Threat
ReportH1 2024
December 2023 – May 2024

(eset):research

ESET THREAT REPORTContents
Foreword4
Threat landscape trends 5
GoldDigger tunneling from Asia to new territories6
Ebury lives on, plundering Linux servers10
Malware posing as generative AI assistants12
More WordPress plugin vulnerabilities, more malicious scripts14
Scripted encounters: Cybercriminals preying on gamers16
Downloaders switch delivery methods to stage a comeback19
Look back at LockBit: Life after Operation Cronos?21

Threat telemetry23
Research publications36
About this report38
About ESET39

H1 2024 | 2

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 3

Executive summary
Android iOS Financial threats

Infostealers Web threats Gaming

GoldDigger tunneling from Asia to new territories

Scripted encounters: Cybercriminals preying on gamers

New Android and iOS trojan steals facial recognition data from victims in Asia to create
deepfake videos for authentication of financial transactions. An older Android sibling also
found its way to Latin America and South Africa.

Infostealers threaten personal data of gaming enthusiasts.

Linux Botnets Infostealers
Ebury lives on, plundering Linux servers
With hundreds of thousands of servers compromised, Ebury operators deploy tools to

Downloaders
Downloaders switch delivery methods to stage a comeback
After upheaval in 2022, downloader threats are slowly coming back to life.

Ransomware

maximize profits.

Look back at LockBit: Life after Operation Cronos?

AI Web threats Infostealers

Post disruption, life for the LockBit ransomware gang shows signs of struggle as more threat
actors utilizing the leaked LockBit builder loom large.

Malware posing as generative AI assistants
A quick look behind fake generative AI assistants used as traps set by infostealers.

Web threats
More WordPress plugin vulnerabilities, more malicious scripts
Over 20,000 websites in H1 2024 compromised via injections of malicious JavaScript code.

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 4

Foreword
Welcome to the H1 2024 issue of the ESET Threat Report!
These past six months painted a dynamic landscape of Android
Financial threats – malware going after victims’ mobile banking
funds – be it in the form of “traditional” banking malware or,more recently, cryptostealers.
A curious newcomer on this scene is GoldPickaxe, new mobile
malware capable of stealing facial recognition data to create
deepfake videos used by the malware’s operators to authenticate
fraudulent financial transactions. Armed with both Android and
iOS versions, this threat has been targeting victims in Southeast
Asia through localized malicious apps. As ESET researchers dug
into this malware family, they discovered that an older Android
sibling of GoldPickaxe, called GoldDiggerPlus, has also tunneled
its way to Latin America and South Africa by actively targeting
victims in these regions.
Keeping up with the times, infostealing malware can now befound impersonating generative AI tools as well. In H1 2024,
Rilide Stealer was spotted misusing the names of generative AI
assistants, such as OpenAI’s Sora and Google’s Gemini, to enticepotential victims. In another malicious campaign, the Vidar
infostealer was lurking behind a supposed Windows desktop app
for AI image generator Midjourney – even though Midjourney’s

AI model is only accessible via Discord. Since 2023, we have been
increasingly seeing cybercriminals abusing the AI theme – atrend that is expected to continue.
Gaming enthusiasts who venture out from official gaming
ecosystems could unfortunately discover that infostealer
threats have also found a way to spoil their favorite hobby:
some cracked video games and cheating tools used in online
multiplayer games were recently found to contain infostealer
malware such as Lumma Stealer and RedLine Stealer.
RedLine Stealer saw several detection spikes in H1 2024, causedby one-off campaigns in Spain, Japan, and Germany. Although
this “Infostealer-as-a-Service” suffered a disruption in 2023 andappears no longer to be under active development, its recent
waves were so significant that RedLine Stealer detections in H1
2024 surpassed those from H2 2023 by a third.
Balada Injector, a gang notorious for exploiting WordPressplugin vulnerabilities, continued to run rampant in the first halfof 2024, compromising over 20,000 websites and racking up
over 400,000 hits in ESET telemetry for the variants used in the
gang’s recent campaign.

On the ransomware scene, former leading player LockBit
was knocked off its pedestal by Operation Chronos, a global
disruption conducted by law enforcement in February 2024.
Although ESET telemetry recorded two notable LockBit
campaigns in H1 2024, these were found to be the result of nonLockBit gangs using the leaked LockBit builder.
The Ebury botnet, previously examined in ESET's 2014 white
paper Operation Windigo, remains dangerous even ten years
later: recent investigation by ESET researchers uncovered that
this threat has compromised nearly 400,000 servers since 2009.
Although Ebury’s toolkit was already substantial at the time ofthe original research, these latest findings revealed expanded
functionalities of the botnet, focusing mostly on monetization
methods such as cryptocurrency and credit card theft.
I wish you an insightful read.
Jiří Kropáč
ESET Director of Threat Detection

Executive summary

Foreword

Threat landscape trends

ThreatlandscapetrendsThreat telemetry

Research publications

About this report

About ESET

H1 2024 | 5

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

Android iOS Financial threats

GoldDigger tunneling from Asia to new
territories
New Android and iOS trojan steals facial recognition data from victims in Asia to create
deepfake videos for authentication of financial transactions. An older Android sibling also
found its way to Latin America and South Africa.
During the first half of 2024, ESET telemetry recordedThis category witnessed a relatively modest decreasea substantial decrease in the detection of nearly allin H1 2024, compared to the previous half year, of 3.8%,

Android threats we track. Despite fluctuations indemonstrating no significant changes in detection

many of these categories, often influenced by seasonalrates over the past two years. However, malware

events such as Christmas and similar holidays (asin this category has exhibited ongoing changes in

discussed in ESET Threat Report T3 2022), Android

behavior and the methods used to victimize its targets.

Financial threats have remained consistently prevalent.

In ESET Threat Reports, Android Financial threats incorporate both Android banking
malware and cryptostealers. This merger reflects the fact that many banking trojans havebegun to incorporate functionality for stealing credentials to cryptocurrency wallets andpilfering these funds, leading us to consolidate these threats into a single category.
Android Financial threats detection trend from H2 2022 to H1 2024, seven-day moving average

H1 2024 | 6

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 7

GoldPickaxe picking both Android
and iOSinformation, steal banking app credentials, intercept

creation is facilitated by face-swapping artificial

The GoldPickaxe Android version, detected by ESET

unique feature that enables threat actors to make

Although GoldDiggerPlus has primarily targeted victims

intelligence services and such videos are then usedsecurity solutions as Android/Spy.Banker.CNA,

real-time calls to their victims. When a victim taps onin Southeast Asia, ESET telemetry data shows us thatfor authentication of financial transactions. The

is distributed via websites posing as the official

the customer service button within the malicious app,

this trojan has been detected also in Latin America andmalware, dubbed GoldPickaxe, has both Android and

Google Play store. The iOS version, detected by ESET

the malware attempts to connect with an available

South Africa. Further, we can confirm that the threat

iOS versions and focuses on owners of cryptocurrency

security solutions as iOS/Riskware.Frp.A, was initiallymember of the gang behind this threat, creating

actors behind GoldDiggerPlus are actively targeting

wallets and clients of financial services provided in

distributed through Apple’s mobile application testing

the illusion that the cybercriminals are operating athese regions and that these detections do not merely

Southeast Asia. ESET discovered that an older Android

platform, TestFlight; however, after its removal fromlegitimate customer service center.

represent Southeast Asian device owners located insibling of GoldPickaxe, called GoldDiggerPlus, has alsothat platform, the threat actors adopted a moretunneled its way from this region to Latin America andsophisticated approach. They now use a multistage

South Africa.

social engineering scheme to persuade victims toAdding to this dynamic landscape, Group-IB discovereda malware family stealing facial recognition data,
which is then used to create deepfake videos. The

Facial recognition data has become an important partof the digital authentication process and is thereforeof interest to cybercriminals. Certain financial apps,these other countries.

allows the threat actors to gain complete control overthe victim’s iOS device.
Group IB believes the threat actor behind GoldPickaxe

record a brief video of their faces from various angles

is a group it calls GoldFactory – a well-organizedusing the front camera of their mobile device. This isChinese-speaking cybercrime group – which isin addition to uploading images of both sides of theiralso behind GoldPickaxe’s siblings: GoldDigger

personal identification documents. Such videos are

and GoldDiggerPlus. GoldPickaxe is in fact based

used for identity verification purposes. This process,on GoldDigger. While we are unable to confirm

often referred to as biometric authentication orsome of the findings about GoldFactory, we werefacial recognition, helps financial apps confirm thatable to detect changes in the distribution of somethe person creating the account or conducting the

GoldDiggerPlus variants, which are detected by ESET

transaction is the same individual who owns the

security products as Android/Spy.Banker.CAY and

identification documents provided. Ironically, it wasAndroid/Spy.Banker.CMQ.

identity theft and fraudulent activities.

The latest known version, GoldDiggerPlus, has ainstall a Mobile Device Management profile, whichor those used in specific regions, require that users

intended to add an extra layer of security to prevent

SMS messages, and carry out a range of other actions.

In active pursuit of new victims
in Latin America and South Africa

GoldDigger has only Android versions and abuses
Android accessibility services to extract personal

Malicious versions of the Mexican Hey Banco app, South African Barko Financial Services, and Peruvian Alfin Banco as provided via a website
impersonating Google PlayESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 8

The GoldDiggerPlus malware that we analyzed

For instance, misusing Android accessibility services

disguises itself as the official apps of Alfin Banco

allows attackers to trigger and log any event on

in Peru, Hey Banco in Mexico, and Barko Financial

a device, thereby gaining full control, and theServices in South Africa. The distribution method

Virtual Network Computing technology facilitates

is identical to that used in Southeast Asia, with thethe streaming of the victim’s screen in real-time.
Attackers have also developed Automated Transfer
Systems, which enable the unauthorized transfer or45%

deposit of funds from the victim’s account, making
the transaction appear less suspicious; they have0%

found ways to bypass software-based two-factor
authentication systems like Google Authenticator;
and they can bypass the Restricted Settings security
measure introduced in Android 13.
Whenever a new mobile financial threat surfaces, it
frequently exhibits links to Latin America or Southeast
Asia. These regions have increasingly become

Geographic distribution of GoldDiggerPlus detections in H1 2024

malicious apps being distributed through websites thatimpersonate the official Google Play store. All thesemalicious apps are provided in the local language of

Malicious version of the Mexican Hey Banco app prompting theuser to register, but it is written in Chinese

epicenters for cybercriminal activities, particularly

Tactical changes in Financial
threats

involving mobile financial threats. However, in the past
two years, Türkiye (formerly known as Turkey) has
been the country most impacted by Android financial
threats according to ESET telemetry.

the targeted region. Interestingly, traces of Chinese

In recent years, Android Financial threats havecan occasionally be detected within the apps, forsignificantly evolved in response to enhanced security

The reason for Türkiye’s top position, and theinstance, when users input fake or incorrect data intomeasures and the changing digital landscape. The

prevalence of these threats in Latin America, Southeast

the malicious version of the Hey Banco app, they aretactics employed by the GoldDigger family described

Asia, and certain African countries, is straightforward:

presented with a message in Chinese that translates

above represent only a fraction of the adaptations

rapid digital transformation. A significant portion of theto “Your mobile phone number does not exist, pleasemade by threat actors. Such changes are driven by

population in these regions bypass the stage of owning

register first”. Amusingly, the “confirm” button is

attackers’ pursuit of more sophisticated and lessa PC or laptop and move directly online through thecorrectly localized.

detectable methods of intrusion.

use of smartphones. Many individuals who previously

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESETNEW COMPROMISE VECTORSFOR IOS DEVICES?

App Store. This change, influenced by several

The prevalence of threats on the iOS platform iscompetitors, offering consumers broader choice.

notably lower compared to other operating systems,

18%

but not nonexistent, as illustrated by the iOS version
of GoldPickaxe. This lower risk is primarily due to0%Apple’s rigorous app approval process and the closed
environment of the iOS ecosystem. It operates
on a sandboxing principle that isolates each app,preventing them from interfering with each otherand even easily accessing each other’s data, hence
reducing potential malicious activities. This principle

Geographic distribution of Android Financial threats detections in H1 2024

also means a security app on an iOS device can’t

lacked access to traditional online banking services are

However, tracking some of the declining Android

scan the entire device or other apps, only itself,

now using their smartphones for financial transactions.

threats is becoming harder, because they arrive on

making threat detection more challenging. Typically,

This swift shift to digital banking has, unfortunately,

the device via droppers. These programs are often

potential iOS threats should be identified andalso sparked a rise in cybercrime. Cybercriminals

disguised as legitimate apps and once they are installed

mitigated by Apple’s built-in security protocols.

often target these regions, taking advantage of theiron a device, they can deploy a variety of malicious

vulnerabilities to commit fraud.

software, usually without the user’s knowledge. The

Historically, unlike Android, iOS hasn’t allowed

The stable detection trend of Android Financial threats
occurred against the backdrop of declines in nearly all
categories we monitor: HiddenApps (-67%), Spyware(-43%), SMS trojans (-25%), Adware (-23%), Stalkerware(-22%), Ransomware (-18%), and Clickers (-15%). This
has led to an overall drop in detections of all Android
threats by 41%. Bucking this downward trend was theScam apps category, which saw an 18% increase.

main purpose of a dropper is to ensure the persistenceof the malware on the device, even if the malicious app
it initially installs is detected and removed. In H1, we
saw several common droppers installing HiddenApps,
but ESET telemetry cannot track them as HiddenApps
because these droppers can install different kinds ofthreats, or even completely change what they install in
the future. Nevertheless, droppers also saw a decline
during the first half of this year.

H1 2024 | 9

apps to be downloaded from third-party sources,
further reducing the chance of encountering
threats. However, a significant shift in this policy ison the horizon – at least for iOS device users in theEuropean Union (EU).
Driven by the European Commission’s DigitalMarkets Act, EU-based iOS users will soon be able
to download apps from websites and alternative
app marketplaces, in addition to the traditional

lawsuits and regulatory scrutiny, aims to open up
Apple’s traditionally closed ecosystem to smaller
However, this change comes with its own setof challenges. To safeguard users, Apple has
implemented a Notarization process for all apps
regardless of distribution channel, ensuring that theymeet baseline platform integrity standards. The new
web download program requires developers to meet
specific criteria, such as having an app with over one
million downloads in the EU. Moreover, companies
can offer an app store for iPhones in the EU, so longas it only offers access to one company’s apps.
Despite this, potential attackers could still findways to exploit this system by disguising malicious
software as legitimate apps, or compromising lesssecure alternative app marketplaces. How soon they
will be able to do this is yet to be seen.
ESET advises EU users to be cautious when
downloading iOS apps from unfamiliar sources, andto understand that Apple’s ability to assist withissues related to apps downloaded from outside the
App Store will be limited.

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESETLinux Botnets Infostealers

Ebury lives on, plundering Linux servers
With hundreds of thousands of servers compromised, Ebury operators deploy tools tomaximize profits.
Ten years ago, ESET Research released a white

In May 2024, after a long-term and extensive

paper describing a large-scale campaign nicknamed

investigation of the botnet in collaboration with law

Operation Windigo, in which malicious actors

enforcement, ESET Research published a new white

employed a botnet to compromise thousands of Linux

paper detailing our updated findings.

and Unix servers with the Ebury malware family.
Despite the arrest and extradition of one perpetrator in
2015, the botnet’s activities persist to this day: Ebury’s
numbers have been rising more-or-less continually
since 2009, with regular updates occurring on tensof thousands of servers annually, resulting in nearly
400,000 affected servers overall.

Although Ebury’s toolkit was already quite substantial
at the time of the original research, ESET’s customized
honeypots, along with law enforcement’s help, revealed
expanded functionalities of the botnet. These focus
mostly on making money from the compromised
servers via various means, such as cryptocurrency andcredit card theft.

Ebury is an OpenSSH backdoor and credential stealer that forms the core of a cluster ofserver-side threats, initially used for web redirections, Windows malware delivery, andspamming. The Ebury botnet nowadays also intercepts HTTP POST requests made to theservers to steal financial details from transactional websites.
Ebury deployments per month since 2009, logarithmic Y axis

H1 2024 | 10

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

When going after cryptocurrency funds, Ebury

Ebury’s decades-long, large-scale operations and its

leverages its presence in data centers worldwide toability to compromise even the most knowledgeable

conduct adversary-in-the-middle attacks. Once theLinux users, such as those running linux.org,

operators identify a valuable server, they are able tohighlight multiple gaps in the state of Linux security.

redirect network traffic to a system under their control
to capture its SSH credentials and subsequently run
scripts to exfiltrate cryptocurrency wallet data fromthe system.

Much more technical detail is available in the white
paper, as is advice for those wanting to make surethat their systems are safe. The latter is tricky due tothe rootkit techniques employed by Ebury malware,

As for credit card theft, the botnet makes use of

but methods for detecting the presence of userland

network traffic eavesdropping, waiting for the

rootkits using various techniques are also provided.

moment victims submit their credit card information

Note that to ensure that an Ebury-compromised

to a compromised online store. Once the data issystem is completely free from ongoing compromise,

submitted, Ebury can deploy various tools to intercept

a complete reinstallation is necessary, without reusing

the information.

any of the keys or credentials from the affected server.

In addition to stealing credit card data andcryptocurrency funds, the threat actors behind Ebury
developed other means to further support theirmonetization efforts. These include Apache modules
exfiltrating HTTP requests or proxying traffic, Linuxkernel modules performing redirections, and modified
Netfilter tools injecting firewall rules.
The visibility into perpetrator activities also shed lighton how Ebury propagates by stealing credentials
and compromising hosting provider infrastructure,
deploying malware on all customer-rented servers,
sometimes resulting in thousands of servers
compromised, hosting millions of domains.

Research publications

About this report

About ESET

H1 2024 | 11

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESETAI Web threats Infostealers

Malware posing as generative AI assistants
A quick look behind fake generative AI assistants used as traps set by infostealers.
ESET telemetry has recorded various attempts to
use the names of generative AI assistants to spreadmalware. Perhaps the most interesting cases weobserved in H1 2024 are a malicious Chrome browser
extension, known as Rilide Stealer, and a malicious
installer claiming to provide a desktop app for AI
software but delivering the Vidar infostealer instead.

Rilide Stealer
In the case of the malicious browser extension, it isdelivered to victims who have been duped into clicking
on malicious ads, typically on Facebook, that promise
the services of a generative AI model. Although theextension itself masquerades as Google Translate, it
offers the official webpage to one of the AI services
used as a lure; the lures include OpenAI’s Sora and
Google’s Gemini. Detected as JS/Extenbro.Agent.EK

Rilide Stealer V4 Chrome browser extension, masquerading as
Google Translate

and JS/Extenbro.Agent.EP by ESET security products,
this extension is actually an infostealer, known as

Since August 2023, ESET telemetry has recorded overRilide Stealer V4, that goes after Facebook credentials.

4,000 attempts to install the malicious extension.

Detection trend of Rilide Stealer V4 browser extension, seven-day moving average

H1 2024 | 12

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Vidar infostealer

The installer, detected as Java/TrojanDownloader.

Spread via Facebook ads, Telegram groups, and dark

AutoIt version 3, which in turn delivers Vidar. This

web forums, the malicious installer purports to offer
Midjourney, an AI image generator, but delivers
the Vidar infostealer instead. Upon execution, if theinstaller detects that a Java runtime environment(JRE) is not installed on the system, an error message
about the missing runtime is shown and the official
Java download page is opened; Java is required for the
installer to run. If the JRE was already installed, then asplash screen advertising Midjourney is shown.

Research publications

About this report

About ESET

Agent.NWR, drops several pieces of malware andinfostealer can log keystrokes, and pilfer credentials
stored by browsers and data from cryptowallets.
However, Midjourney doesn’t offer a desktop app; its
AI model is accessible as a Discord bot on the official
Midjourney Discord server, by directly messaging the
bot in Discord, or by adding it to a third-party Discord
server. Considering the malware uses the nameMidjourney v6, it is attempting to pose as the latest
version of the Midjourney model currently available.

EXPERT COMMENT
Although the ongoing development of generative AI models has been accompanied bysafeguards to prevent their abuse, this has not prevented cybercrooks from pressing the
topic of generative AI into cybercriminal service. Since 2023, we have seen predominantly
infostealers abusing this theme and expect that trend to continue. Instead of clicking on
untrustworthy links promising access to generative AI models, always navigate to theofficial websites of the providers. And to stay protected against infostealers, make sure to
run reputable security solutions on your devices.
Jiří Kropáč, ESET Director of Threat Detection

Splash screen shown by Vidar infostealer installer, impersonating Midjourney

H1 2024 | 13

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

Web threats

More WordPress plugin vulnerabilities,
more malicious scripts
Over 20,000 websites in H1 2024 compromised via injections of malicious JavaScript code.
As noted in our H2 2023 Threat Report, exploiting

Most detections are due to JS/Agent.RJR, a new variant

vulnerabilities in WordPress plugins is a favored initial

first seen in 2024 with Poland (9%), France (7%), andaccess technique used by the Balada Injector gang. In

the US (6%) taking the largest individual shares of theseJanuary 2024, the gang struck again, causing a new

detections; however, .RJR is widely dispersed, including

wave of malicious JavaScripts from the JS/Agent family

Spain, Italy, and Germany at 5% each and Czechia at

to spring to life in ESET telemetry.

3%. Interestingly, other variants, such as .RKY and .RJZ,

The variants detected are the same as or similar tohave another variant embedded inside – .RKA.

those described in a Sucuri blogpost, released the

The total number of hits in ESET telemetry for thesame month, concerning ongoing attacks against

Balada Injector variants used in this campaign was overwebsites running vulnerable versions of the Popup

400,000, with the number of affected websites over

Builder WordPress plugin. The malicious scripts are all

20,000. In H1 2024, the .RJR variant took fourth placelightly obfuscated pieces of JavaScript whose main job

among all JS/Agent variants, contributing significantly

is to redirect to a malicious server and deliver further

to the ongoing swells seen in the trendline for thismalware, ultimately leading to the compromise of web

family since September 2023.

admin accounts and web servers, delivery of backdoors,
or targeting of the compromised website’s visitors.

Balada Injector detection trend in H1 2024, seven-day moving average

H1 2024 | 14

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

JS/Agent detection trend from June 2023 to May 2024, seven-day moving average

EXPERT COMMENT
Since the Balada Injector scripts could lead to the full take over of your web server, makesure to remove them from your website and update any vulnerable plugins to prevent
future exploitation. As the Balada Injector threat actors have an uncanny knack for installing
multiple persistence mechanisms, don’t forget to expunge those too by checking for rogue
admin accounts and malicious files on your web server, and to swap out credentials.
Ján Adámek, ESET Senior Detection Engineer

Research publications

About this report

About ESET

H1 2024 | 15

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 16

Infostealers Web threats Gaming

Scripted encounters: Cybercriminals preying
on gamers
Infostealers threaten personal data of gaming enthusiasts.
Video games have grown into a multi-billion-dollar

Fans of video games usually come into contact with

payloads of files masquerading either as cheating

When it comes to RedLine Stealer, it seems thisindustry and this success, understandably, attracts

malware by venturing out from the official ecosystem

software or as video game cracks. Looking at our

infostealer-for-hire refuses to die even after the

cybercrime. Some gaming companies have already(storefronts, official video game content repositories)

telemetry data, we can confirm that these two threatsdisruption conducted in 2023. Our data suggests

been targeted by ransomware gangs: the most recent

to the uncharted waters of torrent sites and shadywere still quite active in H1 2024.

that even though RedLine Stealer is no longer being

high-profile ransomware attack occurred near the

Discord servers offering cracked games and cheating

beginning of H1 2024, when the company Insomniac

tools. These grey areas are exactly where criminals

Games, developers best known for their two big-

thrive – the possibility of getting a game for free,budget Spider-Man games, fell victim to a large-scale

or of flawlessly executing headshots through walls

data leak after refusing to pay ransom to the notorious

in multiplayer shooters, constitute perfect bait for

Rhysida ransomware group. Sensitive data, ranging

unsuspecting gamers. What awaits the victims oncefrom developers’ personal information to Insomniac

hooked, are often infostealers that go after their

Games’ roadmap of future game releases, waspasswords, credit card data, or cryptowallets.

uploaded to the internet.
Even so, it is not only large businesses that are at risk;

Infostealers-as-a-Service

personal information of people who play video games

Frequently, these attacks are conducted using

is also an enticing target for cybercrooks, as evidenced

infostealers distributed as a service; both RedLine

by threat actors hiding malware payloads in all sorts ofStealer and Lumma Stealer, described in previous

game-related files.

ESET Threat Reports, have been found to be the

RedLine Stealer daily detection trend in H1 2024

ESET THREAT REPORT

Executive summary

Foreword

updated, it is still in use, though it’s mostly relegated to one-off campaigns
isolated to one or two countries – in 2024, its three biggest data peaks
were registered on January 25 (50% of detections registered in Germany),
April 24 (87% in Spain), and May 20 (91% in Japan). However, these peaks
were so significant that RedLine Stealer detections in H1 2024 have actuallysurpassed those from H2 2023, with the increase amounting to 31%.
After Lumma Stealer’s meteoric rise in H2 2023, detections of this threat,
which primarily targets cryptowallets, were going down in H1 2024. Yet,

Threat landscape trends

Threat telemetry

Research publications

About this reportCompromised mods
Gamers not inclined to pirate games or use cheats can still come acrossharmful files when downloading other video game-related assets. As an
example, mods, or modifications for a video game made by the game’s
fanbase, can also be compromised by cybercriminals. While it is best to stick
to well-known mod repositories or go through official platforms such as
Steam, there have been cases when even those weren’t safe.

About ESET

H1 2024 | 17

In June 2023, hackers managed to compromise several accounts on
Minecraft modding platforms and injected infostealing code into existing
projects. More recently, in December 2023, a popular mod for the game Slay
the Spire was breached to push Epsilon Stealer (which ESET detects as the
JS/PSW.Agent trojan, variants .CH and .CI) via the Steam update system. In
these cases, the best line of defense is to use up-to-date security softwareto help catch any potentially malicious files.

interestingly, there seems to have been a shift in the specific threat variants
used by the malware family. In H2 2023, ESET registered Lumma Stealer
detections mostly as Win/Spy.Agent.PRG; these have almost entirely
quieted in 2024. On the other hand, at the end of 2023, the malware
switched to a new variant, specifically to Win/Spy.Agent.QLD. In contrast
to the .PRG variant, .QLD was growing in H1 2024.

VIDEO GAME MODS
Modifications for existing video games, usually made by the fanbase and offered for free. These modifications can add newfeatures, alter the way in-game models look, or even add new gameplay and story content. Some popular video games
began as extensive mods; one of the most famous examples is the competitive first-person shooter Counter-Strike, which
originated as a mod for Half-Life. While many developer companies embrace mods made by their community, game modding
occupies a legal grey area due to copyright laws.

VIDEO GAME CRACKSVersions of games with their copy protection removed. This is usually done to bypass anti-piracy measures.

CHEATING TOOLS
Mostly used in online multiplayer games, cheating tools are third-party software enabling players to gain unfair advantages
over other players. Examples include aim assistance in first-person shooters (also known as aimbots), and making cheaters
able to see through objects (wallhack).
Win/Spy.Agent.PRG and Win/Spy.Agent.QLD detection trends in H2 2023 and H1 2024,
seven-day moving average

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

Phishing scams
Apart from being tricked into downloading malicious payloads, gamers can also fall victim to phishing scams.
According to ESET phishing feeds, gaming placed tenth in the top phishing website category ranking for H1 2024.

Social media

33.8%

Finance

15.2%

Email

13.4%

Shipping

8.4%

Cryptocurrency

7.5%

Document

6.8%

Telecommunications

4.6%

Gambling

3.5%

Shopping

3.5%

Gaming

3.4%

Top 10 phishing website categories in H1 2024

Phishing can get especially dangerous when it targets games with children as the primary audience. Last year, Cisco
Talos published a report about the many ways Roblox, a sandbox gaming platform very popular with kids, is being
abused by cybercriminals. Scams involving phishing were listed first in the list Cisco Talos compiled. Since Roblox
contains virtual currency named Robux that can be purchased with real money, it is a highly attractive target forcybercriminals. In our phishing feeds, we saw several instances of fake Roblox login screens or websites claiming togive out Robux to people upon signing in.

Phishing website impersonating Roblox at robuq[.]com

About ESET

H1 2024 | 18

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Downloaders

Downloaders switch
delivery methods tostage a comeback

Research publications

About this report

About ESET

H1 2024 | 19

H1

H2

+10%

After upheaval in 2022, downloader threats are slowly coming back to life.
With Microsoft’s disabling of internet macros in

two that did not experience significant growth. Based

2022, malicious downloaders took a significant hit,on ESET telemetry data, this phenomenon started at

especially those using macros. The subsequent demise

the end of January and has been continuing ever since,of Emotet, which relied extensively on this attack

suggesting elevated activity of threat actors in this area.

vector, seemed only to confirm that the golden age ofdownloaders was gone. This phenomenon was clearlyvisible in ESET telemetry: between 2022 and 2023,
the data shows a 65% drop in downloader numbers.
However, starting in the latter half of 2023, thesethreats slowly began to recoup their losses. In H2 2023,
they were already up by 10% when compared to H1 ofthe same year, and this upward trend continued in H1
2024 as well, with another increase of 10%.
The increase in H1 2024 actually concerns the majorityof downloaders we track. Looking at the top 10
downloaders detected in this period, there were only

Downloader detection trend in H2 2023 and H1 2024, seven-day moving average

MSIL/TrojanDownloader.Agent trojan

17.2%

To stay in the game once automatic macros had been

DOC/TrojanDownloader.Agent trojan

11.3%

disabled, many cybercriminals decided to change theirPowerShell/TrojanDownloader.Agent trojan

11.0%

JS/Danger trojan

10.7%

VBA/TrojanDownloader.Agent trojan

10.4%

delivery methods. Which is why, nowadays, the mostprevalent downloaders come in the form of spam
emails with attachments that contain non-macro
malicious scripts. These are executed after the victim
clicks on them.

VBS/TrojanDownloader.Agent trojan

8.9%

Win/TrojanDownloader.ModiLoader trojan

6.2%

One of the examples of this shift can be seen in the

BAT/TrojanDownloader.Agent trojan

2.8%

rise in emails with malicious JavaScript attachments,

PDF/TrojanDownloader.Agent trojan

2.7%

collected in our telemetry under the name JS/Danger

HTML/TrojanDownloader.FraudLoad trojan

2.3%

trojan. After a sharp detection decrease back in the

Top 10 Downloader detections in H1 2024 (% of Downloader detections)

ESET THREAT REPORT

H2

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

2.7%

H1
+36%

About ESET

H1 2024 | 20

2.0%

7.4%

MSIL

19.2%

JS
Win

9.0%

DOC
PowerShell
10.4%

14.5%

VBA
VBS
Other

11.0%

12.4%
11.4%

HTML
LNK

Downloader detections per detection type in H1 2024

JS/Danger trojan detection trend in H2 2023 and H1 2024, seven-day moving average

beginning of 2021, this malware family seems to be experiencing a renaissance, most recently seeing a 36% increasein H1 2024. In the same period, JS downloaders also became the second-most prevalent downloader category in
ESET telemetry.
The overall growth of downloaders goes hand in hand with rising detection numbers of malware families they
deliver. For example, the two biggest detection spikes of VBS/TrojanDownloader.Agent in the US (February 9 andMarch 8) were caused by variants downloading Agent Tesla, a notorious infostealer that was up by 40% in H1 2024.
Interestingly, even the threats that rely on macros saw growth in H1 2024: the VBA/TrojanDownloader.Agenttrojan family was up by 24%. We even registered a detection spike caused by VBA/TrojanDownloader.Agent.EGF, on
February 22. This variant comes in the form of a Word document macro that runs a short downloader PowerShell
script used to download further malware.

EXPERT COMMENT
The reason why the number of macro-reliant downloaders has risen could be merely acoincidence. Threat actors keep circulating these threats hoping that at least a fraction ofpeople might go and manually enable macros in their Microsoft documents. In this way,
the criminals’ approach is similar to the infamous advance-fee mailing schemes that offer
earnings too good to be true – the small number of people who fall for the trick is enoughfor the scam to be worthwile to the criminals.
Dušan Lacika, Senior Detection Engineer

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 21

Ransomware

Look back at LockBit:
Life after Operation
Cronos?
Post disruption, life for the LockBit ransomware gang shows signs of struggle as more threat
actors utilizing the leaked LockBit builder loom large.
Originating in 2019 from a ransomware family known

US judicial authorities issued indictments andas ABCD, LockBit went on to become a powerfulinternational arrest warrants against multiple LockBit

player in the ransomware scene, reportedly holding

co-conspirators. In addition, law enforcement agencies

the top place for share of ransomware attacks aroundmanaged to confiscate over 200 cryptowallets, foundthe world from September 2023 to April 2024. LockBit

a list of almost 200 affiliate names, unmasked the true

subsequently lost this mantle as a result of the banning

identity of LockBitSupp, and developed and released aof LockBitSupp – the notorious public face of LockBit

decryption tool.

– from hack forums such as XSS and Exploit, andeven more importantly, Operation Cronos, a global
disruption coordinated by the UK’s National Crime
Agency, Europol, and Eurojust in February 2024.

ESET telemetry corroborates that the LockBit gangis struggling after its disruption. We have observed
two notable LockBit campaigns since the disruption,
though both involved samples built with the LockBit

This disruption led to the arrests of two LockBit

builder leaked in September 2022. A telltale sign ofaffiliates in Poland and Ukraine, while French andnon-LockBit groups using this code lies in the ransom

LockBit ransomware daily detection trend since August 2020

Ransomware is typically the final payload at the end of a chain of threats that could
be preceded by phishing, exploitation, brute-force attacks, compromised credentials,
downloaders, or custom malware. Many would-be ransomware attacks are thus probably
never realized because they are caught early in the attack lifecycle. If attackers manage to
exploit vulnerabilities or other chinks in an organization’s armor and are actually able todeploy ransomware, then reputable security products should detect this late link of the chain.

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 22

notes: unlike those dropped by the LockBit group, which refer the victim toa LockBit leak site, the ones dropped by these samples usually provide only
an email or Tox contact.
One of the campaigns referred to above happened right after the February
disruption. Multiple threat actors attempted to deliver LockBit via
exploitation of the then newly publicized ScreenConnect vulnerabilities
CVE-2024-1708 and CVE-2024-1709. Victims were from various verticals,
mainly located in Europe and the US.
The other was a malicious email campaign in mid-April 2024 that
distributed LockBit ransomware via email attachments. Both theattachment format and name, and the email text, suggest widespreadtargeting with no special focus on any vertical. According to one report, thePhorpiex botnet was responsible for sending these malicious emails.
LockBit is typically a highly targeted threat; however, due to this campaign’s
far-reaching grasp, it significantly affected ESET telemetry for LockBit,
causing a huge spike on April 17, 2024.

EXPERT COMMENT
Contrary to initial skepticism, the effects of Operation Cronos are already evident with LockBit being dethroned as Number
One and desperately trying to save its brand by posting old victims on its leak sites.
The ransomware landscape has been further shaken up by the exit scam pulled by BlackCat after the Change Healthcare
incident. Both RansomHub, a gang that first appeared in mid-February, and Play, an older gang active since mid-2022, havebeen taking advantage of this opportunity to lure in new affiliates and try to climb up the ransomware-as-a-service ladder.
Data posted on leak sites indicates that the number of ransomware attacks in Q1 2024 grew by more than 20% comparedto the previous quarter; however, we expect this number to be lower in Q2 2024, mainly as a result of some of theaforementioned gangs being weakened and the landscape descending into chaos. This doesn’t mean that ransomware-as-aservice is going away; the second half of 2024 will surely present a clearer picture of which gangs dissatisfied affiliates moveto, with ransomware rankings reflecting those shifting alliances.
Jakub Souček, ESET Senior Malware Researcher

Executive summary

Foreword

Threat landscape trends

Threattelemetry

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 23

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

All threats

H1

H2

-11%

10%

0%

Overall threat detection trend in H2 2023 and H1 2024, seven-day moving average

Geographic distribution of malware detections in H1 2024

HTML/Phishing.Agent trojan

23.5%

JS/Agent trojan

12.2%

DOC/Fraud trojan

5.1%

Win/Exploit.CVE-2017-11882 trojan

4.2%

HTML/Phishing trojan

3.9%

PDF/Phishing trojan

3.3%

MSIL/TrojanDownloader.Agent trojan

2.3%

LNK/Agent trojan

2.2%

HTML/Fraud trojan

2.1%

JS/ScrInject trojan

1.9%

Top 10 malware detections in H1 2024 (% of malware detections)H1 2024 | 24

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

Android

H1

H2

-41%

10%

0%

Detection trends of selected Android detection categories in H2 2023 and H1 2024, seven-day moving average (trends of Clickers, Cryptominers,
Ransomware, Scam apps, SMS trojans, and Stalkerware are combined in the trendline Other)

Android/TrojanDropper.Agent trojan

22.2%

Android/Agent trojan

9.9%

Android/AdDisplay.HiddAd PUA

8.5%

Android/AdDisplay.MobiDash PUA

6.4%

Android/Pandora trojan

4.1%

Android/Spy.Agent trojan

4.1%

Android/Andreed trojan

4.0%

Android/SpyLoan PUA

3.7%

Android/AdDisplay.Fyben PUA

3.3%

Android/Hiddad trojan

3.0%

Top 10 Android detections in H1 2024 (% of Android detections)Geographic distribution of Android detections in H1 2024

H1 2024 | 25

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESETCryptocurrency threats

H2

H1

-6%

9%

0%

Cryptocurrency threat detection trend in H2 2023 and H1 2024, seven-day moving average

Win/CoinMiner PUA

34.8%

Win/CoinMiner trojan

12.8%

JS/CoinMiner PUA

12.8%

JS/CoinMiner trojan

10.0%

BAT/CoinMiner trojan

7.2%

NSIS/CoinMiner trojan

5.9%

MSIL/CoinMiner PUA

4.3%

MSIL/CoinMiner trojan

2.2%

WASM/CoinMiner PUA

2.0%

Win/Spy.Agent trojan

Geographic distribution of Cryptocurency threat detections in H1 2024

1.2%

Top 10 Cryptocurrency threat detections in H1 2024 (% of Cryptocurrency threat detections)H1 2024 | 26

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

Downloaders

2.7%

H1

H2

2.0%

7.4%

+10%

H1 2024 | 27

MSIL

19.2%

JS
Win

9.0%

DOC
PowerShell
10.4%

14.5%

VBA
VBS
Other

11.0%

12.4%
11.4%

Downloader detection trend in H2 2023 and H1 2024, seven-day moving average

Downloader detections per detection type in H1 2024

MSIL/TrojanDownloader.Agent trojan

17.2%

DOC/TrojanDownloader.Agent trojan

11.3%

PowerShell/TrojanDownloader.Agent trojan

11.0%

JS/Danger trojan

10.7%

VBA/TrojanDownloader.Agent trojan

10.4%

VBS/TrojanDownloader.Agent trojan

10%

8.9%

Win/TrojanDownloader.ModiLoader trojan

6.2%

BAT/TrojanDownloader.Agent trojan

2.8%

PDF/TrojanDownloader.Agent trojan

2.7%

HTML/TrojanDownloader.FraudLoad trojan

2.3%

Top 10 Downloader detections in H1 2024 (% of Downloader detections)0%Geographic distribution of Downloader detections in H1 2024

HTML
LNK

ESET THREAT REPORT

Executive summary

Email threats

H2

Foreword

H1-11%

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

HTML/Phishing.Agent trojan

36.3%

DOC/Fraud trojan

8.4%

Win/Exploit.CVE-2017-11882 trojan

6.6%

HTML/Phishing trojan

Malicious email detection trend in H2 2023 and H1 2024, seven-day moving average

H2

H1 2024 | 28

5.1%

MSIL/TrojanDownloader.Agent trojan

3.6%

PDF/Phishing trojan

3.5%

HTML/Fraud trojan

3.2%

JS/Danger.ScriptAttachment trojan

2.4%

DOC/TrojanDownloader.Agent trojan

2.4%

JS/Agent trojan

2.3%

Top 10 threats detected in emails in H1 2024

H1

0.7%

-21%

5.4%

0.1% 0.02%

4.5%

Scripts
Executables

6.7%

PDF
Office documents

11.9%
53.0%

Archives
Batch
Shortcuts

17.7%

Spam detection trend in H2 2023 and H1 2024, seven-day moving average

Top malicious email attachment types in H1 2024

Jar
AndroidESET THREAT REPORT

Executive summary

Email threats

Foreword

Threat landscape trends

Threat telemetry

Research publications

Exploits

About this report

About ESET

H2

H1 2024 | 29

H1
+33%

14%

-26%
0%

-2%

Geographic distribution of Email threat detections in H1 2024

Trends of RDP, SMB and SQL attack attempts in H2 2023 and H1 2024, seven-day moving average

Password guessing
Apache log4j CVE-2021-44228

0.3%

19.3%

0.3%

Apache Struts2 CVE-2017-5638
SMB.DoublePulsar scan

0.8%

40.0%

1.9%
3.1%

Apache spring4shell CVE-2022-22963,22965
MS IIS CVE-2015-1635

3.4%

Pulse Secure CVE-2019-11510

4.7%

MS RDP CVE-2019-0708 Bluekeep
MS Exchange Exploit.CVE-2021-26855

10.4%
15.9%

MS SMB1 EternalBlue
Other

External network intrusion vectors reported by unique clients in H1 2024

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

Exploits

15%

41%

0%

0%

Geographic distribution of RDP password guessing attack attempt sources in H1 2024

Geographic distribution of SMB password guessing attack attempt targets in H1 2024

14%

10%

0%

0%

Geographic distribution of RDP password guessing attack attempt targets in H1 2024

Geographic distribution of SQL password guessing attack attempt targets in H1 2024

H1 2024 | 30

ESET THREAT REPORT

Exploits

Executive summary

H2

Foreword

Threat landscape trends

H1+4%

Detection trend of Log4Shell exploitation attempts in H2 2023 and H1 2024, seven-day moving average

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 31

Infostealers

H2

H1

+4%

Infostealer detection trend in H2 2023 and H1 2024, seven-day moving average

MSIL/Spy.AgentTesla trojan

19.8%

JS/Spy.Banker trojan

13.0%

PHP/Webshell backdoor
44%

7.0%

Win/Formbook trojan

5.5%

MSIL/Spy.Agent trojan
0%

Geographic distribution of Log4Shell exploitation attempts in H1 2024

3.2%

Win/Rescoms backdoor

2.6%

ASP/Webshell backdoor

2.4%

Win/Spy.Grandoreiro trojan

1.8%

Win/Pterodo backdoor

1.7%

Win/PSW.Fareit trojan

1.5%

Top 10 Infostealer families in H1 2024 (% of Infostealer detections)

ESET THREAT REPORT

Executive summary

Infostealers

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 32

macOS

H2

H1
-5%

7%

0%

Geographic distribution of Infostealer detections in H1 2023

macOS detection trend in H2 2023 and H1 2024, seven-day moving average

OSX/Mackeeper PUA

34.2%

OSX/Pirrit adware

6.5%

OSX/TrojanDownloader.Adload trojan

5.8%

OSX/Ngrok PUsA

5.4%

OSX/Keygen PUsA

4.2%

OSX/GT32SupportGeeks PUA

3.9%

OSX/Genieo adware

3.6%

OSX/BuhoCleaner PUA

3.4%

OSX/Bundlore adware

3.3%

OSX/TrojanProxy.Agent trojan

2.1%

Top 10 macOS detections in H1 2024 (% of macOS detections)

ESET THREAT REPORT

Executive summarymacOS

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 33

Ransomware

H2

H1

+32%
21%

0%

Geographic distribution of macOS detections in H1 2024

Ransomware detection trend in H2 2023 and H1 2024, seven-day moving average

Win/Filecoder.BlackMatter trojan

14.0%

Win/Filecoder.Conti trojan

8.9%

Win/Filecoder.STOP trojan

6.2%

Win/Filecoder trojan

5.7%

MSIL/Filecoder trojan

5.7%

Win/Filecoder.WannaCryptor trojan

5.6%

Win/Filecoder.BlackBasta trojan

5.3%

Win/Filecoder.GandCrab trojan

2.8%

Win/Filecoder.CryptoWall trojan

2.7%

Win/Filecoder.Phobos trojan

2.7%

Top 10 Ransomware detections in H1 2024 (% of Ransomware detections)

ESET THREAT REPORT

Executive summary

Ransomware

Foreword

Threat landscape trends

Threat telemetry

Research publications

Web threats

About this report

About ESET

H2

H1 2024 | 34

H1
-39%

12%

0%

Geographic distribution of Ransomware detections in H1 2024

Web threat block trend in H2 2023 and H1 2024, seven-day moving average

H2

Unique URL block trend in H2 2023 and H1 2024, seven-day moving average

H1
-44%

ESET THREAT REPORT

Executive summary

Web threats

17%

0%

Global distribution of Web threat blocks in H1 2024

28%

0%

Global distribution of blocked domain hosting in H1 2024

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 35

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 36

Research publications
Beware of predatory fin(tech): Loan sharks
use Android apps to reach new depths

A pernicious potpourri of Python packages
in PyPI

OilRig’s persistent attacks using cloudservice-powered downloaders

ESET researchers describe the growth of deceptive loan apps
for Android and techniques they use to circumvent GooglePlay

The past year has seen over 10,000 downloads of malicious
packages hosted on the official Python package repository

ESET researchers document a series of new OilRig
downloaders, all relying on legitimate cloud service providers
for C&C communications

ESET Research Podcast: Neanderthals,
Mammoths and Telekopye

NSPX30: A sophisticated AitM-enabled
implant evolving since 2005

ESET takes part in global operation to
disrupt the Grandoreiro banking trojan

ESET researchers discuss the dynamics within and between
various groups of scammers who use a Telegram bot called
Telekopye to scam people on online marketplaces

ESET researchers have discovered NSPX30, a sophisticatedimplant used by a new China-aligned APT group we havenamed Blackwood

ESET provided technical analysis, statistical information,
known C&C servers and was able to get a glimpse of thevictimology

ESET Research Podcast: ChatGPT, theMOVEit hack, and Pandora

VajraSpy: A Patchwork of espionage apps

Operation Texonto: Information operation
targeting Ukrainian speakers in the context
of the war

An AI chatbot inadvertently kindles a cybercrime boom,
ransomware bandits plunder organizations without deploying
ransomware, and a new botnet enslaves Android TV boxes

Evasive Panda leverages Monlam Festival totarget Tibetans
ESET researchers uncover strategic web compromise andsupply-chain attacks targeting Tibetans

ESET researchers discovered several Android apps carrying
VajraSpy, a RAT used by the Patchwork APT group

A mix of PSYOPs, espionage and … fake Canadian pharmacies!

Rescoms rides waves of AceCryptor spam
Insight into ESET telemetry statistics about AceCryptor in
H2 2023 with a focus on Rescoms campaigns in European
countries

eXotic Visit campaign: Tracing thefootprints of Virtual Invaders
ESET researchers uncovered the eXotic Visit espionage
campaign that targets users mainly in India and Pakistan withseemingly innocuous apps

ESET THREAT REPORT

Executive summary

Foreword

Ebury is alive but unseen: 400k Linuxservers compromised for cryptocurrency
theft and financial gain
One of the most advanced server-side malware campaigns
is still growing, with hundreds of thousands of compromised
servers, and it has diversified to include credit card andcryptocurrency theft

ESET APT Activity Report Q4 2023–Q1 2024
An overview of the activities of selected APT groups
investigated and analyzed by ESET Research in Q4 2023 andQ1 2024

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 37

To the Moon and back(doors): Lunar landing
in diplomatic missions

Introducing Nimfilt: A reverse-engineering
tool for Nim-compiled binaries

ESET researchers provide technical analysis of the Lunar
toolset, likely used by the Turla APT group, that infiltrated a
European ministry of foreign affairs

Available as both an IDA plugin and a Python script, Nimfilt
helps to reverse engineer binaries compiled with the Nim
programming language compiler by demangling package andfunction names, and applying structs to strings

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Credits
Team
Peter Stančík, Team Lead
Hana Matušková, Managing Editor
Aryeh Goretsky
Branislav Ondrášik
Bruce P. Burrell
Klára Kobáková
Nick FitzGerald
Ondrej Kubovič
Rene Holt
Zuzana Pardubská

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 38

Contributors

About the datain this report

Alexandre Côté-Cyr

The threat statistics and trends presented in this report

This data was processed with the honest intention to

Dušan Lacika

are based on global telemetry data from ESET. Unlessmitigate all known biases, in an effort to maximize theIgor Kabina

explicitly stated otherwise, the data includes detections

value of the information provided.

Jakub Souček

regardless of the targeted platform.

Jan Holman
Ján Adámek
Ján ŠugarekJiří Kropáč
Ladislav Janko
Lukáš Štefanko
Marc-Étienne LéveilléMartin Červeň
Mathieu Tartare
Vladimír Šimčák
Yevhenii Fomiachenko

Most of the charts in this report show detection trends

Further, the data excludes detections of potentiallyrather than provide absolute numbers. This is because

unwanted applications, potentially unsafe applications

the data can be prone to various misinterpretations,and adware, except where noted in the more detailed,especially when directly compared to other telemetry

platform-specific sections and in the Cryptocurrency

data. However, absolute values or orders of magnitude

threats section.

are provided where deemed beneficial.

ESET THREAT REPORT

Executive summary

Foreword

Threat landscape trends

Threat telemetry

Research publications

About this report

About ESET

H1 2024 | 39

About ESET
ESET® provides cutting-edge digital security to prevent attacks before

WeLiveSecurity.com

they happen. By combining the power of AI and human expertise, ESET@ESETresearchstays ahead of known and emerging cyberthreats — securing businesses,
critical infrastructure, and individuals. Whether it’s endpoint, cloud, or
mobile protection, our AI-native, cloud-first solutions and services remain

ESET GitHub
ESET Threat Reports and APT Activity Reports

highly effective and easy to use. ESET technology includes robust detection
and response, ultra-secure encryption, and multifactor authentication.
With 24/7 real-time defense and strong local support, we keep users safeand businesses running without interruption. An ever-evolving digitallandscape demands a progressive approach to security: ESET is committed
to world-class research and powerful threat intelligence, backed by R&D
centers and a strong global partner network. For more information, visit
www.eset.com or follow us on LinkedIn, Facebook, and X.

© 2024 ESET, spol. s r.o. - All rights reserved.
Trademarks used herein are trademarks or registered trademarks of ESET, spol. s r.o.
All other names and brands are registered trademarks of their respective companies.

(eset):research