, they

aimed at specific technologies crosses the boundaries ofare less clear—a data subject needs to opt out ofmultiple industry sectors.

marketing purposes and additionally withdraw consent
for processing activities.

Some of the leading sector-specific US legislation related
to cybersecurity includes:

With broad agreement on the need for federal consumer
privacy legislation realized in the Consumer Online• Health Insurance Portability and Accountability
Act (HIPPA);Privacy Rights Act (COPRA) in April 2020 and the Biden• Gramm-Leach-Bliley Act;

administration’s apparent recognition of the need for• Dodd-Frank Act; andfederal privacy legislation, we will likely see a host of• IoT Cybersecurity Improvement Act.

www.eset.com

19Regulatory radar: Critical cues for cybersecurity posture in the EU and US• Consumer Privacy Protection Act 2017—requires

IoT

companies to secure personal information and provide
notifications on data breaches.

Finally, the IoT Cybersecurity Improvement Act of 2020,• Cybersecurity Information Sharing Act (CISA)—allows

which applies across sectors, requires the National

sharing of internet traffic between gov’t and techInstitute of Standards and Technology (NIST) to publish

companies for cybersecurity threat reasons.

standards and guidelines for federal agencies on the• Federal Information Security Management Act

appropriate use of IoT devices in government systems.

(FISMA)—requires government agencies to havepolicies, standards and guidelines on information

This piece of IoT legislation consists of a stepped timeline

security.

that requires agencies to:

An example of sector-specific legislation is the HIPPA,
which requires healthcare organizations to protect
personally identifiable information from fraud and theft,
and to address limitation in healthcare insurance
coverage. In the financial industry, organizations are
required to comply with the Gramm-Leach-Bliley Act• agree on how to address and disclose vulnerabilitiesof devices in use;
• set minimum information security requirements for
managing cybersecurity risks; and• review and revise guidelines and standards every
five years.

and the Dodd-Frank Act, which stipulates there must be
policy in place to protect information from security

The final component takes effect in December 2022 andthreats and issues with data integrity.

will prohibit use of IoT devices that do not comply with
the NIST standards and guidelines.

In fact, under the Dodd-Frank Act, the Consumer Financial
Protection Bureau has authority to socialize potential
new rules. Accordingly, in autumn of 2020, the bureau
issued an Advance Notice of Proposed Rulemaking which
will likely result in changes in the near future to themethods of consumer-authorized access to data and thelevel of data security required under the law.

www.eset.com

20

6

ENDPOINT DETECTION
AND RESPONSE:
A COUNTERBALANCE TOPERSISTENT THREATS

Large organizations and government institutions, such as ministries of foreign
affairs, embassies and other diplomatic representatives, are prime targets forespionage operations. Threat actors target these institutions in various ways
to steal sensitive information. Stealth is an essential part of these malicious
campaigns because remaining unseen and undetected in a target network for
as long as possible is key for success.
Endpoint detection and response (EDR) technology

Once Invisimole’s operators have a foothold in an

can help large organizations detect stealthy threatorganization, they typically set up different

actors by flagging suspicious behaviors, especiallypersistence chains to ensure continued access.

when they employ fully undetected malware or

However, although different chains exist, they

legitimate tools. EDRs can generate alerts upon

have one point in common: No malicious code is

execution of unpopular applications or legitimate

present on disk.

tools known to be abused by attackers—for
example, so-called living-off-the-land binaries

Further, Invisimole’s operators abuse legitimate(LOLBins)—thus allowing defenders to see andtools to load and decrypt, in memory, malicious

investigate suspicious activities happening intools that enable their espionage activities. The

their networks.

usage of these legitimate tools makes it hard forstandard detection technologies to detect

Invisimole, a threat actor ESET researchers haveanomalies. In these cases, in which stealth is the

been tracking for a few years, bears out its name,ultimate goal, defenders relying on a properly

as it targets high-profile organizations forconfigured EDR solution can detect such malicious

espionage purposes and deploys various strategies

activities and correctly mitigate attacks.

in order to be as difficult as possible to detect.

www.eset.com

21

7

ENDPOINT DETECTION
AND RESPONSE AT ESETWHAT IS ENDPOINT DETECTION AND RESPONSE?

Endpoint detection and response (EDR) solutions collect and analyze large
amounts of data generated from activity on endpoints. Suspicious behaviors
produce an alarm that alerts security professionals to further investigate andpotentially discover any attacks that would otherwise go unnoticed. ESETdeveloped ESET Enterprise Inspector (EEI) as an EDR solution capable ofprotecting both Windows and macOS endpoints.
MITRE ATT&CK®

other contextual information, EEI offers automated

ESET Enterprise Inspector references its detections

and easy threat hunting capable of discoveringto the MITRE ATT&CK knowledge base of adversarial

targeted attacks. Since EEI allows the creation oftactics, techniques and procedures, which provides

custom rules, and rule exclusions, it can be fine-comprehensive information about the mosttuned to make it best suited for an environment

complex threats and adversary groups afflicting

or to re-scan the events database with custom

cyberspace. With over 20 contributions to theconfigurations for historic threat hunting.

knowledge base and having participated in thethird MITRE Engenuity ATT&CK Evaluations, our EDR

Public API

solution is battle tested and mature.

ESET Enterprise Inspector features an API thatThreat hunting
Packaged with a set of rigorously tested rules toallows security engineers to export detections,thus allowing effective integration with tools such
as SIEM, SOAR, ticketing and other tools.

detect suspicious behaviors and with advanced
filtering capabilities to sort data based on file
popularity, reputation, signature, behavior andwww.eset.com

22

ABOUT ESETFor more than 30 years, ESET® has been developing industry-leading IT security software and services
to protect businesses, critical infrastructure and consumers worldwide from increasingly sophisticateddigital threats. From endpoint and mobile security to endpoint detection and response, as well as
encryption and multifactor authentication, ESET’s high-performing, easy-to-use solutions unobtrusively
protect and monitor 24/7, updating defenses in real time to keep users safe and businesses runningwithout interruption. Evolving threats require an evolving IT security company that enables the safeuse of technology. This is backed by ESET’s R&D centers worldwide, working in support of ourshared future. For more information, visit www.eset.com or follow us on LinkedIn, Facebook,and Twitter.

Contributing Editors:
Rene Holt, ESET PR Writer
James Shepperd, ESET PR Writer
Branislav Ondrasik, ESET Security Research Communications Manager
Additional Contributions From:
WeLiveSecurity
ESET Creative Studio

www.eset.com

23