Threat
ReportH1 2023
December 2022 – May 2023

(eset):research

ESET THREAT REPORTContents
Foreword3
Threat Landscape Trends 4
Predatory lending practices find new ground on Android5
The many faces of cryptocurrency threats8
Emotet campaigns shrink as operators struggle to find a new attack vector11
Malicious OneNote files: The short-lived limelight of a new intrusion vector13
Email threats see a sextortion scam comeback15
Microsoft SQL Server: An increasingly attractive target for brute-force attacks18
RedLine Stealer: Malware as a business 21
macOS affected by the first case of two linked supply-chain attacks24
Same code, different ransomware? Leaks kick-start myriad of new variants27

Threat Telemetry30
Research publications43
About this report44
About ESET45

H1 2023 | 2

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 3

Executive summary
Android

Exploits Attack vectors SQL attacks

Predatory lending practices find new ground on Android

Microsoft SQL Server: An increasingly attractive target for brute-force attacks

Instead of quick financial assistance, victims of malicious loan apps are met with death
threats and digital usury practices.

MSSQL password guessing attacks take a nasty upturn; Log4Shell exploitation attempts
continue their endemic growth.

Cryptocurrency threats

Infostealers Malware-as-a-Service

The many faces of cryptocurrency threats

RedLine Stealer: Malware as a business

Cryptocurrency threat detections were falling in H1 2023 despite bitcoin’s comeback, but weshouldn’t celebrate just yet.

A look at the infamous RedLine infostealer, which recently faced disruption by ESET
Research.

Emotet Downloaders Attack vectors

macOS Supply-chain attacks

Emotet campaigns shrink as operators struggle to find a new attack vector

macOS affected by the first case of two linked supply-chain attacks

A once notorious botnet family tries to stay afloat with three seemingly low-impact

One of the spikes observed in macOS detections reveals the first case of interconnected

campaigns in H1 2023.

supply-chain attacks, compromising a significant number of macOS devices.

Attack vectors

Ransomware
Same code, different ransomware? Leaks kick-start myriad of new variants

Malicious OneNote files: The short-lived limelight of a new intrusion vector
Several high-profile malware families have been testing OneNote as a spreading mechanism.

Email threats Web threats Scams Phishing
Email threats see a sextortion scam comeback
The past half year saw a rise in sextortion scams and phishing.

Leaks allow more criminals to try their luck with ransomware yet make preexisting
detections increasingly effective against emerging malware.

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 4

Foreword
Welcome to the H1 2023 issue of the ESET Threat Report!
We are pleased to present the latest issue of ESET Threat
Report, which brings changes aimed at making its contents
more engaging and accessible. One notable modification is
our new approach to data presentation: rather than detailingall data changes within each detection category, our intention
is to provide more in-depth analyses of selected, notabledevelopments. For those seeking a comprehensive overview of
the telemetry data related to each category, we have included
the full set of charts and figures in a dedicated Threat Telemetry
section.
Another notable update is the change in publication frequency,transitioning from triannual to a semiannual release schedule.
In this issue, we focus on the highlights of H1 2023, covering
the period from December 2022 through May 2023. When
comparing this period to H2 2022, we refer to the timeframefrom June 2022 to November 2022.
In H1 2023, we observed trends highlighting cybercriminals’
remarkable adaptability and relentless pursuit of new avenues
to achieve their nefarious goals – be it through exploiting

vulnerabilities, gaining unauthorized access, compromisingsensitive information, or defrauding individuals. One of thereasons for shifts in attack patterns is stricter security policies
introduced by Microsoft, particularly on opening macro-enabled
files. In a new attempt to bypass these measures, attackers
substituted macros with weaponized OneNote files in H1 2023,
leveraging the capability of embedding other files directly
into OneNote. In response, Microsoft readjusted, prompting
cybercriminals to continue exploring alternative intrusion vectors,
with intensifying brute-force attacks against Microsoft SQL
servers possibly being one of the tested approaches.
Our telemetry data also suggests that operators of the oncenotorious Emotet botnet have struggled to adapt to theshrinking attack surface, possibly indicating that a different
group acquired the botnet. In the ransomware arena, actors
increasingly reused previously leaked source code to build new
ransomware variants. While this allows amateurs to engage inransomware activities, it also enables defenders like us to cover abroader range of variants, including newly emerging ones, with amore generic set of rules and detections.

Although cryptocurrency threats have been steadily declining
in our telemetry – not even to be resurrected by the
recent increase in bitcoin's value – cryptocurrency-related
cybercriminal activities continue to persist, with cryptomining
and cryptostealing capabilities increasingly incorporated into
more versatile malware strains. This evolution follows a patternobserved in the past, when malware such as keyloggers was
initially identified as a separate threat, but eventually became acommon capability of many malware families.
Looking at other threats focused on financial gain, we observed
a comeback of so-called sextortion scam emails, exploiting
people’s fears related to their online activities, and an alarming
growth of deceptive Android loan apps masquerading as
legitimate personal loan services, taking advantage of vulnerable
individuals with urgent financial needs.
I wish you an insightful read.
Roman Kováč
ESET Chief Research Officer

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

ThreatLandscapeTrendsResearch publications

About this report

About ESET

H1 2023 | 5

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 6

Android

Predatory lending practices find new groundon Android
Instead of quick financial assistance, victims of malicious loan apps are met with death
threats and digital usury practices.
In H1 2023, ESET telemetry identified an alarming

Google and communication about these applications

growth of deceptive Android loan apps, which

remains in progress.

masquerade as legitimate personal loan services,promising users quick and easy access to funds.
However, these services are designed to defraud users
and gain their personal and financial information. ESET
products therefore recognize these apps using thedetection name SpyLoan, which directly refers to their
spyware functionality combined with loan claims.
These fraudulent apps are marketed through social
media and SMS messages offering personal loans, but
the apps themselves are available to download fromdedicated scam websites, third-party app stores, andGoogle Play, as they are not only able to mislead users
but also bypass Google Play policies. As a Google App
Defense Alliance partner, ESET shared its findings with

Compared to H2 2022, detections of all SpyLoan apps

H2

H1
+88%

grew by nearly 90% in H1 2023, leading to the overall
growth of the Android Spyware category by 19%.
Spyware is by far not the most prevalent threat
on Android; this platform has been swarmed bydetections that turn a profit for cybercrooks via
online ads – Adware, HiddenApps, and Clickers. In
ESET Threat Report T3 2022, we explained thatbehind the pre-Christmas growth of Adware and
HiddenApps were free mobile games packed withadware, and the availability of development tools andresources for Android that make it easier for Adwareand HiddenApps developers to create and distribute
their wares. In H1, which in our case also encompasses

SpyLoan detection trend in H2 2022 and H1 2023, seven-day moving average

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 7

device (such as Exif metadata without actually sending
the photographs themselves), contact lists, location
data, and SMS messages. Interestingly, according
to the reviews, it doesn’t matter whether a person

14%

applies for or even receives a loan: the app’s enforcers

2%

13%

start to harass and blackmail their victims into

1%

25%

2%

9%

payment, sometimes mentioning death threats, as was

1%

Other

0.1%
3%

documented by their victims. The users of SpyLoan
apps also mention that the interest rates are very high,and loan tenure is extremely short – sometimes as

39%

short as five or seven days.

Android detection categories in H1 2023

December 2022, the rise of HiddenApps (+42%) andeven though their trend across the current reporting

Adware (+19.5%) detections was still mainly connectedperiod is generally downward.

to gaming apps that serve ads to their users. If wecount together the detections of all categories living off
ads, their share of all Android detections is 68.4%.

While SpyLoan apps also represent a form of financial
threat, they differ from banking malware in that theypresent a form of modern-day digital usury, which

Even though other Android detections visibly declinedrefers to the charging of excessive interest rates onin H1 2023 – SMS trojans by 62.5%, Ransomware byloans, taking advantage of vulnerable individuals with

50%, and Cryptominers by 16% – the prevalence ofurgent financial needs, or borrowers who have limited

Adware and HiddenApps is so significant that overall

access to mainstream financial institutions.

Android detections increased by 20.2%.

Once installed, these apps request permissions to

The only type of detection that held its numbers steadyaccess a list of accounts, call logs, calendar events,

was Financial threats, which encompass Banking

device information, installed app lists, local Wi-Fi

malware and Cryptostealers – which grew by 4.5%,

network information, information about files on theUsers of SpyLoan apps claiming to be harassed and threatened

Machine-translated threatening messages posted by one of thereviewers: Is the debt you have worth your peace of mind and that ofyour loved ones?... Do you really want to put your safety at risk?... Are
you willing to pay the consequences? You can get into a lot of problems,
avoid a bad experience for yourself and those around you.

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

According to ESET telemetry, the enforcers of theseThe deceptive communication deployed by SpyLoan

apps operate mainly in Mexico, Indonesia, Hongapps is so layered and complex that we will describe

Kong, Thailand, India, Pakistan, Colombia, Peru, theit in an upcoming blogpost on WeLiveSecurity.com.

Philippines, Egypt, Kenya, Nigeria, and Singapore. We

In general, SpyLoan apps use wording and design

believe that any detections outside of these countries

elements that closely resemble legitimate loan apps,

are related to phones that have, for various reasons,and this intentional similarity makes it difficult toaccess to a phone number registered in one of these

determine the authenticity of an app, especially whencountries.

financial and legal terms are involved.

35%

0%

Research publications

About this report

About ESETEXPERT COMMENT
Despite the challenges posed by these fraudulent
loan apps, there are effective steps users canemploy to safeguard themselves. These include
sticking to official app sources, reading negative
app reviews – as positive ones may be coerced
from previous victims – and using a reputablesecurity app. Individuals who have fallen victim to
SpyLoan apps should report the incident to local
law enforcement or relevant legal authorities,
contact consumer protection agencies, andnotify the governing institution for private loans(often the national bank or its equivalent). If the
deceptive loan app was obtained through Google
Play, individuals can seek assistance from Google
Play Support to report the app and request
the removal of their associated personal data.
However, it is important to note that the data
may have already been extracted to the attacker’scommand and control server.
Lukáš Štefanko, ESET Senior Malware
Researcher

Geographic distribution of SpyLoan detections seen by ESET telemetry in H1 2023

H1 2023 | 8

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 9

Cryptocurrency threats

The many faces of cryptocurrency threats
Cryptocurrency threat detections were falling in H1 2023 despite bitcoin’s comeback, but weshouldn’t celebrate just yet.
Ever since ESET started tracking cryptocurrency

Conversely, the cryptocurrency threats trend saw

threats, their trend roughly corresponded to bitcoin

no growth in H1 2023. Detections in this category

exchange rates. Whether bitcoin rose or fell, it seemed

continued to steadily decrease, amounting to an

to be a given that cryptocurrency threats1 would follow

overall 31% decline between periods. This raises

suit – until H1 2023, when the trends diverged.

questions – where has all the cryptomalware gone?

In H1 2023, bitcoin was experiencing a partial
resurgence in popularity. After a prolonged decline andAre cybercriminals simply done with cryptomining andcryptostealing, or is there something more going on?

the rate staying beneath USD 20,000 per BTC for the

On the one hand, ESET telemetry has indeed registered

most part of November and December of 2022, thea decline in new cryptocurrency threat detections

cryptocurrency climbed up to the USD 30,000 markin the past few months. There have also been ain the middle of April, and hovered around there until

number of successful law enforcement operations

the end of the period. Even though that’s far from its

targeting cryptocurrency-related crime recently. Fearprevious heights, bitcoin is not in freefall anymore.

of retaliation might play a part in why threat actors

Its recent growth could be a reaction to several bankcould be reconsidering their crypto-focused operations,closures (SVB, Signature Bank, Silvergate), with people

leading to a lower number of detections. The ever-forgoing the traditional banking system in favor

fluctuating exchange rates of cryptocoins probably

of decentralized currencies. Still, after the wave ofact as a further deterrent. On the other hand, looking

bankruptcies and cryptocurrency hedge fund collapses,

only at threats that solely focus on cryptocurrency

culminating in the failure of FTX, it remains to be seen

might not be enough anymore when talking about thiswhether bitcoin’s growth lasts.

part of the threat landscape. Over the years, malicious

1

Cryptomining and cryptostealing malware

H2

H1

-31%

Cryptocurrency threat detection trend and bitcoin/USD exchange rate in H2 2022 and H1 2023, seven-day moving average

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

activity surrounding cryptocurrencies has diversified considerably. Since

The situation is very similar over in Android threats, where we reclassified

threat actors presumably want to maximize their profits, it would makethe banking subcategory as Financial threats due to the prevalence ofsense for them to abandon threats focused purely on cryptocurrencies incryptostealing features. Compared to the ClipBanker families, the trend offavor of malware with broader capabilities. As such, cryptostealing and/orAndroid financial threats has been stable over H2 2022 and H1 2023.

cryptomining components have now also become part of other malware.

For an example of just how insidious cryptocurrency threats preying on

Among the most well-known infostealers, RedLine Stealer, Agent Tesla,

Android users can be, ESET researchers found dozens of clippers in the form

and Racoon Stealer all have cryptostealing capabilities, while for exampleof trojanized WhatsApp and Telegram apps that can switch cryptocurrency

the Fareit trojan is able to mine cryptocurrency on a compromised machine.

wallet addresses that victims send in chat messages to addresses belonging

These are all big malware families with the combined detections counting

to the attacker. Often, the victim has no chance of knowing the walletin the hundreds of thousands – even if cryptocurrency is not their main

address has been switched, as the changed address is visible only to thefocus, they have a wide reach.

recipient of the message.

Other threats have also jumped on the cryptomalware bandwagon: as a

Another way of spreading cryptomalware is via botnets. One such botnet

feature, cryptostealing is now integrated into so many ClipBanker families

is Amadey, a popular downloader sold on underground forums whose(i.e., threats that steal or manipulate the data in the clipboard) that theysource code has been leaked online. Among other capabilities, the malware

cannot be cleanly separated from cryptocurrency threats anymore. Thesecan steal cryptowallet information. This botnet experienced significant

threats grew by 23% in H1 2023.

growth in H1 2023; its numbers skyrocketed by almost 370% between
periods. Danabot, another botnet tracked by ESET, was seen pushing both

H2

H1

+23%

ClipBanker detection trend in H2 2022 and H1 2023, seven-day moving average

executables with crypotostealers, and later also LaplasBanker, which canreplace cryptowallet addresses.

About ESET

H1 2023 | 10

EXPERT COMMENT
It appears that the decline of the cryptocurrency threat
landscape, which even bitcoin’s current return to form
could not reverse, will continue. However, the greedof cybercriminals means that as long as there are
cryptocurrencies, there will also be threats going after
them, at least in some shape or another. Even thoughover time there might be less and less crimeware in thiscategory, features targeting cryptocurrency are becoming
part of other malware. Those multipurpose threats,
alongside various scams and phishing efforts, serve as areminder to always stay vigilant.
Igor Kabina, ESET Senior Detection Engineer

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

While cryptocurrency crimeware has become

profitable: recently, the US Department of Justiceknown crypto-brands such as MetaMask and OpenSea.

more and more widespread over time, the activity

seized over USD 112 million in funds from various

The operators offer an administration panel to manageof cybercriminals has coalesced around various

operations running pig butchering scams.

the phishing campaigns, as well as the option to

cryptoscams and phishing. A prime example is thenotorious “pig butchering” scheme, with many such
scams still going strong in H1 2023. In these schemes,
criminals first use social engineering methods to gain
their victims’ trust, build a close relationship with them,and then convince them to put increasing amountsof money into fake cryptocurrency ventures, such as
copycat investment apps. Once the targets have no
more money to give, the scammers steal the funds
and disappear. These schemes seem to be immensely

Similar to other malware, phishing services can also
be turned into a product, with threat actors offering

According to ESET phishing feeds, cryptocurrency-

Recently, a PhaaS operation focusing on cryptocurrency

themed phishing lures ranked fifth in H1 2023.

scams has been identified by Scam Sniffer. The

Searching through the feeds, we saw numerous

operation is run by a scam vendor called Inferno

instances of cryptocurrency exchange platform

Drainer; it had made close to USD 6 million in stolen

impersonators, fraudulent play-to-earn games, andcryptocurrency at the time of reporting, having createdcryptocurrency-giveaway scams.

hundreds of phishing websites impersonating well-

37.5%

Finance

21.7%

Email

8.8%

Shipping

6.9%

Cryptocurrency

5.5%

Telecommunications

4.1%
3.5%

Gaming

2.8%

Document

3.1%

File storage

exchange for a 30% slice of the proceeds.

phishing-as-a-service (PhaaS) to interested parties.

Social media

Shoppingbuild phishing websites for the prospective buyers in

2.2%

Top 10 phishing website categories in H1 2023 by number of unique URLs

Examples of cryptocurrency-themed phishing and scam websites seen in ESET phishing feeds

H1 2023 | 11

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

Emotet Downloaders Attack vectors

About ESET

Emotet campaigns shrink as operatorsstruggle to find a new attack vector
A once notorious botnet family tries to stay afloat with three seemingly low-impact
campaigns in H1 2023.
Ever since Visual Basic for Applications (VBA) macros

Two notable things about this wave of malspam:from the internet have been disabled in OfficeFirst the operators didn’t use reply-chain attacks, adocuments, Emotet operators have been scrambling

technique that would make the malicious emails lookto find an alternative attack vector that would prove

more legitimate by injecting them into a preexisting

similarly effective. In H1 2023, they ran three distinctive

conversation of the victim.

malspam campaigns, each testing a slightly different
intrusion avenue and social engineering technique.
However, the shrinking size of the attacks and constantchanges in the approach may suggest dissatisfaction
with the outcomes.

Second, it seems an odd choice to use VBA macros,which Microsoft disabled by default in documents
coming from the internet. This means most of thevictims simply couldn’t run the embedded malicious
code. Even if they jumped through all the hoops

After a typical several-month-long hiatus, the Emotet

necessary to activate the macro, a reliable multilayered

botnet became active again. Around March 8, 2023, it

security solution would still detect and block either thestarted distributing Word documents with embedded

download of Emotet’s binary or its subsequent activity.

malicious VBA macros, masquerading as invoices. To
avoid detection and prolong the sample processing, theoperators artificially inflated the size of the files to over
500 MB – a well-known technique previously used bycrimeware and APT groups.

In their second campaign between March 13 and March
18, attackers seemingly acknowledged these flaws, andapart from using the reply-chain approach, they also
switched from VBA macros to OneNote files (.one)

2023 Emotet campaigns as seen in ESET telemetry.

H1 2023 | 12

ESET THREAT REPORT

Executive summary

Forewordwith embedded VBS scripts. If victims opened these files, they were greetedby what looked like a protected OneNote page, asking them to click a

Threat Landscape Trends

H2

Threat Telemetry

Research publications

About this report

H1

-94%

View button to see the content. Behind this graphic element was a hidden
VBS script, set to download and execute the Emotet DLL.
content, people tend to click at similar prompts by habit and thus canpotentially allow the attackers to compromise their devices.
According to ESET telemetry, March 20 saw the launch of the last of thesecampaigns, taking advantage of the end of the tax year in the UnitedStates. The malicious emails sent by the botnet pretended to come from the
US Internal Revenue Service (IRS) tax office and carried the attached ZIP file
Similar to the first 2023 wave, the ZIP file contained an artificially inflated
Word document using the same name as the ZIP requiring the user toenable an embedded VBA macro. Again, this has probably hit a dead end
with the default macro-disabling policy in place. Using a country-specifictax-related theme also limited the potential impact of the campaign
exclusively to the USA. However, ESET systems also detected a lessprevalent use of embedded VBScript, indicating that another campaign
using the OneNote approach was underway at the same time.
Overall, the 2023 Emotet campaigns accounted only for tens of thousandsof detections, a drop of almost 95% compared to the multimillion detection
rates in H2 2022. The most frequently used attack vectors were weaponized
Office files – typically Word documents and Excel spreadsheets –accounting for 58% of the detected attacks, followed by VBA macros in 29%
of cases and 10% using embedded VBS scripts. Most of the attacks detectedby ESET systems were aimed at Japan (31%), Italy (11%), and Mexico (5.5%),

H1 2023 | 13

EMOTET OVERVIEWFirst sighted as a banking trojan in June 2014, Emotet has
since changed into a crime-as-a-service platform, selling
access to compromised systems to other criminal groups.
Thus, once Emotet is running on a computer, it typicallydownloads and executes other strains of malware.

Despite a OneNote warning that this action might lead to malicious

named W-9 form.

About ESET

Latest Emotet campaigns compared to its previous activity in H2 2022.

although these numbers may be biased by the strong ESET user base inthese regions.
It remains unclear why Emotet operators relied so heavily on the disabledby-default VBA macros and why some campaigns didn’t use the replychain attacks, which would have helped improve their reach. Emotet has
been known for its effectiveness in the past, and these flaws might further
support rumors from H2 2022 that a different – probably less-skilled –threat group has bought the botnet and its infrastructure.

Emotet has a modular program design, with a main
module distributed through spam emails, historicallycontaining malicious Microsoft Word documents. Emotet
then uses additional modules to spread further, bruteforce network share usernames and passwords, turncompromised systems into proxies, steal email addresses
and messages from the compromised systems, andperform other malicious actions.
Microsoft’s move to throw out the “Enable Content”
button came at a time for Emotet when, after recoveringfrom takedown efforts from 2021, it had been churningout spam campaigns in March and April 2022. Taking
note of the change, Emotet’s developers have shiftedto experimenting with different techniques to replace
their dependence on macros as the initial stage of theirmalware delivery platform.

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 14

Attack vectors

Malicious OneNote
files: The short-lived
limelight of a new
intrusion vector
Several high-profile malware families have been testing OneNote as a spreading mechanism.
Hiding an attached malicious file or a script behindalmost 90,000 detections. Looking at the trend chart,

what looks like a clickable button in a OneNote file

February and March were the busiest months, with(.one) might sound too simple to be a viable attack

OneNote becoming a part of the intrusion chain of

vector. However, ESET telemetry shows it was used

a long list of malware families, including Emotet,

by a broad range of cybercriminals in H1 2023, with

RedLine Stealer, Qbot, Formbook, AsyncRAT, XWorm,

attackers distributing weaponized Microsoft OneNote

Quasar, IcedID, and even BlackBasta ransomware.

files in order to spread additional malware.

Why did cybercriminals suddenly adopt this new

When first detected in December 2022, OneNote

vector? It was only after several of their previous go-to

files as attack vectors only accounted for a couple ofattack avenues turned into dead ends. First, Microsoft

hundred detections. Compared to that, the number

disabled VBA macros in Office files that come from theof attacks utilizing this approach from January tointernet, closing a loophole abused for years. Attackers

May 2023 grew dramatically, increasing to a total ofthen tried to shift to ISO and password-protected

Detection trend of weaponized OneNote files seen in ESET telemetry in H1 2023

EXPERT COMMENT
If the scenario of VBA macros repeats itself, OneNote files will become significantly lessattractive for mass spread campaigns, and cybercriminals will again start looking for new
ways to compromise the devices of their victims. However, the limited rollout that excluded
the web version, Windows 10, macOS, and mobile platforms from the stricter settings may
still leave an interesting attack surface for some cybercriminals who will decide to keep
weaponized .one files in their arsenal.
Dušan Lacika, Senior Detection Engineer

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

A “protected” OneNote notebook, requesting the victim to double-click a View button

A malicious VBScript hidden underneath the notification redirecting to the attacker’s server

ZIP files, which had bugs in their mark-of-the-web propagation, yet these

Also, OneNote by default displayed a pop-up warning that informed ofwere quickly fixed, reigniting the hunt for new vectors once again.

the potentially malicious nature of the embedded content. Unfortunately,

What made OneNote files so attractive to the attackers was that while

documented by the years of abuse of the “Enable macros” banner in Officeserving as a digital notebook, the app also allows users to embed other files

documents and by the cookie notices on websites, most users don’t pay

directly into the documents and open them with a simple double-click. Whileattention to such warnings and proceed anyway.

this functionality is commonly used to drag-and-drop spreadsheets and/or

To tighten OneNote security, Microsoft decided to disable 120 fileother documents to amend written notes, malicious actors found it usefulextensions if embedded in a OneNote file, effective since April 2022. The

when embedding their malicious code, such as VBScripts and HTA files.

displayed notification had also been updated, informing users that their

To mask their nefarious intentions, attackers created the illusion of“administrator has blocked their ability to open this file type in OneNote”.

protected content in the background, prompting the victim to doubleclick a View button to access it. Behind the button prompt was a malicious
script or a file that accessed a remote site online and downloaded a bundleof further malware and a decoy document displayed to the victim.
As this new vector emerged, administrators could mitigate OneNotethreats by disabling a selected group of or all embedded attachments in.one files.

Admins have the option to reenable these extensions via Office policies, if
they have a specific use case in their environment. However, it is important
to note that at the time of writing, this change only affects the OneNote
for Microsoft 365 and OneNote in retail versions, but does not apply to theAndroid, iOS, Win 10, and web versions of OneNote.

About ESET

H1 2023 | 15

OneNote warning informing the user of the risks associated with running the embeded content

RECOMMENDATIONS• Using the latest version of the Windows operating system
ensures that the attachments with 120 potentially risky
extensions in .one files are disabled by default.

• If there is no use case in the organization, set mail servers toblock email messages with attached .one files.

• Administrators running OneNote versions that are excluded fromthe stricter rule setting must install the Microsoft Office group
policy templates and use these to disable embedded attachments
and specific extensions in OneNote documents. Based on theprevious attacks, the suggested file extensions to block are .js,
.exe, .com, .cmd, .scr, .ps1, .vbs, and .lnk.

• A reliable multilayered security solution can detect and block
malicious activity stemming from .one files.

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Email threats Web threats Scams Phishing

Email threats see
a sextortion scam
comeback
The past half year saw a rise in sextortion scams and phishing.
Among email threats, the most remarkable growth

DOC/Fraud.AAW, which we observed demanding

rate observed in H1 2023 was the 201% leap in

USD 1550 worth of Bitcoin in return for not divulging

DOC/Fraud detections, primarily affecting Japan, Spain,

the sexual content the attacker claimed to haveand France. This family covers mainly Microsoft Word

recorded via the victim’s camera. Subsequent top

documents with various types of fraudulent content,

variants were ATT and ADJ, which are similar scams

distributed via email attachments. Due to an increaseclaiming to have stolen data including sexual content.

in sextortion scams, detections returned to levels notseen since 2021.
claiming to have installed malware on the recipient’s

and was then emptied. Another remained utterly

computer that enables them to gather data of a sexual

empty.

The top variant of this family in H1 2023 was

About ESET

38.2%

Win/Exploit.CVE-2017-11882 trojan

12.2%

DOC/Fraud trojan

10.1%

HTML/Phishing trojan

7.5%

MSIL/TrojanDownloader.Agent trojan

3.4%

HTML/Phishing.Outlook trojan

2.9%

HTML/Fraud trojan

2.7%

PDF/Phishing trojan

2.1%

HTML/Phishing.Microsoft trojan

1.7%

VBA/TrojanDownloader.Agent trojan

1.7%

Top 10 email threats detected in H1 2023

Even with sometimes no financial gain in sight, thefamily ranked third among all email threats detected byour email scanners.

H1 2023 | 16

HTML/Phishing.Agent trojan

among these extortion demands successfully garneredover 0.08 Bitcoin, currently worth over USD 2,000,

an empty threat.

About this report

At the time of writing, one Bitcoin address observed

In a sextortion scam, fraudsters send an email

nature – such a claim should be confidently ignored as

Research publications

DOC/Fraud detection trend from January 2021 to May 2023

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 17

Holding steady as the top email threat in H1 2023,

This peak was driven by two variants: DTS, which first

Homing in on brand-specific phishing threats, HTML/

Tracked as PDF/Phishing, the abuse of PDF

HTML/Phishing.Agent accounted for 38% of detections.

appeared that day, and BRZ.

Phishing.Outlook returned to the top 10 email threats

attachments for phishing also grew substantially, by

list, taking the sixth position after a 30% increase

88%, placing it eighth in the top 10 email threats list.

over the previous half year. The most prevalent

A top variant in H1 2023 consisted of a link in a PDF

variant was AQ, which we saw spreading as an email

document that navigates to a login page in Italianattachment called Remittance_230323.htm. Opening

asking for account details. Another top variant was

this attachment in a browser prefills the username

a PDF document posing as a notice from American(the same as the email recipient) and exfiltrates any

Express with a Verify Here Now button that leads to acredentials provided by the victim via a legitimate but

phishing website.

This detection name refers to malicious HTML
documents sent as email attachments. Opening suchan attachment in a web browser opens a phishing sitethat typically poses as a banking, payment, or social
networking provider. Most detections in the current
reporting period were in Japan, the United States, andthe United Kingdom.
While the current top variants of this family all
decreased, on March 22, 2023, the family reached a
new peak that has not been seen as far back as 2021.

HTML/Phishing.Agent detection trend from January 2021 to May 2023

HTML/Phishing.Agent.DTS is a weak attempt atphishing for Microsoft Outlook credentials using anemail without body text and an attachment called
RemittanceAdvice.html. Opening this HTML file in abrowser displays an Outlook login form lacking styling.
HTML/Phishing.Agent.BRZ is a Microsoft 365 phishing
threat we observed spreading as an email attachment
called DepositRemittance.html. Opening this
attachment in a browser displays an Office 365 login
page with the username prefilled.

compromised website (advertising travel in Greece).

ESET THREAT REPORT

Executive summary

Phishing threats also contributed to the growth of
web threats. In H1 2023, the number of blocked web
threats increased by 31% compared to the previous halfyear. This increase was partly due to the 125% jump inphishing blocks, although scam blocks were the main

Foreword

Threat Landscape Trends

Threat Telemetryor scam products. One last specimen is asxcnx[.]com,
a domain that was seen redirecting to tech support
scam sites and pages abusing Netflix branding to phishfor payment card details.

Research publications

About this report

About ESET

H2

growth contributor.
Interestingly, several spikes in our web threat data for
H1 2023 revealed a common theme: threat actors are
placing malicious domains into redirect chains usedby advertisements on legitimate websites. Web pages
at such domains sometimes act legitimately, but atother times turn malicious, aggressively pushing scams,
malvertising, phishing, and other suspicious content to
website visitors.
Racking up over 57 million blocks, one example of amalicious domain is pogothere[.]xyz, which was
still alive at the time of publication. This domain can

Phishing and scam block trends in H1 2023, seven-day moving average

be found in ad redirect chains on shady sites offeringcracked software or game hacks.
Another example is 123w0w[.]com, which was foundleading to a landing page masquerading as a YouTube
video player that requests the download of a plugin toplay the video.
Yet another case is viixikup[.]com. Usually, thisdomain redirects to a potentially unwanted or harmfulsite that harasses visitors with aggressive advertising
A landing page for asxcnx[.]com that impersonates Netflix in German

H1 2023 | 18

H1

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 19

Exploits Attack vectors SQL attacks

Microsoft SQL Server: An increasingly
attractive target for brute-force attacks
MSSQL password guessing attacks take a nasty upturn; Log4Shell exploitation attempts
continue their endemic growth.
Microsoft SQL (MSSQL) Server has gained renewedinterest among cybercriminals as an initial accessvector. ESET telemetry data shows a rising trend inblocked password guessing attempts against MSSQL
from 940 million in H2 2022 to 1.7 billion in H1 2023.
This growth is set against a backdrop of a decline
in password guessing attacks against other popular
services, such as Remote Desktop Protocol (RDP), from
17.9 billion to 15.8 billion, and Server Message Block(SMB) protocol, from 469 million to 399 million.
In H1 2023, as usual, the most popular network
intrusion method tried by external actors was
password guessing, followed by Log4Shell exploitation.
Compared to H2 2022, the list of top external network
attack vectors remains unchanged. However, thegrowing trend of MSSQL attacks in the password
guessing category deserves a closer look.

MSSQL brute-force attacks
MSSQL is a relational database management system

H2popular in corporate environments. If this server ismade accessible via the internet, it listens by default
for TCP connections on port 1433, thus making thisport a prime target for brute-force attacks. Obviously,
legitimate database users should authenticate before
being allowed to access any data. While we hope thatstrong and unique passwords are being used to deter
intruders, the persistent efforts of cybercriminals tofind exposed MSSQL services that are poorly secured
are sometimes rewarded.
On April 17, 2023, AhnLab researchers reported
spotting Trigona ransomware (detected by ESET
security products as Win32/Filecoder.OLC) on an
MSSQL server that could easily be accessed by guessing

Detection trend of MSSQL attack attempts, seven-day moving average

H1

+85%

ESET THREAT REPORT

Executive summary

H2

Foreword

Threat Landscape Trends

Threat Telemetry

H1

Trends of RDP, SMB, and SQL password guessing attempts, seven-day moving averagevalid credentials.
Our data shows that the absolute count of MSSQL
attacks increased by 84% between the past two halfyear periods.
Considering that Microsoft has been tightening up
the security policies around opening macro-enabled
files and, starting in 2023, files with one of a multitudeof dangerous file extensions used by OneNote,cybercriminals may be looking at MSSQL and otherintrusion vectors more closely.
Geographically, most MSSQL brute-force attacks in H1

2023 were directed at services in Turkey, the USA, andPoland. It should be kept in mind that any geographicaldata based on IP addresses is probably affected by theuse of VPNs, rented servers, and proxy services.
Despite the rise of SQL attacks, it should be noted that
RDP brute-force attacks consistently take the lion’sshare of password guessing attempts, accounting
for an average of 87 million attacks per day in ourtelemetry data. However, the RDP attack trendline
continued the decline seen since 2022. The SMB attack
trendline followed suit.

Research publications

About this report

About ESETEXPERT COMMENTWith the rise of brute-force
attacks against MSSQL, databaseadmins should be reminded of
the security benefits of Windows
Authentication mode over mixed
mode when setting up the databaseengine. In Windows Authenticationmode, SQL Server Authentication isdisabled, compelling database users
to connect through their Windows
user account, which can beprotected with an account lockout
policy that effectively stops bruteforce attacks from progressing.
If you can’t avoid using mixed mode,
make sure passwords are strong andput the database behind a firewall
or VPN, if possible.
Ladislav Janko, ESET Senior
Detection Engineer

H1 2023 | 20

Log4Shell
The Log4Shell vulnerability continues to land secondin the external intrusion vector ranking. Patches havebeen available for the flaw since December 2021, yet
the graph of exploitation attempts shows a rise of 16%
in H1 2023.
While many countries experienced a growth in attacks
compared to H2 2022, Poland stands out with an
explosion of growth, seeing over triple the average
number of daily attacks since mid-September.
Two days after Log4Shell exploitation attempts peaked
on February 7, 2023, CISA warned that North Koreaaligned ransomware operators had been targeting
healthcare systems in South Korea and the USA. One of
the techniques used to gain access to victims’ networks
was the exploitation of Log4Shell. AhnLab researchersreported that Lazarus, a North Korea-aligned group,
was also exploiting this vulnerability. North Korea
seems to be a hotbed of Log4Shell exploiters.
Due to the continued and frequent exploitation
attempts of Log4Shell, on May 1, 2023, CISA added
CVE-2021-45046, discovered after the incomplete fix of
CVE-2021-44228, to its Known Exploited Vulnerabilities
Catalog. Our data on Log4Shell exploitation attempts
does not distinguish between these CVEs. Since it is
not possible to inspect encrypted network traffic for
additional exploitation attempts, anyone still using

ESET THREAT REPORT

H2

Executive summary

Foreword

Threat Landscape Trends

H1
+15%

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 21

a vulnerable version of the Log4j library is urged to

Who might be carrying Spring4Shell exploits in their

update rather than hope that attackers attempt totoolkit? In December 2022, Fortinet researchers

exploit the vulnerability via plaintext.

published an analysis of a new botnet called Zerobot.

Spring4Shell
Although Spring4Shell attacks have not returned

While a Log4Shell exploit is not present within the listof 31 exploits in Zerobot’s arsenal, a Spring4Shell exploit
is featured.

to their pre-May-2022 levels, a steady rise has been
observed in H1 2023, a 50% increase compared to theprevious half year. The spike observed on January 6,2023 was mainly due to increased detections in theUSA, the UK, and China.
Detection trend of Log4Shell exploitation attempts, seven-day moving average

H2

H1

+81%

Detection trend of Log4Shell exploitation attempts in Poland, seven-day moving average

H2

H1
+49%

Detection trend of Spring4Shell exploitation attempts, seven-day moving average

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Infostealers Malware-as-a-Service

Research publications

About this report

About ESETRedLine Stealer:
Malware as a business

MSIL/Spy.AgentTesla trojan

A look at the infamous RedLine infostealer, which recently faced disruption by ESET Research.

PHP/Agent backdoor

2.2%

MSIL/Spy.RedLine trojan

2.2%

Win/Korplug backdoor

2.0%

RedLine Stealer has been gaining notoriety ever sinceten statistics: MSIL/Spy.AgentTesla, Win/Formbook,its discovery in 2020 by Proofpoint. Detected by ESET

and MSIL/Spy.Redline. The three families together

products as MSIL/Spy.RedLine, this infostealer-for-made for more than half of the top ten infostealer

hire, readily available on underground forums, usuallydetections, with their numbers counting in the

makes the news every couple of weeks . In April 2023,

hundreds of thousands.

the news was positive for once: while investigating
the malware with Flare Systems, ESET researchers
managed to temporarily disrupt part of RedLine
Stealer’s operations.

In general, MaaS is a premade malware solution thatcan be leased by cybercriminals. In exchange for theircan be made into a sustainable (albeit extremely

brings malware access to criminals who would notillegal) business. Thus malware-as-a-service, or MaaS,

ordinarily be able to code a sophisticated solution

came into existence: threat actors decided to turnthemselves, thereby contributing to the proliferation of

their malware into products that can be offered formalicious campaigns.

prevalence of MaaS among cybercriminals – in H1 2023,
there were three MaaS families in our infostealer top-

Win/Formbook trojan

8.6%

PHP/Webshell backdoor

7.7%

MSIL/Spy.Agent trojan

4.4%

Win/HoudRat trojan

3.1%

ASP/Webshell backdoor

2.9%

Win/PSW.Fareit trojan

2.9%

Top 10 infostealer families in H1 2023 (% of Infostealer detections)

H2

H1
-16%

the malware itself, but also to botnets and customer
service provided by the MaaS creators. This approach

look at ESET telemetry data readily demonstrates the

19.3%

payments, the clients often gain access to not only

Many threat actors realized long ago that malware

a fee and produce a steady source of income. A quick

H1 2023 | 22

Lately, one particular MaaS variant has risen inprominence – RedLine Stealer. After its discovery
in 2020, it soon became one of the most prevalent

RedLine Stealer detection trend in H2 2022 and H1 2023, seven-day moving average

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

infostealer families in our telemetry. MSIL/Spy.RedLine

used to manage their campaigns. These control panels

first made the list of top ten infostealer detections inhave a full graphical interface, making deploying theH2 2022 and managed to stay there in H1 2023 despite

malware to victims easier. To work properly, the panels

a decrease in total detection numbers, placing ninth.

communicate with the spyware’s backend, which isThis piece of malware can be bought on underground

Since the affiliates get a ready-made solution, they canrelatively low monthly subscription fee (reported

quite easily integrate it into larger malicious operations.

as USD 150 per month), it can be used to steal a

As such, the malware has been used in several notablewide range of information. From passwords, tocampaigns. In H1 2023 alone, it took advantage of thecryptocurrency wallet information, to saved data from

AI boom by posing as free downloads of ChatGPT and

Steam and Discord, RedLine operators aim to satisfy all

Google Bard. These were being spread via malicious

their customers’ nefarious needs.

ads on hijacked Facebook business pages. CronUp

access to the malware’s control panel, which is thenAbout this report

About ESET

Affiliate

VictimOperatorbuys license fromoperates

accessesmanages

discovered that in another series of attacks leveraging
advertising, RedLine was distributed via Google Ads

Control
panel
serverVictim’smachineBackendservers

runs

executes

exfiltrates
data toruns

authenticates to

RedLinecontrol panel

RedLinebackend

RedLine operation overview

alongside Ursnif, and potentially Cobalt Strike andransomware. As uncovered by Avast, this infostealer
was also used in a highly targeted phishing campaignthat abused Adobe Acrobat Sign: select recipientswere sent emails with attachments masquerading
as the signing service; however, the attachments
actually contained links that eventually led to ZIP files
containing RedLine.
As detailed by Flare Systems in a joint presentation
with ESET at Botconf 2023, RedLine Stealer distribution
methods vary as much as its campaigns. In addition to
the already mentioned Google Ads and spearphishing,
this spyware has also been spread through links, ads
or comments in YouTube videos, and through public

RedLine panel login prompt

H1 2023 | 23

controlled by the actual RedLine operators.

forums or Telegram channels. In exchange for a

RedLine’s paying clients, referred to as “affiliates”, get

Research publications

stealer log samples. The malware infiltrates the victim’s

STEALER LOGS
Stealer logs are large collections of data
stolen by infostealers that are usually
hosted in the cloud. These logs containmainly user credentials, but other typesof sensitive information can be foundthere as well, such as cookies, document
scans, and bank account payment details.
These logs are sold and distributed onunderground forums and marketplaces.

ESET THREAT REPORT

Executive summary

system disguised as, among other things, Windows 11
upgrades, cracks for video games or other software,
mobile app clones, and popular applications such as
Visual Studio.

Foreword

Threat Landscape Trends

Threat Telemetry

months of December 2022 through March 2023, ourresearchers have determined that RedLine control

they had, during a joint investigation with researchers

Netherlands. Each of the three countries hosted close

at Flare Systems, discovered several GitHub repositories

to 20% of the total number of RedLine C&Cs. ESET also

used as RedLine control panel dead-drop resolvers. In

found a significant number of the spyware’s control

total, ESET found four such repositories, which were

panels at IP addresses located in the USA and Finland,

then all taken down with GitHub’s help:

with both countries hosting around 10%.

github[.]com/lermontovainessa/Hub

As opposed to hosting control panels, the countries

github[.]com/arkadi20233/hubthat had to endure the most RedLine attack attempts

The control panels used information stored in thedead-drop resolvers to access RedLine’s backend
servers. Since there were no fallback channels, theremoval of the repositories broke the authenticationof the RedLine control panels that were in use at
the time. Even if our action did not affect the MaaS
backend, it still worked as a temporary disruption,
because it forced the operators to distribute newversions of the panels.
Apart from the GitHub repositories, our researchers
also found code-signing certificates that were used
to sign RedLine control panels. The certificates wereassigned to RAIL AND CIVILS LTD and AMERT, LLC, andAbout ESET

Based on parsing our telemetry data for thepanels are hosted mainly in Russia, Germany, and thegithub[.]com/MTDSup/updateResolver

About this reportwere revoked after we reported them.

In April, ESET researchers revealed on Twitter that

github[.]com/ivan123iii78/hub

Research publications

over the same time period were mainly Peru (15%),

20%

0%

Geographic distribution of RedLine Stealer panels in December 2022–March 2023

Mexico (6%), and Poland (5%).
While ESET researchers managed to inconvenience
RedLine’s operators by removing the repositories withthe dead-drop resolvers, we can nevertheless be surethat we haven’t heard the last from this notorious
infostealer. Even if RedLine were to suddenly disappear,
many actors would be eager to take its place.

15%

Case in point: there seems to be a RedLine competitor
currently trying to establish itself. In 2022, malware

0%

named META was announced on cybercrime forums,
claiming to be a better alternative to RedLine. It
remains to be seen whether malicious actors decideto switch to the new malware, but the latest statistics
point towards that being a way off yet.

Geographic distribution of RedLine Stealer detections seen by ESET telemetry in December 2022–March 2023

H1 2023 | 24

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 25

macOS Supply-chain attacks

macOS affected by the first case of twolinked supply-chain attacks
One of the spikes observed in macOS detections reveals the first case of interconnectedsupply-chain attacks, compromising a significant number of macOS devices.
Supply-chain attacks – which involve threat actors

platform are of Potentially Unwanted Applications

adding malicious code to software, which is then

(PUAs); in H1 2023, PUAs accounted for 49.3% of all

distributed to unsuspecting users via legitimate means

macOS detections. In fact, one of the spikes visible– have become a significant concern in the worldin the ESET telemetry for mid March occurred whenof cybersecurity. In March 2023, the Windows and

PUA detection was extended to include additional

macOS platforms were affected by the culmination of

applications.

the first recorded case of two interconnected supplychain attacks, when initially the infamous Lazarus
group tainted the X_TRADER software, which later
enabled a second Lazarus intrusion, with the group
compromising 3CX phone system apps and theircustomers.
The macOS ecosystem, due to its nature and smallermarket share, is generally exposed to fewer malware
attacks than Windows. According to ESET telemetry,overall macOS detections have been slowly decreasing
for some time and most of the detections seen on thisH2

It is therefore unusual to see a supply-chain attack
leaving a visible mark in macOS detection trends, but
it was the case at the turn of March and April. This
attack is also among the reasons why trojan detections
grew by 16.8% in H1 2023 and accounted for 11.2% of all
macOS detections, according to ESET telemetry.
In late March, it was discovered that both the Windows
and macOS applications developed by 3CX contained
malicious code. 3CX offers a phone system that utilizes
voice over Internet Protocol (VoIP) to make and receive

macOS detection trend in H1 2023, seven-day moving average

H1
-16%

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

phone calls instead of traditional phone lines, and canpresence of the malicious application in our telemetry

be accessed via 3CX’s apps. The malicious code added

until February 14, 2023. Later on, the spike appearing

to these applications enabled the attackers to taketowards the end of March shows that ESET telemetry

control of any computer that had these compromised

started to record a marked increase in detections ofapps installed. It was quickly determined that 3CX wasthe compromised 3CX app for macOS, primarily in

not responsible for adding the harmful code to its apps;

Germany, the United Kingdom, France, the Unitedrather, its software build chain was compromised,

States, and Canada.

leading to the supply-chain attack.

Research publications

About this report

About ESET

H1 2023 | 26

This supply-chain attack was orchestrated by external

The details surrounding the affected systems running

threat actors with the goal of distributing additional

macOS were extensively covered in a Twitter threadmalware to specific 3CX customers. ESET Research,

and a blogpost by Patrick Wardle. Analysis of thealong with other security researchers, strongly believes

trojanized 3CX macOS application, recognized by ESET

that the attack was conducted by Lazarus, a well-as OSX/NukeSped.P, revealed it had been digitally

known and sophisticated North Korea-aligned group.

signed in late January; we did not, however, detect theHeatmap of ESET detections of the compromised 3CX app for macOS; detections of the second-stage malware served by Lazarus are marked in red

Detections of OSX/NukeSped.P, seven-day moving average

The additional malware served by Lazarus toOn the same day ESET researchers published theirselected 3CX customers using their trojanized macOS

findings attributing the attack to Lazarus, 3CX andapplication was observed in ESET telemetry only

the company responsible for the incident response

in a small number of cases, in France and Chile;of this compromise disclosed that the 3CX supply-

ESET products detect this as OSX/NukeSped.Q.

chain attack was enabled by another supply-chain

Although indications of the macOS second-stage

attack. This occurrence marks the first recorded

payload were present in ESET’s telemetry as early as

instance of two interconnected supply-chain attacks,

February, our researchers did not possess the sample

with one attack facilitating the other. The precedingor metadata that would have signaled its malicious

attack targeted Trading Technologies, specificallynature. It appears that the second-stage malware

its decommissioned X_TRADER software version

for both Windows and macOS specifically targeted

r7.17.90p608, which was installed by a 3CX employee

cryptocurrency companies.

on a personal machine. Trading Technologies currently
offers a range of products and services for electronic

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 27

trading of various investment categories, including

THE LAZARUS GROUP

trading of cryptocurrencies.

Lazarus has been active since atleast 2009 and has been responsible
for significant incidents such as theSony Pictures Entertainment hack,multimillion-dollar cyberheistsin 2016, the WannaCryptor(aka WannaCry) outbreak in
2017, and a history of disruptive
attacks targeting South Korean
infrastructure. ESET Research’s
discovery of a new Lazarus Linux
payload further solidified theconnection between this threat
actor and the 3CX compromise.

and tools for financial institutions and professional

X_TRADER provided advanced trading capabilities
traders. Even though Trading Technologies stopped all
support of this software in April 2020 and announced
its retirement date as far back as September 2018,

3CX Windows app

the 3CX employee installed its tainted version on an
undisclosed day in 2022. ESET telemetry detected two
instances of the malicious X_TRADER installer in 2022
– one in August in the United Kingdom and anothercompromises

one in December in the United States.

LazarusThe series of high-profile supply-chain attacks, ranging
from WIZVERA VeraPort (where Lazarus was also
involved), to NotPetya and SolarWinds, to the recent

April 2020

installed by

X_TRADER software by
Trading Technologies

3CX employee

3CX macOS app

Late 2021

2022

2023

X_TRADER end-of-life

3CX/Trading Technologies incident, underscores thatin recent years, the threat landscape has expanded
beyond traditional targets such as individual computersand networks. It reveals the growing complexity ofsoftware development and distribution and the factthat organizations are increasingly reliant on thirdparty software and hardware providers. These factors
have created opportunities for malicious actors to
exploit trusted relationships and evade traditional
defense mechanisms, as these attacks can be highly
effective and difficult to detect. The 3CX supply-chain
attack especially indicates that no platform is safe fromthis attack vector.

compromise spreads toSimplified diagram of linked supply-chain attacks

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 28

Ransomware

Same code, different ransomware? Leaks
kick-start myriad of new variants
Leaks allow more criminals to try their luck with ransomware yet make preexisting detections increasingly effective against
emerging malware.
Recently, several notorious ransomware families such as Babuk, Conti, andBuhti ransomware gang is one of the new players that made use of the

LockBit 3.0 have published or seen their source code leak into the public

published LockBit 3.0 Black when building its Windows-oriented variant.

domain. This fueled the launch of a myriad of new malware variants andOlder code from LockBit 2.0 has also been seen in a mix with Babuk infamilies, with significant code overlaps. While this makes it increasingly

another emerging ransomware family named Rorschach.

simple for amateurs to start ransomware of their own, it may also help the
defenders – despite muddying the waters on the scene.

Even ransom notes aren’t what they once used to be. While in the pastthis had been a staple of each threat actor, currently criminals increasingly

The source code for Babuk, aka Babyk, is a prime example of thismimic and inspire each other, blurring the lines even more. While thephenomenon. Since the group made its code public domain in September

dropped TXT file might help identify the ransomware strain at play, seeing

2021, it has become a prominent go-to basis for new ransomware strains.

this ransom demand also means that user data has already been encrypted.

What makes it attractive for cybercriminals is its ability to attack Linux and
VMWare ESXi systems. Notable emerging families using Babuk as theirbase included RAgroup, Nokoyawa, Buhti, and Rorschach.

Source-code sharing and similar ransom notes might complicate public
tracking of the ransomware, but it also enables defenders to use a moregeneric or well-known set of detections and rules to identify the threat

Another example of code that was recently published – allegedly by aactor activity. Using these can thus cover a wider range of variants,

disgruntled insider – was the “builder” of LockBit 3.0 ransomware. This

including newly emerging ones.

malware family itself is built upon previously leaked source code, with
LockBit 3.0 Black and Green variants being based on Black Matter andConti, respectively.

Looking into ESET telemetry, ransomware detections between H2 2022
and H1 2023 increased by over 10%. However, this trend is skewed by a large

BABUK RANSOMWARE OVERVIEWBabuk (or Babyk) ransomware was discovered in 2021 asa further development of Vasa Locker. It made its nameby attacking large enterprises, but its most prominent
victim was Washington D.C.’s Metropolitan Police
Department. The gang claimed to have obtained 250
GB of data from the agency and threatened to publish
it unless USD 4 million was paid. However, this has
significantly increased focus of other law enforcement
agents on the gang, which subsequently led to it closing
shop and splitting. The source code – including Windows,
NAS and ESXi variants of the malware – was published in
September 2021 and has become one of the go-to bases
for new ransomware strains.

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

number of Win/Filecoder.BlackBasta detections observed on a single day

MoneyBird

in a single network space in the USA. Omitting that spike, the number of

An Iranian-aligned threat actor called Agrius is deploying a new fauxransomware attacks remained almost identical in both periods.

ransomware variant called MoneyBird to destroy victims’ data. It is a

It is important to note that this detection trend only includes instances

continuation of previously documented wiper campaigns that target

where ESET encountered ransomware as the final payload. Attacks

Israeli victims.

detected at an earlier stage – such as a brute-force attack; exploitation

MortalKombatof a vulnerability; malspam; or an attack of a dropper, downloader, orOperators behind this malware family conduct brute-force attacks against

infostealer – are not part of the ransomware data set.

NOTABLE NEW PLAYERS
Buhti
This ransomware family has a variant for both Windows and Linux systems,
each of them built upon different leaked source code. For Windows, it usesa modified LockBit 3.0 builder and for Linux (and potentially VMWare ESXi)
the “open-sourced” Babuk code.

exposed remote desktop accesses on port 3389 and deploy as a bundle
with a clipper called Laplas.
RAgroup
RAgroup ransomware is based on the leaked Babuk source code, andtargets mostly businesses in South Korea and the United States. It uses
intermittent encryption, encrypting only part of the targeted file and thus
speeding up the process (see White Phoenix, in the next column). The
operators of RAgroup also attempt to sell the stolen data via their leak site.

About ESET

H1 2023 | 29

ARRESTED/CLOSED SHOP/KEYS RELEASED:DECRYPTED: Hive ransomware
One of the most active ransomware gangs, known as Hive, had its systems
infiltrated, and later disrupted, by law enforcement agents. The action was
spearheaded by German, Dutch, and US authorities, with support from
Europol and 13 countries. Hive’s servers and dark-web leak site were seized.
According to the involved agencies, the takedown saved approximately
USD 130 million in ransom and produced decryption keys for past victims.
No arrests were made.
DECRYPTOR: White Phoenix
Encrypting data takes time and is loud enough to attract defenders’attention. To avoid that scenario, ransomware gangs recently started using
intermittent encryption, encrypting only parts of the targeted data. A new
decryptor called White Phoenix is taking advantage of that approach,recovering a limited set of file formats. While imperfect, in some cases, it

CactusRorschachmight be enough to help some victims decrypt key pieces of data and avoid

Cactus ransomware exploits known vulnerabilities in VPN devices to gain

Rorschach is one of the fastest encryptors on the ransomware market

paying the ransom.

today, with a high level of customization and similarities with Babuk,

DECRYPTOR: MegaCortex ransomware

initial access. Subsequently, it extracts the ransomware binary from a
password-protected 7-Zip archive, effectively using encryption to evadedetection. This is a known technique used already by the WannaCryptor(aka WannaCry) family in 2017.
MalasLocker
An odd new player in the ransomware arena is MalasLocker. Its operators
demand that the victim pays the ransom in the form of a donation to an
attacker-approved non-profit organization.

Lockbit 2.0, Yanlouwang, and DarkSide.
Trigona

In H1 2023, a new MegaCortex ransomware decryptor has been released.
This standalone tool can automatically find and recover affected data

Trigona ransomware uses brute-force attacks against exposed Microsoft

on a vicitm’s system. MegaCortex was mostly known for its activities in

SQL servers to gain access and subsequently to install ransomware to2019, but it became inactive in 2020. In October 2021, Europol arrested 12

encrypt victims’ data.

individuals responsible for 1,800 ransomware attacks, who deployed several
ransomware strains, including MegaCortex.
DECRYPTOR: ESXiArgs Ransomware
CISA released a recovery script for the ESXiArgs ransomware. This family

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

propagates mostly via exploitation of known vulnerabilities in unpatched,

BOUNTY LockBit, Babuk, Hive

out-of-service, or out-of-date VMware ESXi servers. According to CISA,The US authorities have charged Mikhail Pavlovich Matveev – a criminal

threat actors behind the strain have compromised over 3,800 servers
globally, encrypting their configuration files thus rendering the virtual
machines unusable.
SENTENCE: A Russian pled guilty to helping Ryuk
Denis Dubnikov, a Russian national involved in money laundering for Ryukransomware, has been sentenced by a US court to no jail time except forthe period he already served. On top of that Dubnikov must pay a financial
penalty of USD 10,000 and a forfeit USD 2,000. While similar offenses canpossibly lead to as much as 20 years in prison, the court decided to release
Dubnikov on parole after his recent guilty plea.
SANCTIONS: Affiliates of TrickBot, Ryuk, Conti
In February, the USA and the UK issued historical first joint cyber
sanctions aiming at seven individuals affiliated with attacks of TrickBot
malware and Ryuk and Conti ransomware. As a result, any property of the
sanctioned persons in the USA and the UK must be blocked and reported
to the authorities. The same is true for all dealings between citizens of bothcountries and the designated individuals.
ARREST: DoppelPaymer gang
In February, law enforcement agents raided three locations in Germany
and Ukraine, targeting two individuals suspected of being core membersof the DoppelPaymer ransomware gang. Three additional arrest warrants
were issued by the German authorities aimed at the “masterminds behindthe criminal group”. In Germany alone, the DoppelPaymer gang attacked 37
companies including a hospital in Düsseldorf. The US victims of the groupare known to have paid at least EUR 40 million between 2019 and 2021.

with ties to LockBit, Babuk, and Hive ransomware, and who is believed to
be operating from Russia – over cyberattacks against critical infrastructure.
A USD 10 million bounty has also been issued for information that would
lead to his capture. Overall, victim ransom payments to those three gangs
amount to USD 200 million, with ransom demands being twice as high.

About ESET

H1 2023 | 30

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

ThreatTelemetry

Research publications

About this report

About ESET

H1 2023 | 31

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

All threats

H1

H2

-7%

10%

0%

Overall threat detection trend in H2 2022 and H1 2023, seven-day moving average

HTML/Phishing.Agent trojan

Geographic distribution of malware detections in H1 2023

27.1%

Win/Exploit.CVE-2017-11882 trojan

8.3%

DOC/Fraud trojan

7.0%

HTML/Phishing trojan

6.0%

JS/Agent trojan

4.7%

LNK/Agent trojan

2.8%

MSIL/TrojanDownloader.Agent trojan

2.5%

PDF/Phishing trojan

2.1%

HTML/Phishing.Outlook trojan

2.0%

HTML/Fraud trojan

1.9%

Top 10 malware detections in H1 2023 (% of malware detections)H1 2023 | 32

ESET THREAT REPORT

Android

Executive summary

H2

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1
+20%

11%

0%

Detection trends of selected Android detection categories in H2 2022 and H1 2023, seven-day moving average (trends of Clickers, Cryptominers,
Ransomware, Scam apps, SMS trojans, and Stalkerware are combined in the trendline Other)

Android/TrojanDropper.Agent trojan

31.7%

Android/Agent trojan

8.7%

Android/Hiddad trojan

6.8%

Android/AdDisplay.MobiDash PUA

6.6%

Android/Andreed trojan

6.4%

Android/Spy.Agent trojan

5.4%

Android/AdDisplay.Fyben PUA

5.0%

Android/Obfus trojan

4.3%

Android/Snaptube PUA

2.0%

Android/SpyLoan PUA

1.6%

Top 10 Android detections in H1 2023 (% of malware detections)Geographic distribution of Android detections in H1 2023

H1 2023 | 33

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESETCryptocurrency threats

H2

H1

-31%

8%

0%

Cryptocurrency threat detection trend in H2 2022 and H1 2023, seven-day moving average

Win/CoinMiner PUA

40.0%

Win/CoinMiner trojan

15.8%

JS/CoinMiner PUA

12.8%

NSIS/CoinMiner trojan

7.8%

BAT/CoinMiner trojan

5.1%

MSIL/CoinMiner PUA

3.9%

JS/CoinMiner trojan

2.9%

WASM/CoinMiner PUA

2.8%

MSIL/CoinMiner trojan

2.5%

Win/Spy.Agent trojan

Geographic distribution of Cryptocurency threat detections in H1 2023

1.2%

Top 10 Cryptocurrency threat detections in H1 2023 (% of malware detections)H1 2023 | 34

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 35

Downloaders

H2

H1

1.1%

2.3%

-60%

MSIL

5.1%
7.3%

29.0%

Win
VBA
DOC

7.8%

JS
PowerShell

8.7%

VBS
14.8%

9.5%
14.3%

Downloader detection trend in H2 2022 and H1 2023, seven-day moving average

Downloader detections per detection type in H1 2023

MSIL/TrojanDownloader.Agent trojan

25.4%

VBA/TrojanDownloader.Agent trojan

14.3%

DOC/TrojanDownloader.Agent trojan

9.4%

PowerShell/TrojanDownloader.Agent trojan

7.8%

VBS/TrojanDownloader.Agent trojan

7.2%

Win/TrojanDownloader.ModiLoader trojan
JS/Danger trojan

11%

6.5%
3.0%

JS/TrojanDownloader.Nemucod trojan

2.5%

Win/TrojanDownloader.Delf trojan

2.5%

JS/TrojanDownloader.Agent trojan

2.5%

Top 10 Downloader detections in H1 2023 (% of malware detections)0%Geographic distribution of Downloader detections in H1 2023

Other
LNK
HTML

ESET THREAT REPORT

Executive summary

Email threats

H2

Foreword

H1-14%

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

HTML/Phishing.Agent trojan

38.2%

Win/Exploit.CVE-2017-11882 trojan

12.2%

DOC/Fraud trojan

10.1%

HTML/Phishing trojan

Malicious email detection trend in H2 2022 and H1 2023, seven-day moving average

H2

H1

H1 2023 | 36

7.5%

MSIL/TrojanDownloader.Agent trojan

3.4%

HTML/Phishing.Outlook trojan

2.9%

HTML/Fraud trojan

2.7%

PDF/Phishing trojan

2.1%

HTML/Phishing.Microsoft trojan

1.7%

VBA/TrojanDownloader.Agent trojan

1.7%

Top 10 threats detected in emails in H1 2023

0.5% 0.4%

+7%

7.9%

0.1% 0.01%

1.6%

Scripts
Executables

11.3%

Office documents
PDF
Archives

14.3%

Batch
63.7%

Shortcuts
Jar
Android

Spam detection trend in H2 2022 and H1 2023, seven-day moving average

Top malicious email attachment types in H1 2023

ESET THREAT REPORT

Executive summary

Email threats

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

Exploits

About this report

About ESET

H2

H1 2023 | 37

H1
-12%

13%

+85%

0%

-15%

Geographic distribution of Email threat detections in H1 2023

Trends of RDP, SMB and SQL attack attempts in H2 2022 and H1 2023, seven-day moving average

Password guessing
Apache Log4J CVE-2021-44228
19.0%

0.3%

Apache Struts2 CVE-2017-5638
SMB.DoublePulsar scan

0.5%
0.8%

42.7%

2.7%

Pulse Secure CVE-2019-11510

3.4%

Apache Spring4J CVE-2022-22963,22965

3.4%

MS IIS CVE-2015-1635

5.9%

MS RDP CVE-2019-0708 BlueKeep
MS SMB1 EternalBlue

8.3%
13.0%

MS Exchange Exploit.CVE-2021-26855
Other

External network intrusion vectors reported by unique clients in H1 2023

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

Exploits

16%

42%

0%

0%

Geographic distribution of RDP password guessing attack attempt sources in H1 2023

Geographic distribution of SMB password guessing attack attempt targets in H1 2023

13%

11%

0%

0%

Geographic distribution of RDP password guessing attack attempt targets in H1 2023

Geographic distribution of SQL password guessing attack attempt targets in H1 2023

H1 2023 | 38

ESET THREAT REPORT

Exploits

Executive summary

H2

Detection trend of Log4Shell exploitation attempts in H1 2023

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 39

Infostealers

H1
+15%

H2

H1
-16%

Infostealer detection trend in H2 2022 and H1 2023, seven-day moving average

MSIL/Spy.AgentTesla trojan

19.3%

Win/Formbook trojan

8.6%

PHP/Webshell backdoor
24%

0%

Geographic distribution of Log4Shell exploitation attempts in H1 2023

7.7%

MSIL/Spy.Agent trojan

4.4%

Win/HoudRat trojan

3.1%

ASP/Webshell backdoor

2.9%

Win/PSW.Fareit trojan

2.9%

PHP/Agent backdoor

2.2%

MSIL/Spy.RedLine trojan

2.2%

Win/Korplug backdoor

2.0%

Top 10 Infostealer families in H1 2023 (% of Infostealer detections)

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

Infostealers

H2

H1
+13%

8%

0%

Online infostealer detection trend in H2 2022 and H1 2023, seven-day moving average

JS/Agent

65.1%

HTML/Phishing.Agent

12.2%

JS/Spy.Banker
HTML/Fraud

Geographic distribution of Infostealer detections in H1 2023

9.8%
2.3%

JS/Chromex.Agent

1.3%

JS/Spy.Agent

1.2%

HTML/Agent

0.9%

PHP/Webshell

0.8%

JS/TrojanDownloader.Pegel

0.8%

HTML/Phishing.Microsoft

0.8%

Top 10 Online infostealer detections in H1 2023 (% of malware detections)7%0%

Geographic distribution of Online infostealer detections in H1 2023

H1 2023 | 40

ESET THREAT REPORTmacOS

Executive summary

H2

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1
-16%

20%

0%

macOS detection trend in H2 2022 and H1 2023, seven-day moving average

Geographic distribution of macOS detections in H1 2023

OSX/Mackeeper PUA

29.3%

OSX/Pirrit adware

9.5%

OSX/GT32SupportGeeks PUA

5.7%

OSX/Bundlore adware

5.5%

OSX/Genieo adware

4.7%

OSX/TrojanDownloader.Adload trojan

4.6%

OSX/Keygen PUsA

4.6%

OSX/BuhoCleaner PUA

3.5%

OSX/MaxOfferDeal adware

3.0%

OSX/TrojanProxy.Agent trojan

2.7%

Top 10 macOS detections in H1 2023 (% of macOS detections)H1 2023 | 41

ESET THREAT REPORT

Executive summary

Threat Landscape Trends

Foreword

Threat Telemetry

Research publications

About this report

About ESET

Ransomware

H2

H1
+10%

16%

0%

Ransomware detection trend in H2 2022 and H1 2023, seven-day moving average

Geographic distribution of Ransomware detections in H1 2023

Win/Filecoder.WannaCryptor trojan

12.2%

Win/Filecoder.BlackBasta trojan

12.0%

Win/Filecoder trojan

9.6%

Win/Filecoder.STOP trojan

9.1%

Win/Filecoder.Magniber trojan

6.8%

MSIL/Filecoder trojan

6.2%

Win/Filecoder.BlackMatter trojan
Win/Filecoder.Phobos trojan
Win/Filecoder.GandCrab trojan
Python/Filecoder trojan

3.9%
2.9%
2.7%
2.4%

Top 10 Ransomware detections in H1 2023 (% of Ransomware detections)H1 2023 | 42

ESET THREAT REPORT

Executive summary

Web threats

H2

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1
+31%

13%

0%

Web threat block trend in H2 2022 and H1 2023, seven-day moving average

H2

Global distribution of Web threat blocks in H1 2023

H1
+22%

16%

0%

Unique URL block trend in H2 2022 and H1 2023, seven-day moving average

Global distribution of blocked domain hosting in H1 2023

H1 2023 | 43

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 44

Research publications
Shedding light on AceCryptor and its
operation
ESET researchers reveal details about a prevalent cryptor,
operating as a cryptor-as-a-service used by tens of malware
families

Not‑so‑private messaging: Trojanized
WhatsApp and Telegram apps go after
cryptocurrency wallets

BlackLotus UEFI bootkit: Myth confirmed
The first in-the-wild UEFI bootkit bypassing UEFI Secure Booton fully updated UEFI systems is now a reality

ESET researchers analyzed Android and Windows clippers
that can tamper with instant messages and use OCR to steal
cryptocurrency funds

Android app breaking bad: From legitimate
screen recording to file exfiltration within ayear

The slow Tick‑ing time bomb: Tick APTgroup compromise of a DLP softwaredeveloper in East Asia

ESET researchers discover AhRat – a new Android RAT basedon AhMyth – that exfiltrates files and records audio

ESET Research uncovered a campaign by APT group Tickagainst a data-loss prevention company in East Asia andfound a previously unreported tool used by the group

Evasive Panda APT group delivers malware
via updates for popular Chinese software

Love scam or espionage? Transparent Tribelures Indian and Pakistani officials

These aren’t the apps you’re looking for: fakeinstallers targeting Southeast and East Asia

ESET Research uncovers a campaign by the APT group known
as Evasive Panda targeting an international NGO in China
with malware delivered through updates of popular Chinese
software

ESET researchers analyze a cyberespionage campaignthat distributes CapraRAT backdoors through trojanized
and supposedly secure Android messaging apps – but also
exfiltrates sensitive information

ESET researchers have identified a campaign using trojanizedinstallers to deliver the FatalRAT malware, distributed via
malicious websites linked in ads that appear in Google search
results and can receive commands to delete files

Linux malware strengthens links between
Lazarus and the 3CX supply‑chain attack

MQsTTang: Mustang Panda’s latest
backdoor treads new ground with Qt and
MQTTStrongPity espionage campaign targeting
Android users

Similarities with newly discovered Linux malware used
in Operation DreamJob corroborate the theory that theinfamous North Korea-aligned group is behind the 3CX
supply-chain attack

ESET APT Activity Report Q4 2022­–Q1 2023
Summary of activities of selected advanced persistent threat(APT) groups analyzed by ESET Research from October 2022
to March 2023.

ESET researchers tease apart MQsTTang, a new backdoor
used by Mustang Panda, which communicates via the MQTT
protocolWinorDLL64: A backdoor from the vast
Lazarus arsenal?
The targeted region, and overlap in behavior and code,suggest the tool is used by the infamous North Korea-aligned
APT group

ESET researchers identified an active StrongPity campaign
distributing a trojanized version of the Android Telegram app,presented as the Shagle app – a video-chat service that has
no app version

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Credits

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 45

Team

Contributors

About the datain this reportPeter Stančík, Team Lead

Alexandre Côté Cyr

The threat statistics and trends presented in this report

This data was processed with the honest intention toare based on global telemetry data from ESET. Unlessmitigate all known biases, in an effort to maximize theexplicitly stated otherwise, the data includes detections

value of the information provided.

Klára Kobáková, Managing Editor
Aryeh Goretsky
Branislav Ondrášik
Bruce P. Burrell
Hana Matušková
Nick FitzGerald
Ondrej Kubovič
Rene Holt
Zuzana Pardubská

Dušan Lacika
Igor Kabina
Jakub Kaloč
Ján ŠugarekJiří Kropáč
Juraj Jánošík
Ladislav Janko
Lukáš Štefanko
Marc-Étienne LéveilléMartin Červeň
Michal Malík
Milan Fránik
Patrik Sučanský
Peter Kálnai
Tomáš Procházka
Vladimír Šimčák
Zoltán Rusnák

regardless of the targeted platform.

Most of the charts in this report show detection trends

Further, the data excludes detections of potentiallyrather than provide absolute numbers. This is because

unwanted applications , potentially unsafe applications

the data can be prone to various misinterpretations,and adware , except where noted in the more detailed,especially when directly compared to other telemetry

platform-specific sections and in the Cryptocurrency

data. However, absolute values or orders of magnitude

threats section.

are provided where deemed beneficial.

ESET THREAT REPORT

Executive summary

Foreword

Threat Landscape Trends

Threat Telemetry

Research publications

About this report

About ESET

H1 2023 | 46

About ESETFor more than 30 years, ESET has been developing

WeLiveSecurity.com

industry-leading IT security software and services to@ESETresearchdeliver comprehensive, multilayered protection against
cybersecurity threats for businesses and consumers
worldwide. ESET has long pioneered machine learning

ESET GitHub
ESET Threat Reports and APT Activity Reports

and cloud technologies that prevent, detect and respondto malware. ESET is a privately owned company that
promotes scientific research and development worldwide.

© 2023 ESET, spol. s r.o. - All rights reserved.
Trademarks used herein are trademarks or registered trademarks of ESET, spol. s r.o.
All other names and brands are registered trademarks of their respective companies.

(eset):research