THREATREPORT Q1 2020
WeLiveSecurity.com@ESETresearch
ESET GitHub

Contents
3

FEATURED STORY

5NEWS FROM THE LAB

6APT GROUP ACTIVITY

8

STATISTICS & TRENDS
9Top 10 malware detections

10 Downloaders
11

Banking malware

12 Ransomware
14 Cryptominers
15 Spyware & backdoors
16 Exploits
17 Mac18 Android
19 Stalkerware
20 Web threats
22 Email threats
24 IoT security

25 ESET RESEARCH CONTRIBUTIONS

Foreword
Welcome to the first quarterly ESET Threat Report!
The first quarter of 2020 was, without a doubt, defined by the outbreak of COVID-19 — now
a pandemic that has put much of the world under lockdown, disrupting peoples’ lives in
unprecedented ways.
In the face of these developments, many businesses were forced to swiftly adopt workfrom-home policies, thereby facing numerous new challenges. Soaring demand for remote
access and videoconferencing applications attracted cybercriminals who quickly adjusted
their attack strategies to profit from the shift.
Cybercriminals also haven’t hesitated to exploit public concerns surrounding the pandemic.
In March 2020, we saw a surge in scam and malware campaigns using the coronavirus pandemic as a lure, trying to capitalize on people’s fears and hunger for information.
Even under lockdown, our analysts, detection engineers and security specialists continued
to keep a close eye on this quarter’s developments. Some threat types — such as crypto­miners or Android malware — saw a decrease in detections compared with the previous
quarter; others — such as web threats and stalkerware — were on the rise. Web threats inparticular have seen the largest increase in terms of overall numbers of detections, apossible side effect of coronavirus lockdowns.
ESET Research Labs also did not stop investigating threats — Q1 2020 saw them dissect
obfuscation techniques in Stantinko’s new cryptomining module; detail the workings ofadvanced Brazil-targeting banking trojan Guildma; uncover new campaigns by the infamous
Winnti Group and Turla; and uncover KrØØk, a previously unknown vulnerability affecting theencryption of over a billion Wi‑Fi devices.
Before lockdowns became the new normal, experts from ESET Research Labs were sharing
their insights at security conferences and events around the world. In February, they unveiled the KrØØk vulnerability research and led a workshop for hunting Linux malware at
RSA Conference 2020, and presented two talks at BlueHat IL.
While seeing our researchers on stage might not be possible for a while, you can still
follow their findings on our blog, WeLiveSecurity, and the ESETresearch Twitter feed.
And, don’t forget, in these Threat Reports!
Happy reading, stay safe — and healthy!
Roman Kovác, Chief Research Officer

ESET THREAT REPORT Q1 2020 | 2

ESET researchers uncover a previously unknown security flaw allowing
an adversary to decrypt some wireless network packets transmitted byvulnerable devices.
ESET researchers discovered a previously
unknown vulnerability in Wi-Fi chips andnamed it KrØØk.

FEATURED
STORYKrØØk: Serious vulnerability
affected encryption of billion+
Wi‑Fi devices
Miloš Cermák and Robert Lipovský

Assigned CVE-2019-15126, this serious
flaw causes vulnerable devices to use an
all-zero encryption key to encrypt partof the user’s communication. In a successful attack, this allows an adversary
to decrypt some wireless network packets transmitted by a vulnerable device.
KrØØk affects devices with Wi-Fi chips
madeby Broadcom and Cypress thathaven’t yet been patched. These are themost common Wi-Fi chips used in contemporary Wi-Fi capable devices such as
smartphones, tablets, laptops, and IoTgadgets.

Not only client devices but Wi-Fi accesspoints and routers with Broadcom chips
were affected by the vulnerability, thus
making many environments with unaffected or already patched client devices vulnerable anyway.
Our tests show that prior to patching,some client devices by Amazon (Echo,
Kindle), Apple (iPhone, iPad, MacBook),
Google (Nexus), Samsung (Galaxy), Raspberry (Pi 3), Xiaomi (RedMi), as well assome access points by Asus and Huawei,
were vulnerable to KrØØk. This totaled toover a billion Wi-Fi-capable devices andaccess points, at a conservative estimate. Further, many other vendors whose
products we did not test also use theaffected chipsets in their devices.
Both WPA2-Personal and WPA2-Enterprise
protocols, with AES-CCMP encryption, areaffected by this vulnerability.
KrØØk is related to KRACK [1] (Key Reinstallation Attacks), discovered in 2017by Mathy Vanhoef, but also fundamentally different. In the beginning of ourresearch, we found KrØØk to be one ofthe possible causes behind the “reinstallation” of an all-zero encryption key,observed in tests for KRACK attacks.
This followed our previous findings that
Amazon Echo was vulnerable to KRACK [2].
We responsibly disclosed KrØØk to chip
manufacturers Broadcom and Cypress,
who subsequently released updates
during an extended disclosure period.

ESET THREAT REPORT Q1 2020 | 3

We also worked with the Industry Consortium for Advancement of Security on the Internet (ICASI) [3] to ensurethat all potentially affected parties — including affected
device manufacturers using the vulnerable chips, as wellas any other possibly affected chip manufacturers — were
aware of KrØØk.
According to our information, patches for devices frommajor manufacturers have been released by now. To protect yourself, as a device owner, make sure you have applied the latest available updates to your Wi-Fi-capabledevices, including phones, tablets, laptops, IoT devices,and Wi-Fi access points and routers. As a device manufacturer, please inquire about patches for KrØØk directlywith your chip manufacturer.
Special thanks to our colleagues Juraj Bartko and Martin
Kaluzník, who greatly contributed to this research. We’dalso like to commend Amazon, Broadcom, and Cypress fortheir good cooperation in dealing with the reported issues
and ICASI for their assistance informing as many of the
impacted vendors as possible.
WeLiveSecurity blogpost [4] | KrØØk white paper [5] |KrØØk website [6] | RSAC 2020 presentation [7]The KrØØk vulnerabilityKrØØk manifests itself after a disassociation. Once a station’s WLAN session gets disassociated, the session key(TK) stored in the Wireless Network Interface Controller’s(WNIC) Wi-Fi chip is cleared in memory — set to zero. Thisis expected behavior, as no further data is supposed to betransmitted after the disassociation. However, we discovered that all data frames that were left in the chip’s Tx(transmit) buffer were transmitted after being encryptedwith this all-zero key.
As a result, the KrØØk vulnerability allows an attacker
to break into encrypted wireless network traffic of
unpatched devices.

* * * *

Fortunately, there are a few aspects that limit the impactof the bug:Firstly, it’s a vulnerability concerning encryption on thewireless LAN (Wi-Fi) layer. It has nothing to do with TLS —the encryption that secures online banking, email, and any
website prefixed with HTTPS. In other words, a successful attack exploiting KrØØk degrades a victim’s security astep towards what they’d have on an open Wi-Fi network.
Secondly, as it’s tied to Wi-Fi, the attacker would have to
be in close proximity to the victim’s Wi-Fi signal. But —wouldn’t need to know their Wi-Fi password!

* * * *

* * * *

* * * *

KrØØk causes transmission of data encrypted with an all-zero key

ESET THREAT REPORT Q1 2020 | 4

Cryptomining
Stantinko botnet adds cryptomining to its pool ofcriminal activities
ESET researchers discovered that the criminals behind the half-million-strong
Stantinko botnet [8] — known to have been active since at least 2012 and mainly
targeting users in Russia, Ukraine, Belarus and Kazakhstan — started distributing a
Monero-mining module to the computers they control. Previously, the botnet performed click fraud, ad injection, social network fraud and password stealing attacks.

NEWS FROM
THE LAB

WeLiveSecurity blogpost [9]Stantinko’s new cryptominer features uniqueobfuscation techniques
In their investigation into Stantinko’s new cryptomining module, ESET researchers
discovered several obfuscation techniques intended to protect against detection
and thwart analysis. Aiming to help the cybersecurity industry improve protection
against sophisticated threats, ESET researchers shed light on the techniques anddescribed a possible approach to deobfuscating some of them — most notably obfus­
cation of strings and control-flow obfuscation.
WeLiveSecurity blogpost [10]Banking malware
Guildma: The Devil drives electric
ESET researchers dissected Guildma, a highly prevalent, Brazil-targeting banking
trojan notable for its innovative methods of execution, sophisticated attack techniques as well as impact in the region.

Latest findings from ESET ResearchLabs across the world

Besides targeting financial institutions, Guildma also attempts to steal credentials
for email accounts, e-shops and streaming services. Like many other Latin Americanbanking trojans, Guildma implements a number of backdoor functions, abuses legitimate tools, and its functionality is split into many modules. It spreads via spam
emails with malicious attachments and has affected at least ten times as many
victims as other Latin American banking trojans analyzed by ESET.
WeLiveSecurity blogpost [11]ESET THREAT REPORT Q1 2020 | 5

Winnti Group
The Winnti Group, active since at least 2012, is responsible for highprofile supply-chain attacks against the video game and software
industries. It is also known for having compromised various targets in
the healthcare and education sectors.

Winnti Group targeting universities in Hong Kong

APT GROUPACTIVITYESET researchers discovered a new campaign run by the Winnti Group against two Hong
Kong universities. The researchers found a new variant of ShadowPad, the group’s
flagship backdoor, deployed using a new launcher and embedding numerous modules.
The Winnti malware was also found at these universities a few weeks prior to the
ShadowPad backdoor.
This campaign was taking place as widespread civic protests swept across Hong Kong,
including the territory’s universities.
In addition to the two confirmed compromised universities, ESET has indications thatat least three additional universities may have been affected. The attackers wereinterested in stealing information from the victims’ machines.
ESET contacted the compromised universities and provided the necessary information
and assistance to remediate the compromise.

Both ShadowPad and Winnti, found at these universities in November 2019, containcampaign identifiers and command and control URLs matching the names of theuniversities, which indicates a targeted attack.
Mathieu Tartare, ESET Malware Researcher

Highlights from ESET investigations
into Advanced Persistent Threat
groups and their campaigns

ESET researchers recently published a white paper [12] updating their understandingof the arsenal of the Winnti Group, following a blog post documenting a supply-chain
attack targeting the videogame industry in Asia [13]. Additionally, they published ablog post on a new backdoor named skip-2.0 [14] that targets Microsoft SQL Server.
WeLiveSecurity blogpost [15]

ESET THREAT REPORT Q1 2020 | 6

Compromised website

Turla
Turla, also known as Snake, is an infamous espionage group recognized for
its complex malware. It is believed to have been operating since at least
2008, when it successfully breached the US military.

skategirlchina[.]com
HTTP GET Request

New Turla backdoor delivered via watering hole on
Armenian websites

C&C

ESET researchers found a watering hole operation targeting several high-profile Armenian
websites. It relied on a social engineering trick — a fake Adobe Flash update — as a lure todeliver two previously undocumented pieces of malware, dubbed NetFlash and PyFlash by
the researchers.
In this operation, Turla compromised at least four Armenian websites, including two
belonging to the government. Thus, it is likely the targets included government officials
and politicians. ESET notified the Armenian national CERT and shared the analysis withthem before publication.

<Fingerprint script>

Others

Delivers

Interesting users

Nothing!

According to ESET telemetry, the following websites were compromised:• armconsul[.]ru: The consular Section of the Embassy of Armenia in Russia• mnp.nkr[.]am: Ministry of Nature Protection and Natural Resources of the Republic of

Fake Adobe Flash
update warning

Artsakh• aiisa[.]am: The Armenian Institute of International and Security Affairs• adgf[.]am: The Armenian Deposit Guarantee Fund

Download

If the website visitor is deemed interesting, the server replies with a pieceof JavaScript code that displays a fake Adobe Flash update warning. Data fromESET telemetry suggests that, for this campaign, only a very limited number ofvisitors were considered interesting by Turla’s operators.

Fake Adobe Flashexecutable

Matthieu Faou, ESET Malware Researcher
A fake Adobe Flash update pop-up window warning is displayed to visitors of interestin order to trick them into downloading a malicious Flash installer. Once the malicious
executable is downloaded, and if the user launches it manually, a Turla malware variant
and a legitimate Adobe Flash program are installed.
The scheme on the right shows an overview of the initial compromise process.
WeLiveSecurity blogpost [16]Install

InstallReal Adobe Flash

Turla malware

Overview of the watering hole operation

ESET THREAT REPORT Q1 2020 | 7

0.0%

0.0%

STATISTICS& TRENDS

Rate of malware detections in Q1 2020

LNK/Agent trojan

14.6%

VBA/TrojanDownloader.Agent trojan

7.5%

Win/Exploit.CVE-2017-11882 trojan

4.6%

Win/Bundpil worm
Win/Agent worm

The threat landscape in Q1 2020
as seen by ESET telemetry

7.1%

7.1%

3.8%
3.0%

HTML/Phishing.Agent trojan

2.4%

Win/Phorpiex worm

2.3%

Win/HackTool.Equation trojan

2.2%

JS/Agent trojan

2.1%

VBS/Agent worm

2.0%

Top 10 malware detections in Q1 2020 (% of malware detections)

ESET THREAT REPORT Q1 2020 | 8

Top 10 malware detections
LNK/Agent trojan Q4 2019: 1 ↔ Q1 2020: 1
LNK/Agent is a detection name for malware utilizing Windows LNK shortcut files to execute
other files on the system. Shortcut files have been gaining popularity among attackers,
as they are typically considered benign and less likely to raise suspicion. LNK/Agent files
don’t contain any payload and are usually parts of other, more complex malware. They areoften used to achieve persistence of the main malicious files on the system or as a partof the compromise vector.

VBA/TrojanDownloader.Agent trojan Q4 2019: 2 ↔ Q1 2020: 2
VBA/TrojanDownloader.Agent is a detection typically covering maliciously crafted Microsoft Office files that try to manipulate users into enabling the execution of malicious
macros. Upon execution, the enclosed malicious macro typically downloads and executes
additional malware. The malicious documents are usually sent as email attachments, disguised as important information relevant to the recipient.

Win/Exploit.CVE-2017-11882 trojan Q4 2019: 4 ↑ Q1 2020: 3
This detection name stands for specially crafted documents exploiting the CVE-201711882 [17] vulnerability found in the Microsoft Equation Editor, a component of Microsoft
Office. The exploit is publicly available and usually used as the first stage of compromise.
When the user opens the malicious document, the exploit is triggered and its shellcode
executed. Additional malware is then downloaded onto the computer to perform arbitrary
malicious actions.

Win/Bundpil worm Q4 2019: 3 ↓ Q1 2020: 4
Win32/Bundpil is a worm capable of spreading via removable media. It is a part of Wauchos,
one of the largest botnet families, also known as Gamarue [18] or Andromeda. Bundpil was
designed to enhance the persistence of Wauchos and to make it harder to perform a global takedown of its network. As part of this, it contains a domain generation algorithm andcan alter DNS requests.

Win/Agent worm Q4 2019: 5 ↔ Q1 2020: 5
This detection name is for various malicious executables capable of self-replication.
Their common characteristics are the ability to spread to all available drives and gaining
persistence. In order to trick potential victims into executing these malicious files, thefilenames are often changed to impersonate harmless folders and files found on the system. They also usually contain basic backdoor capabilities, such as communication with a
C&C server, downloading and executing additional files, or keylogging.

HTML/Phishing.Agent trojan Q4 2019: 35 ↑ Q1 2020: 6
HTML/Phishing.Agent is a detection name for malicious HTML code often used in a phishingemail’s attachment. Attackers tend to use it instead of other file types, since executableattachments are usually automatically blocked or more likely to raise suspicion. Whensuch an attachment is opened, a phishing site is opened in the web browser, posing as an
official banking, payment service or social networking website. The website requests
credentials or other sensitive information, which is then sent to the attacker.

Win/Phorpiex worm Q4 2019: 6 ↓ Q1 2020: 7
Win/Phorpiex is a worm that is used mainly to download other malware, distribute spam,and perform DDoS attacks. It spreads via removable media and, to trick users into downloading and executing it, replaces legitimate files stored in web or FTP server folders
with copies of itself. It communicates through IRC channels.

Win/HackTool.Equation trojan Q4 2019: 7 ↓ Q1 2020: 8
The detection name Win32/HackTool.Equation covers tools attributed to the United States
National Security Agency (NSA) and made public by the hacking group Shadow Brokers. Soon
after the leak, these tools became widely used by cybercriminals. The detection also includes malware derived from these leaked tools or threats using the same techniques.

JS/Agent trojan Q4 2019: 16 ↑ Q1 2020: 9
This detection name covers various malicious JavaScript files. These are often obfuscatedto avoid static detections. They are typically placed onto compromised but otherwise
legitimate websites, with the aim of achieving drive-by compromise of visitors.

VBS/Agent worm Q4 2019: 8 ↓ Q1 2020: 10
VBS/Agent is a detection name for malicious Visual Basic scripts (VBS) spreading from one
system to another, mostly via removable drives and using various persistence methods.
Their purpose is to gather information about the compromised system, send it to a remotemachine and potentially download and execute other, usually more complex, malware.

ESET THREAT REPORT Q1 2020 | 9

Downloaders
The first quarter of 2020 saw weaker downloader activity but notable updates to the notorious Emotet trojan and its spreading mechanisms.
In Q1 2020, downloader families lost quite a bit of steam compared to Q4 2019, dropping inoverall numbers by more than 35%. ESET telemetry shows the most significant drop around
New Year’s Eve, which might be explained by transition from traditionally campaign-heavy
Christmas season to a calmer beginning of the year. Emotet’s “holiday break” [19] could
have also contributed to the plunge — note that VBA/TrojanDownloader.Agent is often
affiliated with Emotet.
The most significant spike of Q1 was observed around February 10. This could be explainedby the circumstances around the coronavirus outbreak in the Western Hemisphere. Malware
operators exploited the increased tension and fears among the general public to spreadcoronavirus-themed malicious attachments, targeting mostly European countries in thefollowing order: Spain, Portugal, Czech Republic, Taiwan and Germany.
At the family level, VBA/TrojanDownloader.Agent has led the rankings since Q4. Its detections were four times higher than those of VBS/TrojanDownloader.Agent, the second-mostcommon family. VBA/TrojanDownloader.Agent is distributed through spam campaigns and is
predominantly spread via malicious Microsoft Office files. When opened, these macroenabled documents typically use PowerShell to download Win/Emotet binaries fromhacked websites.
Downloader

Win/Emotet

VBA/TrojanDownloader.Agent

VBA/TrojanDownloader.Agent trojan

44.2%

VBS/TrojanDownloader.Agent trojan

10.8%

DOC/TrojanDownloader.Agent trojan

9.5%

Win/TrojanDownloader.Agent trojan

6.9%

JS/TrojanDownloader.Agent trojan

4.1%

JS/TrojanDownloader.Nemucod trojan

3.9%

PowerShell/TrojanDownloader.Agent trojan

3.1%

Win/TrojanDownloader.Wauchos trojan

2.7%

LNK/TrojanDownloader.Agent trojan

1.6%

Win/TrojanDownloader.Agent virus

1.6%

Top 10 downloader families in Q1 2020 (% of downloader detections)

Win/Emotet was particularly interesting this quarter. Researchers have spotted samples[20] using its worm module to spread into nearby insecure Wi-Fi networks and infecting
connected users. ESET telemetry shows our products detected this Wi-Fi module as earlyas April 2018, but only on a very limited number of occasions.

The low prevalence of the Wi-Fi module suggests that Emotet’s operators were
trying to keep it out of sight, perhaps reserving it for targeted attacks.
Zoltán Rusnák, ESET Malware Analyst

Q4 Q1
1-Oct-2019

1-Nov-2019

1-Dec-2019

1-Jan-2020

1-Feb-2020

1-Mar-2020

Downloader detection trend in Q4 2019-Q1 2020, seven-day moving average

The Wi-Fi worm module saw a significant update at the beginning of February 2020. The
original version from 2018 was a self-extracting archive, containing the Emotet binary
and another malicious binary designed to brute-force access to nearby Wi-Fi networks andsubsequently to network shares. The updated version of Emotet’s Wi-Fi spreader added an
additional step after the brute-force attack, downloading second-stage malware from theoperator’s C&C, which then downloads the Emotet binary itself and runs it on the device,
making the update process more flexible.

ESET THREAT REPORT Q1 2020 | 10

Banking malware
Banking malware detections went up slightly in Q1 2020 according to ESET telemetry, with Win/Spy.Ursnif seeing the biggest increase compared to Q4 2019.
Following a significant drop in December 2019, global banking malware detections were ona slight upwards trend in Q1 2020. The category was dominated by JS/Spy.Banker, which
accounted for more than a third of all banking malware detections. This detection namecovers a wide range of malicious scripts used to steal sensitive banking and credit card
information from victims’ browsers.
When comparing the most prevalent banking malware threats from Q1 2020 to those fromthe previous quarter, Win/Spy.Ursnif saw the most significant change — a jump from 5.9%of banking malware detections in Q4 2019 to 13% in Q1 2020.
Ursnif, also known as a variant of the Gozi malware, is a high-profile and very active
banking trojan specializing in credential and data theft. It is known to spread via email
through malicious links and attachments, and exploit kits. The uptick in detections in Q1
2020 is connected to a wave of malicious spam attachments we observed at the beginningof the year. These spam messages claimed to be about legislative changes for 2020, while
the executable attachments were disguised as PPT or PDF files.

JS/Spy.Banker trojan

31.7%

Win/Spy.Ursnif trojan

13.0%

Win/TrickBot trojan

10.1%

Win/TrojanDownloader.Banload trojan

6.5%

Win/Spy.Zbot trojan

5.6%

Win/ClipBanker trojan

4.7%

JS/TrojanDownloader.Banload trojan

4.0%

Win/Spy.Danabot trojan

3.1%

Win/Spy.Banker trojan

2.5%

Win/Tinba trojan

2.2%

Top 10 banking malware families in Q1 2020 (% of banking malware detections)

Besides the most prevalent families, an interesting category of banking malware are thebanking trojans that specifically target Latin America. Investigating these threats, ESET
researchers have identified more than 10 malware families, interlinked through many common characteristics. In Q1 2020, ESET published its analysis of Guildma [11], an advanced
Brazil-targeting banking trojan.

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

The Latin American banking trojans we have identified have many things incommon: they are written in Delphi, contain backdoor functionality and areusually delivered via quite long execution chains. To steal banking information,
they typically rely on a combination of social engineering and fake pop-up
windows — rather than web injections commonly used elsewhere.
Jakub Soucek, ESET Malware Analyst

1-Mar-2020

Banking malware detection trend in Q4 2019-Q1 2020, seven-day moving average

When combined, the Latin American banking trojans accounted for more than 7% ofbanking malware detections in Q1 2020, with Win/Spy.Mekotio, Win/Spy.Amavaldo and
Win/Spy.Grandoreiro being the most prevalent.

ESET THREAT REPORT Q1 2020 | 11

Ransomware
Ransomware operators add doxing as their new go-to tactic, yet vow to spare hospitals during the coronavirus pandemic.
ESET detected an overall drop in ransomware activity in Q1 2020 with January 2020 seeing
the most action despite a slow start after New Year’s Eve.

Win/Filecoder.WannaCryptor trojan
Win/Filecoder.Crysis trojan

According to ESET telemetry, the uptick in January was caused by two major campaigns:
one by the Crysis family (12.9% of all Filecoder1 detections in January) and another targeting South African users by the Sodinokibi family (13.4% of all Filecoder detections inJanuary). The latter malware strain used powershell.exe as its parent process, indicatingthat the Sodinokibi operators delivered the payload via malicious email attachments using
PowerShell to run the ransomware.
WannaCryptor dominated the top 10 ransomware family ranking throughout the firstquarter of 2020, even though it has been almost three years since its largest outbreak in
May 2017. Most of the Q1 WannaCryptor detections were attributed to well-known samples
spread in regions with potentially higher numbers of unpatched devices, namely Turkey,
Thailand and Indonesia.

40.5%
10.8%

Win/Filecoder.Sodinokibi trojan

7.6%

Win/Filecoder.STOP trojan

7.5%

Win/Filecoder.Phobos trojan

4.6%

Win/Filecoder.GandCrab trojan

3.2%

Win/Filecoder.CryptoWall trojan

2.5%

Win/Filecoder.Locky trojan

2.4%

Win/Filecoder.CryptProjectXXX trojan

2.2%

Win/Filecoder.Cerber trojan

2.1%

Top 10 ransomware families in Q1 2020 (% of ransomware detections)

ESET telemetry showed a similar situation with detections of older variants of GandCrab,some of which originated as far back as 2018. Operators behind the Q1 campaigns usedemails to spread these variants mostly to potential victims in Germany, Japan and Italy.
Just as in the music charts, there’s plenty of movement in the top positions — different
families move up and down in prominence. The most commonly seen, WannaCryptor, was followed by Crysis, Sodinokibi, STOP and Phobos families, which were fighting and replacing
each other in the rankings. February 2020 also saw a newcomer in the top 10, Nemty — firstobserved in the wild in August 2019. However, Nemty was promptly replaced by Cerber inthe following month.

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

1-Mar-2020

The last days of March saw an odd behavior by the DeathRansom operators, who started to
mimic an older version of the GandCrab ransomware, version 5.1. The most visible characteristic of this shift was the use of GandCrab’s ransom note. What differs is the TOR linkthat does not include the “gandcrab” string — a “telltale” of the original perpetrators notpresent in the current DeathRansom page. Further, DeathRansom’s landing page does notresemble one that was used by GandCrab.

Ransomware detection trend in Q4 2019-Q1 2020, seven-day moving average
1

ESET classifies ransomware into Filecoder and Diskcoder categories, depending on whether they target files or disk volumes, respectively.

ESET THREAT REPORT Q1 2020 | 12

A significant new trend emerged toward the end of Q4 2019, as ransomware operators
started to steal their victims’ sensitive data and threaten to make it public, unless theransom is paid. This technique — also called doxing — is employed in addition to theunwanted encryption of the victim’s data.
Attackers use this approach to increase pressure on the victim, who has to cope withmultiple problems including stalled business operations, financial loss, reputational harm,
reporting to authorities and potential fines (due to GDPR or other legislation) as well aswith loss of competitive advantage, if confidential data is leaked online.
Doxing had initially been used by operators of Maze ransomware; however, inspired by its
effectiveness, other ransomware operators followed suit in Q1 2020. High-profile families
seen adopting the approach include DoppelPaymer, Sodinokibi, RobinHood, and Nemty.
One of the first victims that was doxed by Maze was the US wire and cable manufacturer
Southwire. Maze operators stole 120 GB of its data, encrypted nearly 900 devices and demanded $6 million to restore to the previous state. When Southwire refused to pay, Maze
started publishing its data, which was met by a lawsuit and preventive steps against theprovider hosting the leaked data.

“Press release” by Maze operators addressing the coronavirus pandemic (Image source: @CryptoInsane [23])Some ransomware operators have decided not to attack medical organizations,but that didn’t discourage others from doing so. There have been quite a few
examples of that in the first quarter of 2020.
Igor Kabina, ESET Senior Detection Engineer
An interesting ransomware-related case was described in a mid-February 2020 alert [24]by US-CERT. The cyberattack targeted a natural gas compression facility. The threat actor
used a spearphishing link to gain initial access to the IT networks and leveraged that toaccess the operational technology (OT) network. Both were subsequently compromised with
commodity ransomware. The incident led to loss of productivity and revenue but did notcause the organization to lose control of operations. US-CERT also states that the casecould have been prevented if the victim had implemented robust segmentation between its
IT and OT networks.

Post by Maze operators on a Russian hacking forum (Image source: BleepingComputer.com [21])Another interesting turn in Q1 2020 was prompted by the COVID-19 outbreak in Westerncountries. Surprisingly, operators of some families (e.g. Maze, DoppelPaymer) released
public statements promising not to target health or medical organizations [22] so as not
to worsen the effects of the pandemic. However, some families — such as Ryuk — havecontinued business as usual.

Q1 2020 shed some light on the earnings of ransomware operators. According to a talkdelivered by FBI Special Agent Joel DeCapua at the RSA 2020 Conference [25], attackers
using encrypting Filecoders have earned at least $140 million over the past six years.
At least that is the sum of all transactions observed on bitcoin wallets associated withransom notes. Most of the money has been transferred to wallets connected with Ryuk(over $61 million) and Crysis/Dharma (almost $24.5 million).
Agent DeCapua also stressed that in the overwhelming number of cases, RDP is still
the primary vector used to compromise businesses. According to FBI data, up to 80%
of successful ransomware attacks are accomplished via breaking into the network bybrute-forcing RDP credentials. DeCapua’s full talk can be found on YouTube [26].

ESET THREAT REPORT Q1 2020 | 13

Cryptominers
In the cryptomining theater, the most notable trend observed in Q1 2020 was continuing decline of cryptomining activities. Cryptominers classified as
potentially unwanted applications have seen the most significant downturn.
ESET security products detect cryptominers as potentially unwanted applications (PUA) or
trojans — the latter being those configured to mine cryptocurrency without the victim’s
knowledge or consent. While in Q4 2019 the trojan:PUA ratio in cryptominers was 52:48,
the decline in PUAs led to the ratio growing to 60:40 in Q1 2020.
As seen in the chart below, there was a gradual but consistent decline in global
detections of malicious cryptominers, a trend that is a continuation of the decline
observed since the beginning of 2019.

As exchange rates of cryptocurrencies fall, so do the bad actors’ revenues.
As a result, their interest in having people’s devices mine coins wanes.
Juraj Jánošík, Head of Automated Threat Detection and Machine Learning

Besides the drop in price of bitcoin and other cryptocurrencies, the decline in crypto­mining activities observed in Q4 2019 and Q1 2020 can be, to a large extent, attributed
to Operation Goldfish Alpha [27]. This operation, coordinated by INTERPOL, identified over
20,000 hacked routers in the ASEAN region, which reportedly accounted for 18% of global
infections of cryptomining malware. By late November 2019, the number of infected devices had been reduced by 78%, according to INTERPOL.
Malicious JavaScript used for in-browser mining, detected as JS/CoinMiner, didn’t recoverfollowing the demise of the infamous Coinhive [28] mining service in March of 2019. While
in Q1 2019 these covered around 30% of all the cryptominer detections, in Q1 2020 theirshare hovered just above 10%, virtually unchanged compared to Q4 2019.
Despite having been predicted by some to grow, Android coinminers — both trojans and
PUAs — remain virtually non-existent.

Win/CoinMiner trojan

17%
13%

Win/CoinMiner PUA

24%

NSIS/CoinMiner trojan
9%
JS/CoinMiner PUA

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

9%28%

JS/CoinMiner trojan
Other

1-Mar-2020

Cryptominer detection trend in Q4 2019-Q1 2020, seven-day moving average

Top cryptominer detections in Q1 2020

ESET THREAT REPORT Q1 2020 | 14

Spyware & backdoors
According to ESET telemetry, Q1 2020 saw a steady level of spyware and backdoor detections, with Win/HoudRat dominating the landscape.
Aside from the usual drop at the turn of the year, spyware and backdoor detections werefairly constant across Q4 2019 and Q1 2020. Backdoor detections have been reachingapproximately double the number of spyware detections.

trojanWin/HoudRat Win/HoudRat
trojan28.5%

Win/PSW.Fareit
trojanWin/PSW.Fareit
trojan

25.7%
25.7%

MSIL/Bladabindi
trojanMSIL/Bladabindi
trojanThe Spyware category in this report comprises detections of trojans and worms with
data-stealing, password-harvesting and keylogging capabilities. Backdoors, also known asWin/PSW.OnLineGames
Win/PSW.OnLineGames
trojantrojanRemote Access Trojans (RATs), are defined as applications allowing remote access to a
Win/Spy.Socelars
trojan 4.1%
Win/Spy.Socelars
trojancomputer without the user’s knowledge, and tracked as a distinct detection category.
Win/Spy.RTM trojan

13.2% 13.2%

Win/Spy.RTM trojan
3.7%
The most prevalent malware family in the Spyware category in Q1 2020 was Win/HoudRat,
which accounted for almost a third of all spyware detections. HoudRat is complex malware Win/Spy.KeyLogger
Win/Spy.KeyLogger
trojan1.9%
trojan1.9%
used to steal credentials from popular e-stores, payment portals, and widely used web
Win/Spy.Weecnaw
trojan1.6%
Win/Spy.Weecnaw
trojan1.6%
browsers. It utilizes removable media for spreading purposes.

Ranking first among backdoors was Win/Vools, with nearly 16% of all backdoor detections.
This malware uses the Microsoft Server Message Block (SMB) vulnerability to spread tovulnerable computers. If successful, Vools collects a victim’s sensitive information andsends it to a remote server.
Backdoors

MSIL/Bladabindi
worm
MSIL/Bladabindi
worm
1.2%

1.2%

Win/Spy.Bebloh
trojanWin/Spy.Bebloh
trojan
1.1%

1.1%

7.4%

7.4%
4.1%
3.7%

Top 10 spyware families in Q1 2020 (% of spyware detections)

SpywareWin/Vools backdoor

15.8%

Win/VB backdoor

9.3%

MSIL/NanoCore backdoor

7.3%

Win/Tofsee backdoor

7.2%

Java/Adwind backdoor

6.4%

Win/Rescoms backdoor

5.9%

PHP/WebShell backdoor

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

Win/RanumBot backdoor

1-Mar-2020

Spyware and backdoor detection trends in Q4 2019-Q1 2020, seven-day moving average

5.2%
4.8%

Win/Equation.DoublePulsar backdoor

4.1%

Win/Glupteba backdoor

3.9%

Top 10 backdoor families in Q1 2020 (% of backdoor detections)

ESET THREAT REPORT Q1 2020 | 15

Exploits
Network security has come into the spotlight, with criminals apparently attracted by networks more open to incoming traffic due to more people working
from home.

Another vulnerability that saw the number of attack attempts dwindling in Q1 2020 was
BlueKeep [30]. This “wormable” critical Remote Code Execution vulnerability in Remote
Desktop Services was disclosed after being patched in May 2019. After some initial
dramatic spikes in activity, the number of attacks started to decrease, continuing
through Q1 2020.
From the network security point of view, one of the key pain points remains the Remote
Desktop Protocol (RDP). We witnessed large scale password guessing attacks, a trend thatrecently strengthened, apparently with the coronavirus-induced lockdowns. In regard to
RDP security, refer to this ESET advisory [31].

50

100

45

90

40

80

35

70

30

60

25

50

20

40

15

30

10

20

5

10

0
1-Dec-2019

10

250

1-Mar-2020

45

35

40

30

35
25

30

200

8

20

25

150

6

15

20

100

4

10

50

2

0
1-Oct-2019

0

15
10

1-Nov-2019

1-Dec-2019

1-Jan-2020

1-Feb-2020

1-Mar-2020

Trends of EternalBlue exploit attempts in Q4 2019-Q1 2020, seven-day moving average
2

1-Feb-2020

Hundreds

12300

1-Jan-2020

BlueKeep attack attempts (left axis)
BlueKeep attack attempts on unique clients (right axis)
Thousands

14

Thousands

Thousands

16

350

0

Trends of RDP connection attempts in Q4 2019-Q1 2020, seven-day moving average2

EternalBlue exploit attempts (left axis)
EternalBlue exploit attempts on unique clients (right axis)
400

Thousands

RDP connection attempts (left axis)
RDP connection attempts on unique clients (right axis)
Millions

The number of attempted attacks using the infamous EternalBlue exploit continued to
decline through Q1 2020, ending at half of the historical high [29] it reached in Q2 2019.
EternalBlue exploits were responsible for the nastiest ransomware outbreak ever: WannaCryptor (or WannaCry). Despite that being almost three years ago, EternalBlue remains a
relevant threat with hundreds of thousands of daily attack attempts.

5501-Oct-2019

0
1-Nov-2019

1-Dec-2019

1-Jan-2020

1-Feb-2020

1-Mar-2020

Trends of BlueKeep attack attempts in Q4 2019-Q1 2020, seven-day moving average

Data prior to December 2019 is not available due to a change in methodology. The increase at the beginning of February was caused in part by lowering the threshold for classifying a sequence of attempts as an attack.

ESET THREAT REPORT Q1 2020 | 16

Mac
According to ESET telemetry, Mac detections had a steady first quarter in 2020.
The first quarter of 2020 saw a small surge in macOS detections in January and a subsequent return to a steady state slightly below the average for 2019. The vast ma­jority of
Mac detections registered by ESET products in Q1 2020 fall into the category of
Potentially Unwanted Applications (PUA), followed by Potentially Unsafe Applications(PUsA), adware and trojans.

Other
32%

OSX/Keygen
PUsA

Mac computers (i.e. those powered by the macOS operating system) are less targeted bymalware than Windows or Linux devices. Apple’s “walled garden” strategy, albeit often
criticized for other reasons, makes it difficult for malware to sneak onto a Mac. A keyelement of macOS security is the mechanism called Gatekeeper that checks if code
has been signed by Apple. Apps failing that check can only be installed with theuser’s explicit permission.

29%

OSX/GT32SupportGeeks
PUA

OSX/Bundlore
adwareOSX/Mackeeper PUA
39%

Under the typical scenario, attackers rely on social engineering to trick thevictims into installing the malware onto their Macs.
Miroslav Legén, ESET Senior Detection Engineer

OSX/Genieo
adwareTop Mac detections in Q1 2020

PUA
16.8%
Adware

9.6%

PUsA

65.1%
5.8%

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

2.7%

TrojanOther

1-Mar-2020

Mac detection trend in Q4 2019-Q1 2020, seven-day moving average

Top Mac detection categories in Q1 2020

ESET THREAT REPORT Q1 2020 | 17

psAndroid
Ad-displaying apps steadily dominate the Android threat landscape, but it’s stalkerware that is attracting the greatest attention.
Although overall Android detection levels were steady through Q1 2020, they were at a
noticeably lower level than in the first half of Q4 2019. Android/Hiddad continued to rank
first among detected families, and along with Android/HiddenApp and others, con­tributed
to Hidden Apps remaining the most prevalent category of Android threats. Their key features are hiding their icons after installation and then going on to bombard users withfull-screen ads. These shady apps commonly make it into the Google Play store, masquerading as attractive games or photo editing apps.

Apps in the Hidden Apps category display adware behavior, but their stealthcapabilities set them apart from traditional adware, and they are fairly prevalent.
For these reasons we have been tracking them outside of the broad adware
category.
Lukáš Štefanko, ESET Malware Researcher

AdwareSMS Trojans

Stalkerware

Clickers

Hidden Apps

SMS Trojans

Stalkerware

Android/Hiddad trojan

18.3%

Android/Agent trojan

16.2%

Android/TrojanDropper.Agent trojan

11.3%

Android/Autoins PUsA

7.6%

Android/SMSreg PUsA

7.1%

Android/HiddenApp trojan

4.1%

Android/TrojanSMS.Agent trojan

2.9%

Android/Inmobi PUsA

1.6%

Android/AdDisplay.AirPush PUA

1.5%

Android/AdDisplay.Toofan PUA

1.4%

Other (Banking malware, Cryptominers, Ransomware,
Spyware)Top 10 Android
detections in Q1 2020 (% of Android detections)

Banking malware, Cryptominers, Ransomware, Spyware

The Android ecosystem was affected by
the coronavirus pandemic that started
in Q1 2020. Threat actors quickly started exploiting Android users’ hunger for
information about COVID-19 and associated protective equipment and potentialcures.

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

1-Mar-2020

Trends of selected Android detection categories in Q4 2019-Q1 2020, seven-day moving average

ESET researchers witnessed malicious
apps distributed in campaigns undercoronavirus-themed disguises, e.g.,
symptom identification, infection maps,
tracking applications, and financial
compensation. Among malicious apps
distributed this way have been various
banking trojan families, ransomware, SMS
worms, spyware, and adware.
Examples of coronavirus-themed Android malware
permission requests
ESET THREAT REPORT Q1 2020 | 18

Stalkerware
The number of detections in the Stalkerware category (also called spouseware by some) has risen by about a third compared to Q4 2019.
ESET treats the Stalkerware category of Android threats differently from the other typesof so-called Potentially Unwanted Applications that it technically belongs to. Stalkerware
is a classic example of dual-purpose technology — an otherwise legitimate tool that can beeasily misused to serve illegitimate goals.

Android/SafeTracker monitor

Android/Guardian monitor

7.3%

Typically, stalkerware is marketed as a tool that enables monitoring children, students or
employees. In reality, these apps are often used for spying upon unsuspecting spouses orromantic partners, sometimes with tragic consequences for those victims. For this reason,
ESET has reclassified these apps from the Potentially Unwanted Applications category inorder to raise warnings about their nature independent of the customer’s settings.

Android/Androidlost monitor

6.8%

The class of Stalkerware apps is an extremely fragmented one: ESET researchers keep
their eyes on about one hundred families. Of those, all but the top four have a prevalenceof under five percent, while the dominant stalkerware family accounts for over 25% ofdetections in this category.

25.2%

Android/Cerberus monitor

10.8%

Android/MobileTracker monitor

4.1%

Android/Spyoo monitor

3.9%

Android/TiFamily monitor

3.5%

Android/SpyPhone monitor

3.0%

Android/Mspy monitor

2.8%

Android/Hoverwatch monitor

2.5%

Top 10 Android stalkerware families in Q1 2020 (% of Android stalkerware detections)

Besides being a threat when used for illegitimate purposes, stalkerware apps tend to havebeen developed without security considerations. ESET researchers often see these apps
communicating with their backend servers via unsecured channels, without any encryption.

Evidently, those behind stalkerware apps put most of their efforts into
aggressive marketing while ignoring security.
Lukáš Štefanko, ESET Malware Researcher

1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

As a result, insecure stalkerware applications bring danger not only to those illegitimately spied upon, but also to the legitimate targets of oversight. Personal informationof all those with such apps installed on their devices might well find its way into publicly
exposed data leaks.
1-Mar-2020

Stalkerware detection trend in Q4 2019-Q1 2020, seven-day moving average

ESET THREAT REPORT Q1 2020 | 19

Web threats
Web threats increased in overall volume in Q1 2020 according to ESET telemetry, with the coronavirus pandemic frequently used as a lure.
0.0%

0.0%

Compared to Q4 2019, the number of malicious and fraudulent websites blocked in Q1 2020
increased by 21%. At the turn of the year, the number of these detections surged, reaching a peak in mid-January 2020 and declining slightly towards the end of the quarter.
However, when viewed in terms of unique URLs blocked, we observed the opposite trend —a 33% decrease from Q4 2019 to Q1 2020.

7.9%

7.9%

The trend data is broken down into categories based on the type of threat blocked:• Malware: websites known to serve malware• Scam: websites with fraudulent content• Phishing: websites used to harvest sensitive data
• Malware Object: otherwise legitimate websites (e.g. cloud storage services) hosting
malicious code

While the Malware category had the most overall blocks, the largest number of unique URLs
blocked belonged to the Scam category. Phishing had the most blocked attacks per unique
URL — approximately 20.
According to ESET telemetry data, ESET customers in Russia, Peru, Japan, the United Statesand France had the largest numbers of web threat blocks. Domains with the largest numbers of detections are listed on the next page.
Scam

Phishing

Malware Object

Malware14

x 100000Millions

MalwareRate of web threat blocks in Q1 2020

12
10

Scam

Phishing

Malware Object

16
14
12
10

8

8
6

6

4
2
0
1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

4
2
1-Mar-2020

Trends of blocked web threats in Q4 2019-Q1 2020, seven-day moving average0
1-Oct-2019

1-Nov-2019

Q4 Q1

1-Dec-2019

1-Jan-2020

1-Feb-2020

1-Mar-2020

Trends of unique URLs blocked in Q4 2019-Q1 2020, seven-day moving average

ESET THREAT REPORT Q1 2020 | 20

Malware

Scam

Phishing

adobviewe[.]clubr.remarketingpixel[.]com

d18mpbo349nky5.cloudfront[.]net

2 fingahvf[.]top

ofhappinyer[.]com

mrproddisup[.]com

3 deloplen[.]com

ak.imgfarm[.]com

attacketslovern[.]info

4 runmewivel[.]com

plugins.zonainst[.]xyz

gleaminist[.]info

5 webunstop[.]net

maranhesduve[.]club

update.updtbrwsr[.]com

6 cozytech[.]biz

rudy.adsnative[.]com

update.updtapi[.]com

7

version.zonainst[.]xyz

static.oceanreefs[.]xyz

8 linkangood[.]com

glotorrents[.]pw

update.brwsrapi[.]com

9 videomore[.]club

postlnk[.]com

update.mrbrwsr[.]com

10 hardyload[.]com

koindut[.]com

update.savebrwsr[.]com

1

d3qjtdfpbrj6c.cloudfront[.]net

Coronavirus pandemic as a lure
In mid-March, we saw a surge in coronavirus-themed web attacks. These ranged fromfraudulent online stores claiming to sell face masks and other personal protective
equipment, all the way to websites distributing dangerous malware.
In the latter category, ESET telemetry detected a malicious website impersonating theWorld Health Organization (WHO) that tried to manipulate users into downloading what ispresented as “COVID-19 Information App”. Instead, victims ended up downloading malware;
we’ve seen the website serve a malicious cocktail of downloaders, spyware and ransomware, with the payload changing frequently.

Top 10 blocked Malware, Scam and Phishing domains in Q1 2020

Homoglyph attacks
Homoglyph attacks rely on replacing characters (or glyphs in font design terms) in
URLs with ones that look similar — or are even visually identical — but are different tocomputers, as they belong to different alphabets. These attacks may be very dangerous
for users, as they have only a limited chance of detecting the trap.
To protect high-value target domains — banks, financial institutions and payment
platforms, prominent email services, and reputable media — ESET products perform arigorous inspection. They check the letters ofprotected URLs against a table of similar lettersbanescofrom any other alphabet and warn the customer if
any deception attempt is detected.

instagram

According to ESET telemetry, the domain mostimpersonated by “homoglyphed” lookalikes in Q1
2020 was apple.com, followed by instagram.com
and blockchain.com. In the case of apple.com, mostof the detections came from a single domain thatis educational in nature, and not malicious.
The domains impersonating instagram.com andblockchain.com, however, are malicious.

hotmailapple

amazon binanceblockchain
volksbank

Malicious website impersonating the WHO and luring users into downloading malware

As for websites with coronavirus-related strings in their domain names, we detected a
spike in mid-March 2020, with a sixty-fold increase when comparing detections from March
1st and March 16th. Detection of these threats was most prevalent among ESET customers in
the United States, Russia and Ukraine, whose detections, combined, accounted for 70% of
the overall detections of these coronavirus-related web threats.
In the Malware category, coronavirus[.]zone was the most blocked threat, distributing
HTML/ScrInject.B — malicious code that redirects the browser to other URLs with further malware. Most prevalent in the Phishing category was chasecovid19v[.]com, whilesurvivecoronavirus[.]org was the most blocked Scam website.

Brands most targeted with homoglyph attacks
in Q1 2020

ESET THREAT REPORT Q1 2020 | 21

Email threats
Spam was “business as usual” in Q1 2020, with a slight peak in March 2020 and a wave of coronavirus-themed unsolicited emails.
Q1 2020 did not see any turbulent developments on the spam scene. ESET telemetryshows a relatively steady level with a few minor peaks, with the largest volume of spam
detected in the second week of March 2020.

Country

Sent spam share in all blocked spam1

United States

18.4%

Almost a fifth of all unsolicited emails detected in Q1 came from the United States, followed by Poland, France, Japan and Germany. Emails where the sender country could not be
identified accounted for 13% of the spam volume. Looking at spam in relation to all emails
sent from the individual countries, Vietnam, Lithuania, Argentina, China and India were in
the lead, with spam accounting for more than a half of all email sent.

2

Unknown

12.9%

3

Poland6.6%

4

France

5.9%

5

Japan

5.2%

When interpreting the data, it should be taken into account that our visibility into spamtraffic is limited, as emails may be filtered at the internet email service provider, orelsewhere, before reaching ESET’s antispam solution on client machines. However, thefact that the detected spam traffic may have bypassed other antispam solutions further
signifies its threat potential.

6

Germany

4.5%

7

Russia4.0%

8Lithuania

3.8%

9

China

3.4%

It is also important to note that the geographic data is distorted by the distribution of
the ESET client base. This bias is less prominent on the sender side, where the countriesof origin for spam emails are determined from the emails themselves.

10

India

3.1%

7-Jan-2020

7-Feb-2020

7-Mar-2020

Spam detection trend in Q1 2020, seven-day moving averageCountries with highest volume of spam sent in Q1 2020

Country

Spam share in all emails sent from the country

1

Vietnam

71.7%

2

Lithuania

70.6%

3

Argentina

57.2%

4

China

56.1%

5

India

54.3%

6

Brazil43.9%

7Indonesia

40.5%

8

Colombia

34.5%

9South Korea

31.5%

10

France25.4%
Countries with highest share of spam in all emails sent in Q1 2020

ESET THREAT REPORT Q1 2020 | 22

Coronavirus spam
As if the coronavirus outbreak wasn’t serious enough by itself, fraudsters wasted notime in trying to profit from the uncertainty, fear, and supply shortages connected tothe crisis. In March 2020, we detected a flood of COVID-19 themed spam, spreading malware, phishing for sensitive information, or offering bogus products — face masks, natural
coronavirus remedies, or even a purported list of ingredients for a coronavirus vaccine.

the spammers incorporated characters from the Greek alphabet that look very similar tostandard Latin characters into the email’s text — for example, α (lowercase Alpha) is usedinstead of lowercase a. In another twist on the same tactic, extortionists tried to intimidate the recipients by claiming the emails came from a neighbor — someone who is close by
and could easily infect them if they didn’t pay up.

In multiple campaigns, spammers took to impersonating the World Health Organization(WHO), aiming to manipulate unsuspecting users into opening malicious links or attachments. The WHO, a major source of information about the pandemic, has addressed thisconcerning trend on its website [32].

Spam email impersonating the WHO

Upsettingly, cybercriminals in the extortion email business have also been trying to profit from the coronavirus crisis, going as far as threatening to infect email recipients andtheir families with coronavirus if no ransom is paid.
Coronavirus-themed extortion scam emails

In the spam campaign shown in the screenshot on the upper right, criminals took an email
template from one of the many previous (s)extortion scam campaigns [33] and customized it to fit the coronavirus pandemic theme. In an attempt to fool antispam engines,

As with most email extortion campaigns, the claims in these emails are unfounded andshould be treated as any other spam email.

ESET THREAT REPORT Q1 2020 | 23

IoT security
Years-old vulnerabilities that allow attackers to bypass access controls dominate the list of most frequent flaws detected on IoT devices.
Devices referred to as Internet of Things often suffer from vulnerabilities or misconfiguration issues that allow them to be exploited. ESET’s router vulnerability scanner module
scanned over a hundred thousand routers worldwide this quarter showing vulnerabilities
that could result in unauthorized access — such as password or information leakage or
directory traversal — to be the predominant type of IoT issues.
This finding is further bolstered by this kind of flaw representing seven of the top ten
IoT vulnerabilities detected by ESET’s scanner. What stands out is also the age of thefront-runners in that list. According to ESET telemetry, none of the top 10 were discovered after 2017 and five out of the ten have been known since 2014.
The leading vulnerability — CVE-2012-5687 [34] — is even older and was first reported in
October 2012. Despite being around for seven-plus years it still accounts for 19% of all
vulnerabilities found. Old command-injection vulnerabilities are quite prevalent too,occupying second (CVE-2014-8361 with 12%) and third (CVE-2014-9583 with 8%) places.
ESET’s telemetry also provides insight into the prevalence of cases when hosted services
are protected by weak or default passwords. Such linkage seems to be particularly strongin cases where HTTP was used, representing 63% of detections, followed by telnet with
22% and FTP with 13%.
CVE-2012-5687 bad access rights

19.5%

CVE-2014-8361 command injection

11.6%

CVE-2014-9583 command injection

7.8%

CVE-2014-1225 cross-site scripting

7.1%

CVE-2015-0554 bad access rights

4.4%

CVE-2014-2962 bad access rights

4.0%

CVE-2014-4019 bad access rights

3.4%

CVE-2013-5947 bad access rights

3.1%

CVE-2017-6190 bad access rights

2.6%

CVE-2015-7254 bad access rights

2.5%

Top 10 vulnerabilities detected by ESET’s router vulnerability scanner module (% of vulnerability detections)

21.8%

HTTP
62.9%

Telnet

FTP

HNAP

13.4%
2.0%

Weak password prevalence per hosted service in Q1 2020

A powerful illustration of how deficiencies in IoT security can severely weaken securityof entire networks is illustrated by the KrØØk vulnerability [5].
KrØØk manifests itself as wireless network data being encrypted with a WPA2 pairwise
session key that is all zeros and occurs on vulnerable chips following a Wi-Fi disassociation (“disconnection”). Such disassociations (and reassociations) occur naturally for avariety of (legitimate) reasons, such as signal interference or roaming between accesspoints. Thus, anyone sniffing network data is theoretically able to decrypt the small
amount of data that was that was queued for transmission just before the disassociation.
Obviously, such a passive approach would require a large element of luck in order toobtain any data of interest.
For a much more effective attack, an active adversary can exploit KrØØk by manually triggering disassociations on the target’s device repeatedly, thus greatly increasing the
likelihood of intercepting (potentially sensitive) data of interest.

When compared to other techniques commonly used against Wi-Fi, exploitingKrØØk has a significant advantage for attackers: while they need to be in rangeof the Wi-Fi signal, they do not need to be authenticated and associated to the
WLAN. In other words, they don’t need to know the Wi-Fi password.”Robert Lipovský, ESET Senior Malware Researcher
ESET THREAT REPORT Q1 2020 | 24

Presentations
RSAC 2020KrØØk: How KRACKing Amazon Echo Exposeda Billion+ Vulnerable Wi-Fi Devices [7]

ESET RESEARCHCONTRIBUTIONSIn the first public presentation on the topic, ESET’s
Robert Lipovský and Štefan Svorencík unveiledKrØØk, a previously unknown security flaw affecting
the encryption of over a billion Wi‑Fi devices including some by Apple, Google, and Samsung.
Hunting Linux Malware for Fun and Flags [35]In a hands-on, technical workshop, ESET researcher
Marc-Étienne M.Léveillé addressed the need to train
Linux system administrators to analyze and better
understand server-side Linux threats. His tutor­
ial aimed at creating an environment where Linuxprofessionals had the opportunity to study suchthreats safely and effectively.

BlueHat IL
Tactics, Techniques and Procedures of the World’s
Most Dangerous Attackers [36]
ESET malware researcher Robert Lipovský shared
the lessons learned from analyzing some of themost significant cyberattacks in history, focusing
on the TTPs of Sednit, also known as APT28, and of
Telebots, also known as Sandworm.
Attor: Spy Platform with Curious GSM Fingerprinting[37]

Latest engagements and achievementsof ESET Research experts

ESET malware researcher Zuzana Hromcová introduced Attor, a novel spy platform used in targeted
attacks against high-value targets. Attor’s defining features are a complex modular architecture,elaborate network communication and a unique
plugin to fingerprint GSM devices.
ESET THREAT REPORT Q1 2020 | 25

MITRE ATT&CK contributions
Besides publishing, and presenting their findings at conferences, ESET researchers
regularly contribute to MITRE ATT&CK® [38] — a globally-accessible knowledge base ofadversary tactics and techniques.
As of April 2020, ESET is one of the top five contributors to the ATT&CK Enterprise Matrix[39], one of the first and most active contributors to the Mobile Matrix [40], and one of
the most heavily referenced sources in both matrices.
At the time of writing, there are more than 100 contributors and 300 referenced sources
for the Enterprise Matrix and six contributors and more than 100 referenced sources for
the Mobile matrix.

Contributions from the threat intelligence community play a critical role inhelping us refine and extend the coverage of the MITRE ATT&CK® knowledge
base. Making cyberspace safer requires a collaborative effort, and the realworld reporting of adversary tactics and techniques from outside sources
helps make ATT&CK a valuable asset for defenders.
Adam Pennington, MITRE ATT&CK Lead

ESET’s contributions include new entries to the Enterprise and Mobile Techniques, Groups
and Software categories, as well as extensions of existing entries.
In the Enterprise Techniques category, one of ESET‘s notable contributions is the uniqueTransport Agent (T1505) [41] arising from ESET’s analysis of LightNeuron [42], a backdoor
used by the Turla group. LightNeuron implements a malicious Microsoft Exchange transport
agent for persistence.
The Software category features LoJax (S0397) [43], a UEFI rootkit used by Sednit (alsoknown as APT28), discovered [44] by ESET and the first UEFI rootkit found in the wild.
In the Groups category, one of ESET’s contributions is Machete (G0095) [45], a cyberespionage group with high-profile targets in Latin American countries, reported [46] by ESET
researchers to have stolen gigabytes of confidential data over the course of a year.
ESET’s Android threat research also made it into ATT&CK — the Mobile category includes
the Input Injection (T1516) [47] and Access Notifications (T1517) [48] techniques, used byvarious kinds of data-stealing Android malware.
Along with ESET references on the ATT&CK website, readers will also find tables mapping
adversary techniques to the ATT&CK knowledge base in the end sections of ESET research
publications on the WeLiveSecurity blog [49].

Other contributions
ESET researchers have also been contributing to the YARA code base, a tool widely used by
the malware research community. In Q1 2020, ESET had two pull requests merged into themain code base.
The first accepted pull request [50], based on research by ESET malware researchers Peter
Kálnai and Michal Poslušný, extended YARA’s Rich Header functionality to better represent
the underlying data and enable full utilization of Rich Header data.
The second contribution [51] driven by ESET malware researcher Anton Cherepanov, improves YARA’s PE module by adding a new feature for parsing PDB strings. This new feature
makes it possible to create better YARA rules to hunt and detect Windows malware thathas specific keywords in PDB paths.

ESET among the top 5 contributors and top 10 referenced sources in the MITRE ATT&CK Enterprise Matrix

ESET THREAT REPORT Q1 2020 | 26

Credits

About the data in this reportTeam

Contributors

Peter Stancík, Lead
Klára Kobáková, Managing Editor

Igor Kabina
Jakub Soucek
Ján Šugarek
Jean-Ian Boutin
Jirí Kropác
Juraj Jánošík
Ladislav Janko
Lukáš Štefanko
Martin Abrahámek
Martin Cerven
Martin Lackovic
Mathieu Tartare
Matthieu Faou
Milan Fránik
Miloš Cermák
Miroslav Legén
Miroslav Rolko
Patrik Sucanský
Robert Lipovský
Zoltán Rusnák

The threat statistics and trends presented in this report are based on global telemetry
data from ESET. Unless explicitly stated otherwise, the data includes detections regardless of the targeted platform and includes only unique daily detections per device.

Aryeh Goretsky
Bruce Burrell
Nick FitzGerald
Ondrej Kubovic
Petr Blazek

Foreword
Roman Kovác, Chief Research Officer

This data was processed with the honest intention to mitigate all known biases, in aneffort to maximize the value of the information provided.
Further, the data excludes detections of potentially unwanted applications [52],potentially unsafe applications [53] and adware, except where noted in the more detailed,platform-specific sections and in the Cryptominers section.
Most of the charts in this report show detection trends rather than providing absolute
numbers. This is because the data can be prone to various misinterpretations, especiallywhen directly compared to other telemetry data. However, absolute values or orders ofmagnitude are provided where deemed beneficial.

ESET THREAT REPORT Q1 2020 | 27

References[1] https://www.krackattacks.com/#paper

M03H_01_Feds-Fighting-Ransomware-How-the-FBI-Investigates-and-How-You-Can-Help.pdf[2] https://www.welivesecurity.com/2019/10/17/alexa-how-amazon-echo-kindle-got-kracked/[26] https://youtu.be/LUxOcpIRxmg[3] https://www.icasi.org/[27] https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-led-action-takes-aim-atcryptojacking-in-Southeast-Asia[4] https://www.welivesecurity.com/2020/02/26/krook-serious-vulnerability-affected-encryptionbillion-wifi-devices/[5] https://www.welivesecurity.com/wp-content/uploads/2020/02/ESET_Kr00k.pdf[28] https://www.welivesecurity.com/2019/02/28/coinhive-cryptocurrency-miner-to-call-it-a-daynext-week[6] https://www.eset.com/int/kr00k/[29] https://www.welivesecurity.com/2019/05/17/eternalblue-new-heights-wannacryptor/[7] https://www.rsaconference.com/usa/agenda/kr00k-how-kracking-amazon-echo-exposed-a-billionvulnerable-wifi-devices[30] https://www.welivesecurity.com/2019/05/22/patch-now-bluekeep-vulnerability/[8] https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operatingcovertly-since-2012/[32] https://www.who.int/about/communications/cyber-security[9] https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminalactivities/[34] https://nvd.nist.gov/vuln/detail/CVE-2012-5687[10] https://www.welivesecurity.com/2020/03/19/stantinko-new-cryptominer-unique-obfuscationtechniques/[36] https://www.bluehatil.com/abstracts#collapse-Tactics[11] https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/[12] https://www.welivesecurity.com/2019/10/14/connecting-dots-exposing-arsenal-methods-winnti/[13] https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/[14] https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/[15] https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong[16] https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-wateringholes/[31] https://www.welivesecurity.com/2019/12/17/bluekeep-time-disconnect-rdp-internet/[33] https://www.welivesecurity.com/2018/07/26/i-saw-what-you-did-or-did-i/[35] https://www.rsaconference.com/usa/agenda/hunting-linux-malware-for-fun-and-flags[37] https://www.bluehatil.com/abstracts#collapse-GSMFingerprinting[38] https://attack.mitre.org/[39] https://attack.mitre.org/matrices/enterprise/[40] https://attack.mitre.org/matrices/mobile/[41] https://attack.mitre.org/techniques/T1505/[42] https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf[43] https://attack.mitre.org/software/S0397/[17] https://nvd.nist.gov/vuln/detail/CVE-2017-11882[44] https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf[18] https://www.welivesecurity.com/2017/12/04/eset-takes-part-global-operation-disruptgamarue/[45] https://attack.mitre.org/groups/G0095/[19] https://www.bleepingcomputer.com/news/security/emotet-malware-restarts-spam-attacks-afterholiday-break/[47] https://attack.mitre.org/techniques/T1516/[20] https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/[49] https://welivesecurity.com/[21] https://www.bleepingcomputer.com/news/security/maze-ransomware-not-getting-paid-leaksdata-left-and-right/[50] https://github.com/VirusTotal/yara/pull/1135[22] https://www.welivesecurity.com/2020/03/23/good-bad-plain-ugly/[23] https://twitter.com/CryptoInsane/status/1240668834190839808[46] https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf[48] https://attack.mitre.org/techniques/T1517/[51] https://github.com/VirusTotal/yara/commit/a72945ce44ce70bd7193e94c16e8bef580e35038[52] https://help.eset.com/glossary/en-US/unwanted_application.html[53] https://help.eset.com/glossary/en-US/unsafe_application.html[24] https://www.us-cert.gov/ncas/alerts/aa20-049a[25] https://published-prd.lanyonevents.com/published/rsaus20/sessionsFiles/17627/2020_USA20_SEMESET THREAT REPORT Q1 2020 | 28

About ESETFor more than 30 years, ESET® has beendeveloping industry-leading IT security
software and services for businesses
and consumers worldwide. With solutions
ranging from endpoint and mobile
security to encryption and two-factor
authentication, ESET’s high-performing,easy-to-use products give consumers andbusinesses the peace of mind to enjoy thefull potential of their technology. ESET
unobtrusively protects and monitors 24/7,
updating defenses in real time to keep
users safe and businesses running without
interruption. Evolving threats require an
evolving IT security company. Backed by
R&D centers worldwide, ESET is the first IT
security company to earn 100 Virus Bulletin
VB100 awards, identifying every single “inthe-wild” malware without interruption
since 2003. For more information, visit www.
eset.com or follow us on LinkedIn, Facebook,and Twitter.

WeLiveSecurity.com@ESETresearch
ESET GitHub