THREATREPORT T2 2022
WeLiveSecurity.com@ESETresearch
ESET GitHub

CONTENTS

FOREWORD
Welcome to the T2 2022 issue of the ESET Threat Report!

3

EXECUTIVE SUMMARY4FEATURED STORY

7NEWS FROM THE LAB

9STATISTICS & TRENDS
10 THREAT LANDSCAPE OVERVIEW
11

TOP 10 MALWARE DETECTIONS

12 INFOSTEALERS
14 RANSOMWARE
16 DOWNLOADERS
18 CRYPTOCURRENCY THREATS
20 WEB THREATS
23 EMAIL THREATS
26 ANDROID
29 macOS AND iOS
31 IoT SECURITY
34 EXPLOITS

37 ESET RESEARCH CONTRIBUTIONS

The past four months were the time of summer vacations for many of us in the northern hemisphere. It
appears that some malware operators also took this time as an opportunity to possibly rest, refocus, andreanalyze their current procedures and activities. According to our telemetry, August was a vacation monthfor the operators of Emotet, the most influential downloader strain. The gang behind it also adapted to
Microsoft’s decision to disable VBA macros in documents originating from the internet and focused on
campaigns based on weaponized Microsoft Office files and LNK files.
In T2 2022, we saw the continuation of the sharp decline of Remote Desktop Protocol (RDP) attacks, which
likely continued to lose their steam due to the Russia-Ukraine war, along with the post-COVID return tooffices and overall improved security of corporate environments. Even with declining numbers, Russian IP
addresses continued to be responsible for the largest portion of RDP attacks. In T1 2022, Russia was also
the country that was most targeted by ransomware, with some of the attacks being politically or ideologicallymotivated by the war. However, as you will read on the following pages, this hacktivism wave has declined in
T2, and ransomware operators turned their attention towards the United States, China, and Israel.
In terms of threats mostly impacting home users, we saw a sixfold increase in detections of shipping-themed
phishing lures, most of the time presenting the victims with fake DHL and USPS requests to verify shipping
addresses. A web skimmer known as Magecart, which saw a threefold increase in T1 2022, continued to be
the leading threat going after online shoppers’ credit card details. Plummeting cryptocurrency exchange rates
also affected online threats – criminals turned to stealing cryptocurrencies instead of mining them, as seen ina twofold increase in cryptocurrency-themed phishing lures and rising numbers of cryptostealers.
The past four months were also interesting in research terms. Our researchers uncovered a previously unknown macOS backdoor and later attributed it to ScarCruft, discovered an updated version of the Sandworm
APT group’s ArguePatch malware loader, uncovered Lazarus payloads in trojanized apps, and analyzed an
instance of the Lazarus Operation In(ter)ception campaign targeting macOS devices while spearphishingin crypto-waters. They also discovered buffer overflow vulnerabilities in Lenovo UEFI firmware and a new
campaign using a fake Salesforce update as a lure.
During the past few months, we have continued to share our knowledge at the Virus Bulletin, Black Hat
USA, RSA, CODE BLUE, SecTor, REcon, LABSCon, and BSides Montreal cybersecurity conferences, where
we disclosed our findings about campaigns deployed by OilRig, APT35, Agrius, Sandworm, Lazarus, and
POLONIUM. We also talked about the future of UEFI threats, dissected the unique loader we named Wslink,
and explained how ESET Research does attribution of malicious threats and campaigns. For the upcoming
months, we are happy to invite you to ESET talks at AVAR, Ekoparty, and many others.
I wish you an insightful read.
Roman Kováč
ESET Chief Research Officer
ESET THREAT REPORT T2 2022 | 2

FEATURED STORY
I see what you did there: A look at the CloudMensis macOS spyware
ESET researchers discovered CloudMensis, previously unknown macOS malware that uses cloudstorage as its C&C channel and to exfiltrate documents, keystrokes, and screen captures fromcompromised Macs.

NEWS FROM THE LAB
Sandworm attacks Ukraine with new version of ArguePatchEXECUTIVE
SUMMARY

ESET Research discovered an updated version of the ArguePatch malware loader used by
Sandworm. ArguePatch was previously used in the Industroyer2 attack against a Ukrainian energy
provider, as well as in multiple attacks involving the data-wiping malware CaddyWiper.
Operation In(ter)ception is open to crypto-opportunities
ESET Research spotted an Operation In(ter)ception campaign for macOS, by Lazarus, in which themalware was disguised as a job description for the Coinbase cryptocurrency platform.

STATISTICS & TRENDS
Category

T1 2022/
T2 2022

Key points in T2 2022

Overall threat detections-9.1% ↓

Decrease in detections in almost all monitored categories

Infostealers-14.3% ↓JS/Spy.Banker (aka Magecart) remains top banking malware

Ransomware-24.1% ↓Politically motivated ransomware on the decline

Downloaders-31.0% ↓Emotet continues activity, adapts distribution vectors

Cryptocurrency threats-16.0% ↓Cryptostealers see first period of growth, at almost 50%

Web threats-6.0% ↓

Surge in shipping-themed phishing lures

Email threats-10.2% ↓Office files double their share among malicious attachments

Android+9.5% ↑

Android spyware continues its growth from T1

macOS-15.1% ↓Decline in detections most prominent in the Adware category

RDP attacks-89.4% ↓RDP attacks fall further, following sharp T1 decline
ESET THREAT REPORT T2 2022 | 3

ESET researchers discovered CloudMensis, previously unknown macOS
malware that uses cloud storage as its C&C channel and to exfiltrate
documents, keystrokes, and screen captures from compromised Macs.

FEATUREDSTORYESET researchers discovered a previously
unknown macOS backdoor that they named
CloudMensis. The malware uses public cloudstorage services to communicate back andforth with its operators, and its capabilities
clearly show that the intent of its operators is
to gather information from the victims’ Macsby exfiltrating documents, keystrokes, andscreen captures.
CloudMensis is malware for macOS developedin Objective-C. The samples analyzed by ESET
Research are compiled for both Intel and Apple
silicon architectures.

It is not known how victims are initially compromised by this threat. Once CloudMensis
gains code execution and administrative privileges, it runs first-stage malware that retrieves a more feature-rich second stage froma cloud storage service.
Interestingly, to retrieve its second stage froma cloud storage provider it doesn’t use a publicly accessible link; it includes an access token
to download the MyExecute file from thedrive. In the sample analyzed, pCloud [1] wasused to store and deliver the second stage.

fetches MyExecute

Token 1
Token 2

pCloudexecute(CloudMensis downloader)

drops as windowserverand executes

CloudCmd

Token 3

YandexCloudData

I see what you did there: A look at
the CloudMensis macOS spyware
Marc-Étienne M.Léveillé

Client(CloudMensis spy agent)

Dropbox
Cloud storage services supported by CloudMensis

Outline of how CloudMensis uses cloud storage services

ESET THREAT REPORT T2 2022 | 4

The spy agent component

Bypassing TCC

Commands

The second stage of CloudMensis is a much larger component,
packed with a number of features to collect information from thecompromised Mac. The intention of the attackers here is clearly to
exfiltrate documents, screenshots, email attachments, and othersensitive data.

Since the release of macOS Mojave (10.14) in 2018, access tosome sensitive inputs, such as screen captures, cameras, microphones and keyboard events, are protected by a system called TCC,
which stands for Transparency, Consent, and Control. When an
application tries to access certain functions, macOS prompts theuser, who can grant or refuse access, whether the access requestfrom the application is legitimate. Ultimately, TCC rules are saved
into a database on the Mac. This database is protected by System
Integrity Protection (SIP) to ensure that only the TCC daemon canmake any changes.

There are 39 commands implemented in the analyzed
CloudMensis sample. Some commands require additional
arguments. Commands allow the operators to perform actions
such as:CloudMensis uses cloud storage both for receiving commands
from its operators and for exfiltrating files. It supports three different providers: pCloud, Yandex Disk, and Dropbox. The configuration
included in the analyzed sample contains authentication tokens for
pCloud and Yandex Disk.
One of the first things the CloudMensis spy agent does is load its
configuration. The configuration contains the following:x Which cloud storage providers to use and authentication tokens
x A randomly generated bot identifier
x Information about the Mac
x Paths to various directories used by CloudMensis
x File extensions that are of interest to the operators
The default list of file extensions found in the analyzed sample,
pictured in the figure below, shows that operators are interested
in documents, spreadsheets, audio recordings, pictures, and email
messages from the victims’ Macs. The most uncommon format
is perhaps audio recordings using the Adaptive Multi-Rate codec(using the .amr and .3ga extensions), which is specificallydesigned for speech compression. Other interesting file extensions
in this list are .hwp and .hwpx files, which are documents for
Hangul Office [2] (now Hancom Office), a popular word processor
among Korean speakers.

CloudMensis uses two techniques to bypass TCC (thus avoiding
prompting the user), thereby gaining access to the screen, being
able to scan removable storage for documents of interest, andbeing able to log keyboard events. If SIP is disabled, the TCC database (TCC.db) is no longer protected against tampering. Thus, inthis case CloudMensis adds entries to grant itself permissions before using sensitive inputs. If SIP is enabled but the Mac is runningany version of macOS Catalina earlier than 10.15.6, CloudMensis
will exploit a vulnerability to make the TCC daemon (tccd) load a
database CloudMensis can write to. This vulnerability is known
as CVE-2020–9934 [3] and was reported and described by Matt
Shockley [4] in 2020.

Communication with the C&C server
To communicate with its operators, the CloudMensis configuration
contains authentication tokens to multiple cloud service providers.
Each entry in the configuration is used for a different purpose. Allof them can use any provider supported by CloudMensis. In the analyzed sample, Dropbox, pCloud, and Yandex Disk are supported.

x Change values in the CloudMensis configuration: cloud storage
providers and authentication tokens, file extensions deemedinteresting, polling frequency of cloud storage, etc.

x List running processes
x Start a screen capture
x List email messages and attachments
x List files from removable storagex Run shell commands and upload output to cloud storagex Download and execute arbitrary files
x Metadata from cloud storage
Metadata from the cloud storages used by CloudMensis reveals
interesting details about the operation. The figure on the next pageshows the tree view of the storage used by CloudMensis to send
the initial report and to transmit commands to the bots as of April
22, 2022.
This metadata gave partial insight into the operation and helped
draw a timeline. First, the pCloud accounts were created on
January 19, 2022. The directory listing from April 22 shows that
51 unique bot identifiers created subdirectories in the cloud storage to receive commands. Because these directories are created
when the malware is first launched, we can use their creation dateto determine the date of the initial compromise, as seen in thechart on the next page.
The chart shows the first compromise was on February 4, witha spike of compromises in early March 2022. The last spike may
be explained by sandboxes running CloudMensis, once it was
uploaded to VirusTotal.

File extensions found in the default configuration of CloudMensis

ESET THREAT REPORT T2 2022 | 5

5
4

4

4
3

Tree view of the directory listing from the CloudCmd storage

15

1

20

22

-0

4-

08
4-0
22

20

420

22

-0

3-0
22

1

01

1 1 1

20

3-0
22
20

3-0
22

1

25

11 1

18

1

20

-0
22
20

2

11

1 1

04

1

25
2-0
22

20

20

22

-0

2-

18

1

11
2-0
22

20

2-0
22
20

22

11

04

1

2

3-

2 2 2

Subdirectory creation dates under /Febrary (sic)Conclusion
CloudMensis is a threat to Mac users, but its very limited distribution suggests that it is used as part of a targeted operation.
Operators of this malware family seem to deploy CloudMensis tospecific targets that are of interest to them. Usage of vulnerabilities to work around macOS mitigations shows that the malware
operators are actively trying to maximize the success of their spying operations. At the same time, no undisclosed vulnerabilities(zero-days) were found to be used by this group during ESET’s
research. Thus, running an up-to-date Mac is recommended to
avoid, at least, the mitigation bypasses.
Apple recently acknowledged the presence of spyware targetingusers of its products and is previewing Lockdown Mode [5] on iOS,
iPadOS and macOS, which disables features that are frequently
exploited to gain code execution and deploy malware.

Following the publication of the CloudMensis blogpost, ESET Research found that the CloudMensis malware exhibits similar features andartifacts to Windows variants of the so-called RokRAT [7], attributed by Cisco Talos with high confidence to Group 123, also known as
ScarCruft [8], APT37 and Reaper.
ESET researchers attribute RokRAT and CloudMensis to the ScarCruft APT group. ScarCruft has been operating since at least 2012 and issuspected to be a North Korean espionage group [9]. It primarily focuses on South Korea, but other Asian countries have also been targeted.
The group’s toolset contains a broad range of downloaders, exfiltration tools, and backdoors used for espionage.
The indicators that guided attribution include a matching list of favored file extensions, similarities in development artifacts such as paths
left in malware samples, and shared use of cloud service providers for command and control.
Attribution details on Twitter [10]The ScarCruft group is also the topic of an upcoming ESET Research talk at AVAR 2022.

WeLiveSecurity blogpost [6]ESET THREAT REPORT T2 2022 | 6

UEFI threats
Buffer overflow vulnerabilities in Lenovo UEFI
firmware
ESET researchers discovered three buffer overflow vulnerabilities in the UEFI firmware ofmultiple Lenovo notebook devices. More than 70 various models were affected, including several
within the ThinkBook series. We reported all of these vulnerabilities to the manufacturer on
February 18. Lenovo acknowledged them and released a security advisory [11] on June 12 with alist of affected devices and firmware update instructions.

NEWS FROM
THE LAB

More information on the topic can be found in the ESET Research Contributions section.
Twitter thread [12]macOS threats
Fake Salesforce update deploys Sliver on macOSESET Research spotted a new campaign, which used a fake Salesforce update as a lure, todeploy the Sliver malware for macOS and Windows. Previously, SentinelOne documented [13] a
COVID-19-themed campaign with a compromise chain that is very similar to the macOS one that
we found.
Sliver is a framework similar to Cobalt Strike and is being used in more and more malicious
campaigns. In this particular campaign, Sliver was deployed using an additional Go Mach-O
executable that downloads and runs the Bash script. The Windows variant also uses adownloader written in the Go language.
As opposed to the script described by SentinelOne, the shell script that deploys Sliver on macOS
doesn’t include the “covid” malware and only installs the Sliver implant, which is sufficient to
deploy additional malware if needed.
The fake Salesforce update download page included a link to a PDF with instructions on how todisable macOS security features. Additionally, it appears that the victim’s Salesforce credentials
were phished before landing on the download page.

Latest findings from ESET ResearchLabs across the world

Twitter thread [14]ESET THREAT REPORT T2 2022 | 7

Sandworm

Operation In(ter)ception is open to crypto-opportunities

Sandworm attacks Ukraine with new version of ArguePatchESET Research discovered an instance of the Operation In(ter)ception campaign for macOS, by
Lazarus. We spotted that a signed Mach-O executable disguised as a job description for Coinbase had
been uploaded to VirusTotal from Brazil. While targeting potential victims through LinkedIn and fakejob offers is nothing new for Lazarus, they have not gone spearphishing in crypto-waters before.

The ESET research team found an updated version of the Sandworm APT group’s ArguePatchmalware loader. ArguePatch – named so by the Computer Emergency Response Team of Ukraine(CERT-UA) and detected by ESET products as Win32/Agent.AEGY – was previously used in the
Industroyer2 attack against a Ukrainian energy provider, as well as in multiple attacks involving thedata-wiping malware called CaddyWiper.
In order to stay under the radar during the Industroyer2 attack, ArguePatch used a patched version of
the HexRays IDAPro remote debugging software. This was changed in the updated version, in which
the malware operators switched to an ESET executable stripped of its signature.
The new variant of ArguePatch includes a feature to execute the next stage of an attack at a specified
time. This bypasses the need for setting up a scheduled task in Windows and is likely intended to help
the attackers stay under the radar.
This shows that Sandworm continues to update its arsenal for campaigns targeting Ukraine.
Twitter thread [15]WeLiveSecurity blogpost [16]Lazarus
Lazarus payloads hiding in trojanized apps
ESET researchers saw the Lazarus APT group using various trojanized, popular applications in May
2022. First, we tweeted about a Windows executable called mozila.cpl, which was submitted toVirusTotal in November 2020. The file is a trojanized sqlite v3.31.1 library with an embedded payloadthat exfiltrates RAR-compressed files from a victim’s system.
Later that month, we reported that Lazarus had disguised one of its payloads as a well-known
Windows activation tool by putting it into the KMSAuto folder. Since KMSAuto is a crack tool and its
users typically exclude its location from their security products, it makes for a great hiding place forthe Lazarus payload. The payload itself was a VMProtect-ed executable that, after dumping it frommemory, turned out to be a RAT, delivered by a trojanized DeFi app.
Twitter threads [17] [18]Fake Coinbase job description used in Operation In(ter)ception

Built as a fat Mach-O executable, supporting both Intel and Apple Silicon processors, this malware
was similar to another ESET discovery [19] that we tentatively attributed to Lazarus at the time. This
newer sample drops three files: a decoy PDF document, and two malicious executables; the first,
FinderFontsUpdater.app, executes the second, safarifontagent, which is a downloader.
The C&C server from which the downloader gets the next stage did not respond at the time weanalyzed this threat.
The bundle was signed using a certificate issued in February 2022 to a developer named Shankey
Nohria. However, the application was not notarized and Apple revoked the certificate on August 12.
There is also a Windows counterpart to this threat that drops the same decoy document, which was
spotted [20] by a researcher at Malwarebytes.
Twitter thread [21]ESET THREAT REPORT T2 2022 | 8

0.0%

STATISTICS& TRENDS

9.7%

Global distribution of malware detections in T2 2022

-9.1%

The threat landscape in T2 2022
as seen by ESET telemetry

1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Overall threat detection trend in T1 2022 – T2 2022, seven-day moving average

ESET THREAT REPORT T2 2022 | 9

THREAT LANDSCAPE OVERVIEW
A summary of the threat landscape developments in T2 2022.
The threat landscape of T2 2022 was characterized by a decrease in almost all monitored categories,
with an overall threat detection decline of 9.1%. Total threat numbers peaked on June 14, which wascaused by DOC/TrojanDownloader.Agent, an Emotet malware family.
Speaking of Emotet, the Downloaders section specifies that while Emotet remained quite active in T2,
its numbers were down by 31%. We also saw Emotet moving away from VBA macros in favor of DOC
and LNK files.
There were also changes in the Exploits category, in which new exploits such as Log4Shell andSpring4Shell were on the rise while RDP attack attempts declined by 89%.
In what constitutes one of the largest declines in Ransomware numbers in the last two years, thatcategory’s detections dropped by 24%. Unlike T1, during which the most targeted country was Russia
due to its invasion of Ukraine, this time ransomware operators turned their attention towards the US.
As was to be expected, Cryptocurrency threats went down, this time by 18.9%, along with the price of
bitcoin. In a surprise twist, the continuously declining subcategory of Cryptostealers grew by almost
50% in T2.

HTML/Phishing.Agent trojan

15.9%

Win/Exploit.CVE-2017-11882 trojan

12.2%

DOC/TrojanDownloader.Agent trojan

11.9%

MSIL/TrojanDownloader.Agent trojan

5.7%

JS/Agent trojan

4.9%

HTML/Phishing trojan
LNK/Agent trojan

4.3%
2.8%

VBA/TrojanDownloader.Agent trojan

2.1%

HTML/Phishing.Outlook trojan

2.0%

HTML/Fraud trojan

2.0%

Top 10 malware detections in T2 2022 (% of malware detections)

While Web threats did not decrease as steeply as other categories, they were nevertheless on a
downward trend in T2, with only unique phishing URLs experiencing growth this period. ESET phishingfeeds showed a dramatic sixfold surge in shipping-themed phishing lures.

Over in the IoT security category, you can see that the Mozi botnet lost some of its power in T2,
slowing down by 23%. On the other hand, other Mirai-based botnets increased their activity by 61%

As opposed to T1, when Email threats experienced their largest increase to date, their numbers went
down by 15% in T2. However, thanks to its rapid growth, HTML/Phishing.Outlook, one of the Emailthreat families, managed to get on to the overall top 10 most detected malware list for the first time.

The Android category was the only one that registered an overall increase in the number of detections,which went up by 9.5%. Its fastest-growing subcategory was Spyware, but its highest numbers werereached by HiddenApps.

Also on the decline, with a 14.3% decrease in detections this period, was the Infostealers category.
The decrease was caused by a reduction in the number of detections of its strongest subcategory,
Spyware, which went down by 21.7%.
Most of the macOS subcategories declined as well, coming to an overall 15.6% decrease in number.
Almost half of the monitored detections were potentially unwanted applications (PUAs).

Several malware families in the top 10 malware detections list traded positions, moving up or down
the list by a few places. The only major changes were MSIL/Spy.AgentTesla’s disappearance from thelist following a notable 29% decrease in detections, and the appearance of a newcomer among the
top-detected threats, the HTML/Phishing.Outlook trojan. This fresh new member of the top 10 grewby 66.1% between T1 and T2 2022.

ESET THREAT REPORT T2 2022 | 10

Win/Exploit.CVE-2017-11882 trojan↓

This detection name stands for specially crafted documents exploiting the CVE-2017-11882 [22]vulnerability found in Microsoft Equation Editor, a component of Microsoft Office. The exploit is publicly available and usually used as the first stage of compromise. When the user opens the malicious
document, the exploit is triggered and its shellcode executed. Additional malware is then downloaded
onto the computer to perform arbitrary malicious actions.

DOC/TrojanDownloader.Agent trojan↓

This classification represents malicious Microsoft Office documents that download further malware
from the internet. The documents are often disguised as invoices, forms, legal documents, or otherseemingly important information. They may rely on malicious macros, embedded Packager (and other) objects, or even serve as decoy documents to distract the recipient while malware is downloadedin the background.

MSIL/TrojanDownloader.Agent trojan↓

MSIL/TrojanDownloader.Agent is a detection name for malicious software written for the Windows
platform, and that uses the .NET Framework; this malware tries to download other malware using
various methods. It usually contains either a URL or a list of URLs leading to the final payload. Thismalware often acts as the first layer of a much more complex package, taking care of the installation
part on the victimized system.

JS/Agent trojan

This detection name covers various malicious JavaScript files. These are often obfuscated to avoid
static detections. They are typically placed onto compromised but otherwise legitimate websites, withthe aim of achieving drive-by compromise of visitors.

↓↓

HTML/Phishing trojan represents generic malware detections that are collected based on scanningmalicious URLs in emails and email attachments. If an email or its attachment contains a blacklisted
URL, it triggers an HTML/Phishing.Gen detection.

LNK/Agent trojan

LNK/Agent is a detection name for malware utilizing Windows LNK shortcut files to execute otherfiles on the system. Shortcut files have been popular among attackers, as they are typically considered benign and less likely to raise suspicion. LNK/Agent files don’t contain any payload and areusually parts of other, more complex malware. They are often used to achieve persistence of the main
malicious files on the system or as a part of the compromise vector.

↓↓

HTML/Phishing.Agent is a detection name for malicious HTML code often used in a phishing email’s
attachment. Attackers tend to use it instead of other file types, since executable attachments areusually automatically blocked or more likely to raise suspicion. When such an attachment is opened,a phishing site is opened in the web browser, posing as e.g., an official banking, payment service orsocial networking website. The website requests credentials or other sensitive information, which
are then sent to the attacker.

HTML/Phishing trojan

VBA/TrojanDownloader.Agent trojan

VBA/TrojanDownloader.Agent is a detection typically covering maliciously crafted Microsoft Officefiles that try to manipulate users into enabling the execution of macros. Upon execution, the enclosed
malicious macro typically downloads and executes additional malware. The malicious documents areusually sent as email attachments, disguised as important information relevant to the recipient.

↓

HTML/Phishing.Agent trojan

HTML/Phishing.Outlook trojan

HTML/Phishing.Outlook is a detection name for phishing emails that harvest login information forMicrosoft's outlook.com email service. Email messages falling under this detection typically contain
HTML attachments posing as outlook.com login pages. Frequently, these phishing forms alreadycome prefilled with the target’s email addresses, probably making the target more likely to supply therest of the information.

↓↓

TOP 10 MALWARE DETECTIONS

HTML/Fraud trojan

HTML/Fraud detections cover various types of fraudulent, HTML-based content, distributed with theaim of gaining money or other profit from the victim’s involvement. This includes scam websites, aswell as HMTL-based emails and email attachments. In such an email, recipients may be tricked into
believing they have won a lottery prize and are then requested to provide personal details. Anothercommon case is the so-called advance fee scam [23], such as the notorious Nigerian Prince scam also
known as “419 scam”.

ESET THREAT REPORT T2 2022 | 11

INFOSTEALERS
JS/Spy.Banker continued its reign in the Banking malware subcategory; Agent Tesla numbers dropped.
As is the case for most of our categories in T2 2022, the number of Infostealer detections decreased
compared to T1. They went down by 14.3%, caused by a decline in their strongest subcategory, Spyware,
which lost 21.7% in T2. Backdoors seem to have stabilized, for now, only having 2% fewer detections
than in the previous period. Meanwhile, banking malware continued its growth from T1, this time increasing by 9.9%. Rather unexpectedly, the biggest growth among Infostealer subcategories was exhibited by the smallest one, Cryptostealers. In T2 2022, it managed an unprecedented gain of 49.7%.
Despite the substantial decrease in detections, Spyware was still the most prevalent Infostealer
subcategory, responsible for 58.6% of detections in the category. Spyware’s decline might have been
helped by the drop in MSIL/Spy.AgentTesla detections, which were down by 24.6% in T2. We still registered a considerable spike in detections in this subcategory on June 6, caused by the aforementioned
Agent Tesla alongside the Win/Formbook trojan. On that date, the highest number of attack attempts
conducted by both malware families was seen in Turkey.
Looking at the chart of the top 10 Infostealer threats, half of them are in the Spyware subcategory.
As usual, MSIL/Spy.AgentTesla was in the lead with 16.9% of all Infostealers and 28% of Spyware –even the drop in numbers did not succeed in dethroning it as the most prevalent there. It introduced
a new distribution method in T2 when it started spreading [24] via weaponized Windows compiled
Infostealers

SpywareBackdoors

Banking malware

Cryptostealers-14.3%

MSIL/Spy.AgentTesla trojan

16.9%

Win/Formbook trojan

10.3%

JS/Spy.Banker trojan

8.4%

MSIL/Spy.Agent trojan

7.7%

PHP/Webshell backdoor

4.9%

Win/PSW.Fareit trojan
Win/Agent backdoor

4.4%
2.8%

Win/HoudRat trojan

2.3%

Linux/SmbPayload backdoor

2.0%

ASP/Webshell backdoor

1.9%

Top 10 infostealer families in T2 2022 (% of Infostealer detections)HTML Help files, which use the .chm extension, attached to phishing emails impersonating the shipping company DHL.
The Win/Formbook trojan also managed to keep its second place despite losing an even higher percentage of its detections than Agent Tesla (36.7%, to be precise). It constituted 10.3% of Infostealer
detections and 17.1% of Spyware detections. The MSIL/Spy.Agent trojan actually grew by 14.4%, but
still remained the third most detected spyware, with 12.8%, and the overall fourth most detected in
the Infostealer category, with 7.7%.
In addition to somewhat recovering from their decline, the Backdoor subcategory increased its
overall share of Infostealer detections, going from 25.5% in T1 to 29.1% in T2. Backdoor numbers
peaked on May 12 when we saw increased activity from the Win32/Agent.TJS backdoor, caught
mostly in the Czech Republic.

1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Infostealer detection trend in T1 2022 – T2 2022, seven-day moving average

This time, four backdoors managed to claim places in the Infostealer top 10, as opposed to three in
T1. PHP/Webshell kept a steady trend and remained the most prevalent backdoor with 16.5%, which
is 5% of all Infostealers. Even a 7.2% decrease could not budge the Win/Agent family from its second
place in the subcategory, which it earned with 9.2% (2.8% of Infostealers). T1’s third-place holder,
ASP/Webshell, was fourth this time, narrowly replaced by the Linux/SmbPayload backdoor with 6.5%of Backdoor and 2% of Infostealer detections.
ESET THREAT REPORT T2 2022 | 12

While the rates of banking malware detections increased by 9.9% in T2, they showed a clear, albeit
gentle, downward trend across the period. Detections in this subcategory constituted 10.8% of the
Infostealer category. Banking malware detections peaked on June 9, with the largest amount of hits
recorded in the United States and attributed to JS/Spy.Banker. The second most detected malware
family on that day was the notorious Qbot, which also had its T2 peak at that time.
JS/Spy.Banker’s dominance from T1 continued in T2. This web skimmer, better known as Magecart,
constituted three-fourths of all Banking malware detections, leaving far behind the rest of the families in the subcategory. From January up until almost the end of May [25], Magecart led a very successful campaign, during which it compromised more than 300 restaurants, stealing at least 50,000 credit
card records in the process. It was also the third most detected among the Infostealers, with 8.4%, andthe only banking malware to get into the overall top 10.

the actual level to which the skimmers in question have spread. The only other members of the
Infostealer top 10 that work similarly to JS/Spy.Banker are PHP/Webshell and ASP/Webshell. The restof the most-detected families are distributed via email attachments or as downloader payloads.

EXPERT COMMENT
The most prevalent variant of JS/Spy.Banker was JS/Spy.Banker.KJ. It is quite an interesting pieceof malware because the part of the code that downloads the skimmer itself is rather short, uses
only a handful of common JavaScript functions, and mostly does not use complex obfuscation. Thismeans the malicious code blends in with the original code quite seamlessly, making the infested
web page appear safe. This posed a challenge in differentiating between a legitimate site and askimmer-infested site, showing the resourcefulness of the malware’s creators.
Radim Raszka, ESET Detection Engineer
As we already mentioned in the opening paragraph, the Cryptostealers subcategory unexpectedly
grew by 49.7% in T2. This development was caused by a staggering increase in PowerShell/PSW.
Coinstealer detections, which gained a new variant in T2. More details regarding Cryptostealers can befound in the Cryptocurrency threats chapter of this report.
Concerning the geographical distribution of Infostealer detections, the top three countries in the list faced
almost the same amount of attack attempts: Turkey 6.5%, and both Japan and the United States 6.3%.
0.0%

6.5%

Website compromised by JS/Spy.Banker and the malicious skimmer code linked to the page

However, it is important to note that web skimmers such as JS/Spy.Banker are distributed anddetected in a different way from most of the Infostealer top 10. Since they constitute online scriptsthat are lying in wait on hacked or unpatched websites (mostly hosted on WordPress and Magento),
their detection statistics are based on the number of visits to these websites and might not reflect
Global distribution of Infostealer detections in T2 2022
ESET THREAT REPORT T2 2022 | 13

RANSOMWARE
Ransomware detections dropped by a quarter in T2 2022. Politically loaded messages related to the Russian war against Ukraine receded in new variants.
The Ransomware category dropped by more than 24% in T2 2022, which is the most significant
decrease since the beginning of 2021 when ransomware detections declined by 27%.

0.0%

7.5%

This detection trend shows several upticks, first on May 18, caused by Lockbit attacks in Guatemala,accounting for 59% of all detections on that day. Another peak in telemetry appeared on June 28 dueto the spread of Win/Filecoder.WannaCryptor.D (24%) in Peru and the distribution of multiple old variants of MSIL/Filecoder (16.5%) in Ukraine. The last and the largest spike was observed on August 12,
caused primarily by well-known variants of Win/Filecoder and MSIL/Filecoder, with 45% of detections
that day coming from the United States.
Russia was replaced by the United States in being the country most targeted by ransomware in T2
2022, reporting 7.5% of all such attacks. It was followed by China with 6% and Israel with 5.5%.
Coming in at fourth and fifth place were Russia and Ukraine; both faced roughly the same number ofransomware attacks. The difference compared to T1 2022 was the decreased number of attacks with
politically loaded messages. Russia was most commonly targeted by years-old Win/Filecoder variants
and ransomware families that lock victims’ screens. In contrast, Ukraine was hit mostly by derivatives of
HiddenTear, the first open-source ransomware, detected by ESET as AK and Y variants of MSIL/Filecoder.

Global distribution of Ransomware detections in T2 2022

In the Ransomware top 10, the most interesting change was probably the increased prevalence of
Python/Filecoder. While in T1 2022 it ranked tenth, in T2 2022 it moved up to seventh place, accountingfor 2.5% of all detections in the category. The detection covers amateurish attempts to create ransomware. Names such as test.pyc used for some of the recently seen binaries and the use of hardcoded
private keys such as 1881**ANARCHY_rtxDATA__ANARCHY1881*** support this hypothesis.

-24.1%

Hardcoded private key as seen in some amateurish Python/Filecoder variants

1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Ransomware detection trend in T1 2022 – T2 2022, seven-day moving average

T2 2022 brought several new trends to the ransomware scene. Lockbit (3.0) started the first everransomware bug bounty [26] program, offering researchers and (un)ethical hackers anything between
USD 1000 and USD 1 million in Monero for findings related to their operation. The sought-after items
include flaws in malware, vulnerabilities in the leak site, or “brilliant ideas” for improvements. The
highest sum is reserved for anyone who can identify the person running Lockbit’s affiliate program,currently known by the nickname “LockBitSupp”. In an interesting turn of events, it was this actor who
publicly claimed [27] that one of the gang’s victims – Entrust – was behind the DDoS attacks thatwere hitting Lockbit’s leak sites.
ESET THREAT REPORT T2 2022 | 14Win/Filecoder.WannaCryptor trojan

18.9%

MSIL/Filecoder trojan

9.0%

Win/Filecoder trojan

8.2%

Win/Filecoder.STOP trojan

5.9%

Win/Filecoder.Lockbit trojan

5.5%

Win/Filecoder.Phobos trojan

4.0%

Python/Filecoder trojan

2.6%

Win/Filecoder.CryptoWall trojan

2.5%

Win/Filecoder.GandCrab trojan

2.5%

Win/Filecoder.EQ

2.4%

Top 10 ransomware families in T2 2022 (% of Ransomware detections)

Another trend observed in T2 2022 is the shift of skilled ransomware writers towards the Rust
programming language. The first to make the move were the BlackCat [28] creators, followed by Hive[29]. The latest addition to this currently exclusive club is the T2 newcomer Luna [30]. Using Rust
offers malware operators several advantages, including improved evasion of security solutions andimproved error resistance [31].
In the past couple of years, one of the most prevalent red team tools (ab)used by the ransomware
gangs has been Cobalt Strike. However, in T2 2022 some of the ransomware groups switched toBrute Ratel [32] because of its lower detection rates by EDR and security solutions.
The last four months saw some curious ransomware-related cases. For example, a victim in theautomotive industry experienced what it meant to have initial access to their network sold on theblack market. Its systems were hit by three different ransomware gangs [33] in just two weeks. Anotheruncommon approach has been seen in cases caused by a new ransomware family called Zeppelin.
CISA and the FBI [34] warned that victims targeted by this gang could see their data encrypted several
times during a single compromise.
But ransomware actors are also facing increased pressure from authorities. Due to ransomware
attracting so much attention, new regulations are being passed, sanctions imposed, and the willingness of victims to pay the ransom decreasing. A mixture of these factors is forcing the threat actors
to refocus from high-profile victims to mid-sized organizations and to lower the demanded ransoms[35]. A new report [36] by the British think tank RUSI even suggests that increased attention on ransomware is pushing perpetrators to look for new hunting grounds, primarily in the Global South,
where attacks are less laborious and the risk of prosecution is lower.

An illustrative case of making the life of ransomware gangs harder is the USD 10 million reward [37]offered for information about “individual(s) who hold a key leadership position in the Conti ransomware…
group”. But even victims may not come out unscathed, as shown by the Colonial Pipeline [38] case. The
US regulator has proposed to fine the company nearly USD 1 million for “control room management
failures” that complicated recovery from the 2021 ransomware compromise.
Despite the growing law-enforcement and regulatory activity, many new ransomware actors
appeared on the scene in T2 2022. Reminding the world of the 2017 WannaCryptor (aka WannaCry)
incident, CISA and the FBI [39] warned that North Korean threat actors cooked up a new ransomware
family called Maui. About a week later Microsoft attributed another newcomer H0lyGh0st [40] tohackers from the same country. QNAP NAS devices have another threat to worry about too, namely
Checkmate [41]. A new free-to-use ransomware builder Redeemer [42] (version 2.0) may also worsen
the situation as it opens the doors for unskilled actors who want to try their luck in the game.
There were also some “rebrands” during this period. Chaos ransomware builder has been used tocreate another family called Yashma [43]. And we have to mention Conti, which after catastrophic leaks saw its minions dissolved [44] into several other gangs, including Hive, BlackBasta, BlackCat,
and BlackByte.
The list of high-profile victims in T2 2022 is also quite long. It includes a Foxconn factory in Mexico [45]hit by Lockbit, the government of Costa Rica [46] that saw its systems attacked by Conti, building materials manufacturer Knauf Group [47] hit by Black Basta, and the already mentioned security giant
Entrust [48].
In the happy corner, there were multiple families that ceased their activity or actors behind them werearrested. In the case of Thanos [49], its creator, seller and also operator – a Venezuelan doctor – wasarrested by the authorities. AstraLocker [50] closed up shop with decryptors now available. Victims ofthe newcomer Yashma [51] can also decrypt their files using a new decryptor.
The final bit of good news comes from the No More Ransom [52] initiative – where ESET is anassociate partner – which in its six years of existence has helped 1.5 million ransomware victims to
decrypt their files and save around USD 1.5 billion.

EXPERT COMMENT

The growing proportion of Python ransomware families can have multiple explanations. First, Python iseasy to use even for unskilled malware writers. As a scripting language, it also allows threat actors to
obfuscate and change their code and create new variants that can evade detection. Second, technicallyadvanced ransomware actors are abandoning the mass-spreading model mostly tracked by our telemetry
and are increasingly focusing on big-game hunting and RaaS schemes, letting the rookies claim a bigger
portion of their former market. Last but not least, there are very many “test” projects related to encryption
on GitHub that can be easily reused as part of a new ransomware strain.

Igor Kabina, ESET Senior Detection Engineer
ESET THREAT REPORT T2 2022 | 15

DOWNLOADERS
In T2 2022, Emotet operators took their foot off the gas but remained the dominant force in the Downloaders category.
A hundredfold increase in activity and looking for new compromise vectors – that is where we left
Emotet at the end of T1 2022. In T2 2022, the number of its attacks headed in the opposite direction– although not as dramatically – and dropped by over 31%.
As for the new vectors, Emotet’s operators have abandoned VBA macros in response to Microsoft
disabling them [53] in documents originating from the internet. Instead, Emotet has moved tocampaigns based on weaponized Microsoft Office files (91%) and LNK files (9%). Both arrive in email
inboxes in the form of password-protected ZIP files.
The only significant campaign built on LNK files was detected on May 18, aimed primarily at inboxes in Japan and Italy. All the other upticks visible in the trend chart between June and mid-July werecaused by waves of malspam containing weaponized documents and spreadsheets (DOC), aiming at
the same regions.
According to ESET telemetry data, August was a vacation month for Emotet operators. Regarding newfeatures first seen in T2 2022, Emotet operators added the Google Chrome CC stealer module [54] thatT1

T2
-31.0%

An email from one of Emotet’s malspam campaigns that spread malware via attached password-protected ZIP files

extracts credit card information from that browser and sends it to the command and control server.
They have also returned to some of the earlier modules, namely the years-old Spreader.
In the T2 2022 Downloader top 10, Emotet remained the most influential malware family. Its
malicious DOC and LNK files were responsible for almost half of all detections in the category,
which declined by 16% in overall detections. The only other notable player in the top 10 list was
MSIL/TrojanDownloader.Agent with 21% of detections, mostly attacking devices in Turkey and Spain.

EXPERT COMMENTIn June, we saw Emotet operators reintroduce the old Spreader module, which they used for lateral
movement before the January 2021 takedown. Its main goal is to gain remote access to other devices
in the network by brute force, using a hardcoded list of usernames and passwords. If successful, thespreader copies the main Emotet binary to the compromised system and executes it as a service.

1-Jan

1-Mar

1-May

1-Jul

Zoltán Rusnák, ESET Malware Researcher

Emotet detection trend in T1 2022 – T2 2022, seven-day moving average

ESET THREAT REPORT T2 2022 | 16

0.0%

19.8%

-16.0%

1-Jan

T1
1-Mar

1-May

T2
1-Jul

Downloader detection trend in T1 2022 – T2 2022, seven-day moving average

MSIL’s variants JDM, MVU, and MRS used the already documented approach of downloading two
binaries: an EXE file, and a DLL tool to execute it, leading to a compromise by either Agent Tesla,
Fareit, or the MSIL/Agent.CFQ trojan. The KXQ and MFV variants opted for a modified tactic: downloading an encrypted DLL injector posing as a JPG or BMP file that, if executed, delivered the same
final payloads.
2% 2% 1%

6%

DOC
MSIL

3%
3%

VBA
LNK

7%

44%

Win
PowerShell

8%

JS
23%

HTML
VBS
Other

Downloader detections per detection type in T2 2022

Global distribution of Downloader detections in T2 2022

Another downloader family in the top 10 that ditched VBA macros as an initial vector wasPowerShell/TrojanDownlader.Agent. Its variants FSW and FSV – responsible for every fifth detectionof this family in T2 – were part of campaigns spreading weaponized Windows compiled HTML Help
files, which use the .chm extension.
If such file is executed, a regular Windows Help window is opened to mask that HTML code is run in
the background. That in turn downloads PowerShell script with two built-in binaries: a loader that
injects a running process with the second binary and the final payload – MSIL/Spy.AgentTesla.E.
Emotet and this campaign confirmed the trend seen in T1 2022, namely the abandonment of VBA
macros as the initial compromise avenue. Since the beginning of the pandemic, it was the unopposed
number one vector for several malware families including Emotet, Trickbot, and Qbot. But at the beginning of 2022, VBA-based downloaders started declining, with weaponized Office files (DOC) andMSIL detections taking the lead. In T2, VBA placed third, closely followed by the LNK platform.
One of the factors that contributed to this trend was Microsoft’s February 2022 announcement that
VBA macros in documents downloaded from the internet would be disabled by default. Despite theflurry [53] of rollbacks and re-announcements of this step by Microsoft in T2 2022, it seems that VBA
macros have already lost their appeal to cybercriminals, who are testing new ways to compromise
their victims – such as the LNK and CHM files.

ESET THREAT REPORT T2 2022 | 17

CRYPTOCURRENCY THREATS
Cryptostealers were on the rise while cryptocurrency exchange rates plunged.

However, the threat posed by cryptocurrency-related malicious activities was far from gone, as recent
headlines were rife with stories of various criminal feats, from NFTs stolen in a Discord phishing scam
[55] to an exploit [56] allowing hackers to steal bitcoin from ATMs. Law enforcement is also staying
vigilant: the US Securities and Exchange Commission (SEC) announced [57] in May that it plans toincrease the size of its cybersecurity unit to protect investors in cryptocurrency markets.
In T2 2022, the Cryptominers subcategory continued its decline from T1, going down by a further
20.7%. Cryptominers still experienced a strong detection peak, which occurred on June 11 and wascaused by the AH variant of the MSIL/CoinMiner potentially unwanted application (PUA).
An interesting development in the coinminer threat landscape was the emergence of a new pieceof malware based on the ESET-discovered KryptoCibule [58]. First documented by researchers at
Symantec [59], who named it ClipMiner, this new coinminer, with the ability to scan clipboard content
Cryptominers

The top three coinminer detections – as usual – continued to be occupied by the same families.
Despite a significant decrease in numbers between T1 and T2 2022 (32.8%), the Win/CoinMiner PUA
was first with 41.7%. The JS/CoinMiner PUA with 13.8% declined by 7.6%, the smallest drop among the
top three. This allowed it to claim second place from its long-time holder, the Win/CoinMiner trojan,
which had 12% of Cryptominer detections in T2 after its numbers decreased by 22.9% compared to T1.
Even though PUAs boasted the two most-detected cryptominers, their overall proportion shrunkslightly in the Trojan:PUA ratio, making it 33% (Trojans) to 67% (PUAs) this time, continuing the trendthat started in T1. Similarly, the amount of in-browser detections increased relative to desktop detections: in T1, it was 13% to 87%, compared to T2’s 17% to 83%.
Related to the increase of in-browser detections, the number of cryptojacking domain visits grew by
16.4% in T2. If you want to avoid having your computer used against your will for mining, we advise
you to steer clear of free streaming websites or torrent sites.
BTC/USD exchange rate (left axis)

Cryptostealers-18.9%

x 10000

Cryptocurrency threats

for wallet addresses, has made its operators at least USD 1.7 million. ESET tracks ClipMiner as two
detections, MSIL/Agent_AGen.UG, and MSIL/Agent_AGen.UL. Our telemetry shows that both of themwere on an upward trend in T2 2022.

ETH/USD exchange rate (right axis)
4.5

6

4

5

3.5
3

4

2.5

3

1-Jan-2022

T1

1-Mar-2022

T2
1-May-2022

1-Jul-2022

Cryptocurrency threat detection trend in T1 2022 – T2 2022, seven-day moving average

Thousands

T2 2022 brought a steep decline in cryptocurrency exchange rates, including the price of bitcoin
dipping below USD 20,000 for the first time since late 2020. It seems that, for now, cryptocurrencies,
NFTs, and other blockchain-related ventures have lost much of their shine. Looking at the Crypto­
currency threats trend chart, this is true for cybercriminals to a degree, with the T2 detection numbers
continuing the decrease started in T1, this time going down by 18.9%.

2

2

1.5

1
0
1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2

1
0.5
0

1-Jul-2022

Bitcoin and Ethereum/USD exchange rates in T1 2022 – T2 2022, seven-day moving average
ESET THREAT REPORT T2 2022 | 18

PUA

TrojanDesktop

In-browser

0.0%

8.3%

17%
33%

67%
83%

Trojan:PUA and desktop:in-browser ratio of cryptominer detections in T2 2022

In a surprise twist, the Cryptostealers subcategory did not decline this time. Even more surprisingly,
not only did they not decrease in number, they actually experienced rather significant growth of almost 50%. This can be almost single-handedly attributed to the meteoric rise of the PowerShell/PSW.
CoinStealer trojan, a malware family that did not have many detections in the past, but managed to
become the second most detected cryptostealer in T2 thanks to a new variant added to its arsenal,
PowerShell/PSW.CoinStealer.D.
Threats belonging to this malware family search for installed cryptocurrency browser extensions suchas Metamask, Binance, or Coinomi. They then exfiltrate this information for nefarious purposes, forexample changing the target cryptocurrency addresses in memory to effectively transfer their ownership from the target to the cybercriminal.
We saw see two spikes in the Cryptostealers detection trend. The first, on June 13, was caused by
Win/Spy.Agent, mainly registered in Peru. The second spike, which occurred on July 8, was due toPowerShell/PSW.CoinStealer, with the highest number of attempted attacks registered in India andthe United States.
T1 2022

T2 20221

webminepool[.]com

webminepool[.]com2

dl-x[.]com

mainevnap[.]com

3

wypracowanie.edu[.]pldl-x[.]com

4

slovolam[.]sk

gsgazete[.]com

5carrierecalciatori [.]it

mituus[.]com

6

arafifblues[.]com

slovolam[.]sk

7

kaizoku-ehime[.]jp

wypracowanie.edu[.]pl8mainevnap[.]com

monerominer[.]rocks

9

mituus[.]com

arafifblues[.]com

10monerominer[.]rocks

geotimes[.]com.ge

Global distribution of Cryptocurrency threat detections in T2 2022

As in T1 2022, the Win/Spy.Agent trojan was the most-detected cryptostealer with 30.8%. However,
the aforementioned heavy hitter of T2, PowerShell/PSW.CoinStealer, was close behind. Accountingfor 27.9% of all cryptostealers, it beat the Win/PSW.Agent trojan, which ended up third and registered
20.7% of cryptostealer detections.
As opposed to the leading coinminers, all the families in the top three cryptostealers experienced
growth in T2, paradoxically with Win/Spy.Agent growing the least out of the three, by 14.8%. Since
PowerShell/PSW.CoinStealer was, according to our telemetry, mostly dormant in T1, it increased bymore than a thousandfold in T2. Meanwhile, Win/PSW.Agent doubled its number of detections, goingup by 102.1%.
ESET telemetry registered the highest number of cryptocurrency threat detections in Peru (8.3%), with
Russia (7.2%) and the United States (4.3%) in second and third places, respectively.

EXPERT COMMENT
Soaring energy prices negatively influence cryptocurrency exchange rates and the willingness to trade ormine cryptocoins. Malware authors now increasingly find it more profitable to steal cryptocurrencies thanto illicitly mine them. Additionally, free streaming websites and torrenting sites are capitalizing on thetrend of releasing films straight to streaming platforms that started during the height of the pandemic,
and in-browser coinminers are taking advantage of that. With the continuing energy crisis, we anticipate
that the growth of cryptostealers accompanied by the rise of in-browser coinminers will continue.
Igor Kabina, ESET Senior Detection Engineer

Top 10 most visited cryptojacking domains in T1 2022 and T2 2022
ESET THREAT REPORT T2 2022 | 19

WEB THREATSShipping-themed phishing lures skyrocketed while most web threats stagnated.
Web threats did not experience as extensive a decrease in T2 2022 as other monitored categories,
but nevertheless started exhibiting a slight downward trend. Overall blocks decreased by 6% and thedecline was somewhat more pronounced when it came to the number of unique URLs blocked, which
went down by 10.3%. All of the web threat subcategories followed this trend too, the only exception
being unique phishing URL detections – those increased by 28.3%.
The number of unique phishing URLs that ESET products blocked reached almost 4.7 million in T2. On
average, we blocked 38,000 of these a day. Interestingly, despite the significant uptick in unique URLs,
the overall number of detected phishing websites remained relatively stable, only decreasing by 3.9%.
As in T1, of all of the Web threat subcategories, Malware blocks declined the most. The total numberof malware-distributing website blocks went down by 9.8%, while the number of unique URLs our
products blocked diminished by a quarter. On the other hand, the number of legitimate websites
hosting malware, labeled Malware objects in the accompanying charts, stayed stable, with only a 3%
decrease in both all blocks and unique blocks.
Scam site detections did not change drastically (4.5% decrease) and remained the most prevalent
form of web threat, with over 340 million overall blocks and 18 million unique blocks. Their numbers
Scam

MalwarePhishing

7

5

3

1
0
1-Jan-2022

1

freychang[.]funsurvey-smiles[.]com

propu[.]sh2

aj2396[.]online

s.sarafan[.]fun

mrproddisup[.]com

3

jecromaha[.]info

v.vfghe[.]com

foreign-movies.baby-supernode[.]xyz

4

www.hostingcloud[.]racing

mybetterck[.]com

thecred[.]info

5

iclickcdn[.]com

newrrb[.]bid

watchvideoplayer[.]com

6

webanalyser[.]org

bwukxn[.]com

www--bancosantafe--com-- ar.insuit[.]net

7

d1ywb8dvwodsnl.cloudfront[.]net

serch07[.]biz

tech4-you[.]com

8

vk-online[.]xyz

cellar.z5h64q92x9[.]net

tabledownstairsprovocative[.]com*

9

broworker1s[.]com

loft.z5h64q92x9[.]net

gtorra[.]pw

10

buikolered[.]com

hilarion-lar[.]com*

google-qa[.]net

Top 10 blocked Malware, Scam and Phishing domains in T2 2022; domains first detected in this period are marked with *

All

Scam

MalwarePhishing

Malware Object

5-10.3%
4
3

4

2

Phishing

Malware Object

-6.0%

6

Scam

x 100000Millions

All

Malware2

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Web threat block trend in T1 2022 – T2 2022, seven-day moving average

1
0
1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Unique URL block trend in T1 2022 – T2 2022, seven-day moving average
ESET THREAT REPORT T2 2022 | 20

0.0%

12.5%

peaked on May 25, when we registered 5 million scam website blocks, almost double the daily
average amount. Unique scam URL blocks were down by 12.1%, with the largest number of uniqueblocked scam URLs on July 4, coming to almost 210,000.
Based on GeoIP tracking, the US remained the country hosting the largest proportion of detected Web
threats, being the virtual home to more than a third of them (34.7%). Apart from that, the threats wereslightly more spread out among other countries, where their shares did not reach double digits, withGermany in second place hosting 7.6% of web threats, followed by China with 5.9%. Conversely, thecountries that found themselves on the receiving end of web threat attack attempts the most often
were Japan (12.5%), Russia (10.6%), and Peru (4.4%).
Finance

32.7%

Social media

24.9%

Shipping

13.1%

Email
Global distribution of Web threat blocks in T2 2022

0.0%

34.7%

7.7%

Gaming4.2%

Cryptocurrency

4.2%

Document

3.8%

Telecommunications

2.5%

File storage

2.2%

Shopping

2.2%

Top 10 phishing website categories in T2 2022 by number of unique URLs

ESET phishing feeds show that the Finance category remained the go-to sector when it comes tophishing websites, making up almost a third of the recorded unique phishing URLs in T2 20221. It was
followed by the Social media category, which in turn took up one-fourth of detections. That comesas no surprise considering that, according to our data, Facebook was the most impersonated among
companies and services. Starting in 2021 and culminating at the beginning of T2 2022, Facebook andMessenger were used as lures in a large-scale phishing operation [60] that generated its operators
significant advertising revenue.

Global distribution of blocked domain hosting in T2 2022

1

The statistic is based on phishing URLs that could be categorized.

Of note is also the sixfold increase in detections that catapulted the Shipping category into third place
among phishing categories, where it now resides with 13.1%. This category was mostly represented
by fake DHL and USPS requests to verify shipping addresses.

ESET THREAT REPORT T2 2022 | 21

Though cryptocurrency-themed lures accounted for basically the same percentage of phishingwebsites as in T1, their actual numbers almost doubled. This is an interesting development at atime when cryptocurrency exchange rates are plummeting. Notably, the increase in these websites
is happening alongside the rising number of cryptostealers and in-browser coinminers caused bycriminals turning to stealing cryptocurrencies instead of mining them (for more details, see theCryptocurrency threats section.
After being reduced by almost half in T1, the number of homoglyph blocks remained practically thesame in T2. Hotmail remained the most impersonated service, while T1’s second-most targeted,
Eastman Credit Union, disappeared from our telemetry completely in T2.
The list of the 10 most targeted services and domains featured two newcomers: the first was a
domain that impersonated the Canadian internet-only bank Tangerine at tạngerlne[.]com – note thea changed into ạ and i written as l; the other targeted the global finance group ING using the domain
ingdirẹct[.]com, switching e to ẹ. Both of them were inaccessible at the time of writing.

EY
linkedintwittertangerine

hotmail
facebook

santander google

office ING

Top 10 brands and domain names targeted with homoglyph attacks in T2 2022

Phishing websites impersonating DHL and USPS and claiming issues with shipping addresses
ESET THREAT REPORT T2 2022 | 22

EMAIL THREATSEmotet’s weaponized Office file attachments again doubled their proportion of detections. Outlook was the brand most abused by phishers in T2 2022.
Email threats, which in T1 experienced their largest growth since the beginning of 2021, saw a 10%
decline in T2 2022. The decrease was influenced by the lower number of Emotet malspam campaigns
and adjustments in ESET’s tracking of phishing emails.
Detection levels saw less fluctuation than in the first four months of 2022, with only a handful ofsmaller spikes in May and June, followed by a period of lower activity starting in mid-July and lasting
throughout August.
May 16 saw the first notable spike in ESET telemetry this period, with the BOR and F variants of
Win/Exploit.CVE-2017-11882 as the main drivers. These variants were part of malspam campaigns
distributing RTF downloaders, which in turn delivered MSIL/Spy.AgentTesla as their final payloads.
The recipients of these emails were typically lured into opening attachments that appeared to be
DOC files containing a jumble of characters. To hide the malicious nature of the documents, attackers
masked them as invoices or purchase lists.
Another wave of the same campaign was seen on June 14, contributing to the largest T2 2022 uptick.
However, it wasn’t the only wave of malspam that wreaked havoc on that day. The Emotet botnet
was flooding inboxes in Japan and Italy with messages carrying weaponized Office files – typically

HTML/Phishing.Agent trojan

21.2%

DOC/TrojanDownloader.Agent trojan

16.9%

Win/Exploit.CVE-2017-11882 trojan

16.7%

MSIL/TrojanDownloader.Agent trojan

7.7%

HTML/Phishing trojan

5.5%

HTML/Fraud trojan

2.7%

HTML/Phishing.Outlook trojan

2.7%

LNK/TrojanDownloader.Agent trojan

2.6%

VBA/TrojanDownloader.Agent trojan

2.6%

MSIL/Spy.AgentTesla trojan

1.8%

Top 10 threats detected in emails in T2 2022

-10.2%

1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Malicious email detection trend in T1 2022 – T2 2022, seven-day moving average

Documents used in a malspam campaign that spread variants of MSIL/Spy.AgentTesla
ESET THREAT REPORT T2 2022 | 23

Microsoft Excel spreadsheets – triggering the DOC/TrojanDownlader.Agent.EAR and .DOV detections.
The latter also contributed to spikes in the detection trend on June 22 and July 7.
Among the top 10 Email threats, HTML/Phishing.Agent kept its lead with 21%. Its overall numbers
declined by 20% between T1 and T2, partially due to an adjustment in ESET telemetry that separated
it from emails spreading fraudulent pharmaceutical offers.
The second most prevalent threat, DOC/TrojanDownloader.Agent triggered by Emotet campaigns,
also saw a drop of 31%, diminishing its share in the T2 Email threats category to 17%. With this botnet
shifting away from VBA macros, VBA/TrojanDownloader.Agent detections are slowly but surely sliding
down the top 10, descending from the leading position to ninth place in just one year.
A noteworthy addition to the top 10 was HTML/Phishing.Outlook – a threat that tries to lure its
victims to open an HTML file attached to an email, presenting them with a fake Outlook login page
and attempting to steal their passwords. Its numbers were already growing in T1, and it further increased its share by 54% in T2, moving up from eleventh to seventh place. Countries that faced thebiggest portion of these attacks were the United Kingdom and New Zealand.

EXPERT COMMENT
The phishing forms found in HTML/Phishing.Outlook email attachments typically come pre-filled withemail addresses, probably in an attempt to appear more trustworthy. This might make the targeted user
more likely to insert the rest of the requested information, thus making the operation more effective forthe phishers.

Jiří Kropáč, ESET Director of Threat Detection
The organization whose logo and name saw the biggest jump in abuse between T1 and T2 2022 wasExpress Mail Service (or EMS). Moving up from fourteenth place to sixth, its detections were 33 times
more prevalent than in the previous four months, with most of its targets in the Asia-Pacific region.

While keeping similar detection levels as in T1, Microsoft became the number two among abusedbrands, being used to target victims in the United States and in the UK. HTML/Phishing.DHL emails,
which were wildly popular during the 2020 and 2021 pandemic lockdowns, declined by 55% between
T1 and T2 2022, descending to the third position among branded phishing threats.

Being generic in the subject line presumably pays off, considering that “Re:”, “RE”, and “Fwd:” were thehighest-ranking subject lines reported by ESET telemetry in T2 2022. As for broader subject topics
used, hoping to dupe victims into opening the email, the “payment” theme – including invoices, orders
and purchases – outran its competition, being used in 46% of malicious emails. The “Bank message”
theme was the second most prevalent, being the topic of a quarter (24.7%) of the encountered
malevolent messages.

Example of a fake login form displayed by HTML/Phishing.Outlook

A phishing page posing as an EMS form and spread as an email attachment, detected as HTML/Phishing.EMS

ESET THREAT REPORT T2 2022 | 24

1% 0.3% 0.1%
6%

Windows executables

4%

At 47%, Windows executables were the most prevalent malicious attachment type in T2 2022.
Although losing eight percentage points relative to T1, this file format kept its distance from the
23% reached by the second-place contender, script files. As in T1 2022, compromised Office files
almost doubled their share, going from 10% in T1 2022 to 19% in T2 2022. The reason for the
uptick is identical to the previous four months, namely Emotet “promoting” Office files other than
VBA-macro-containing ones to its main intrusion vector, instead of those with VBA macros.

Script files
Office documents

19%

47%

PDF documents
Shortcuts

Spam emails kept a steady upward pace between T1 and T2 2022, increasing by 8%. There were two
short-lived spikes in ESET data: one around June 6, with numbers reaching approximately double thevolume of a regular day, and a second one in the last days of August, probably driven by the end of theholiday season.

Compressed archives
23%

Batch files
Java files

Top malicious email attachment types2 in T2 2022

As COVID-19 is becoming endemic, it apparently loses its appeal as a lure. Emails that used thedisease in the subject line in T2 were only half as frequent as in T1 2022, reaching a 0.19% share –the lowest level since the beginning of 2021. Going in the opposite direction, “travel” topics were 70%
more frequent in T2 than in T1, being the subject line in 1.4% of detected emails.
EU-BusinessRegister.pdf remained the most prevalent name of blocked attachments seenin T2, fueling the well-known subscription scam. Another popular filename among attached files –198_Invoice_#15427.html – might sound generic, yet is presumably effective, as it triggers thealready mentioned and booming HTML/Phishing.Outlook detection.
0.0%

If the geographic distribution is considered, the top five countries remained the same, but some ofthem switched places. The United States remained the biggest source of spam, spewing out 20.5% of
the global volume. The second most prolific spam producer was China with 14.6%, followed by Polandwith 11%, France with 9.4%, and Japan with 8.8%.
Looking at the spam portion in all emails, China has the worst ratio, with 76% of sent messages falling
into the unsolicited category. Singapore is second with 41.3% and Russia third with close to 30%.
When interpreting this data, it should be noted that ESET’s visibility into spam is limited due to email
traffic commonly first being filtered at the level of internet email service provider, and elsewhere,
before reaching ESET-protected endpoints.

13.3%

+7.7%

1-Jan-2022
Global distribution of Email threat detections in T2 2022
2

The statistic is based on a selection of well-known extensions.

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Spam detection trend in T1 2022 – T2 2022, seven-day moving average

ESET THREAT REPORT T2 2022 | 25

e

ANDROID
For over a year, Android detections have continued to grow — in T2 2022 by 9.5%. The most significant growth was seen in the Spyware category.
For 16 months now ESET telemetry has exposed continuous but leisurely growth of Android detections, most recently at 9.5% in T2 2022. The category that experienced the biggest growth wasagain Spyware (109%), represented by Android/Spy.Agent trojan, which is number three in the top 10
Android detection list. Compared to T1 2022, this threat has jumped four places from number seven.
Malicious apps falling under this detection name have a wide range of spying capabilities including
recording audio and video.
Behind a large portion of Android/Spy.Agent detections recognized in ESET telemetry is “GB
WhatsApp” – a popular but cloned (and therefore unofficial) third-party version of WhatsApp withadditional features. However, the cloned app is not available on Google Play; there are no security
checks in place compared with the legitimate WhatsApp and versions available on various download
websites are riddled with malware. WhatsApp is even temporarily banning [61] accounts that use such
unsupported apps and if these accounts continue to use them, they are permanently banned fromaccessing WhatsApp. Most of these detections in T2 were seen in Egypt, Brazil, India, and Peru.
All
Stalkerware

Scam apps

HiddenApps
SMS trojans

AdwareClickers

Banking malware

Stalkerware

Scam apps

SMS trojans

Android/TrojanDropper.Agent trojan

25.6%

Android/Andreed trojan

18.0%

Android/Agent trojan

8.5%

Android/Spy.Agent trojan

5.5%

Android/Hiddad trojan

3.9%

Android/Snaptube PUA

3.8%

Android/AdDisplay.MobiDash PUA

3.6%

Android/Autoins PUsA

3.1%

Android/Obfus trojan

2.2%

Android/TrojanSMS.Agent trojan

1.7%

Clickers

Top 10 Android
detections in T2 2022 (% of Android detections)
Cryptominers, Ransomware,
SpywareCryptominers, Ransomware, Spyware

0.0%

9.7%

+9.5%

T1
1-Jan-2022

1-Mar-2022

T2
1-May-2022

1-Jul-2022

Detection trends of selected Android detection categories in T1 2022 – T2 2022, seven-day moving average

Global distribution of Android detections in T2 2022
ESET THREAT REPORT T2 2022 | 26

EXPERT COMMENT
Behind the growth of Spyware are mainly easy-to-access, off-the-shelf Android spyware kitsavailable on various online forums. In many cases, amateur attackers can find working and reliable
remote access trojans (RATs) online for free. In comparison, the successful deployment of othertypes of Android malware, such as banking malware, requires at least some level of technical skill.
Lukáš Štefanko, ESET Malware Researcher
Another Spyware variant, detected by ESET as Android/Spy.Facestealer trojan, was spotted on Google
Play by Trend Micro [62]. Facestealer disguises itself as various useful applications and changes its
code frequently, therefore it repeatedly manages to enter the digital marketplace. In its beginnings,
the spyware would steal people’s Facebook login credentials (hence the name); however, currently, it
can also exfiltrate various other user credentials and even private keys to cryptocurrency wallets.
The macOS and iOS section mentions vulnerabilities in iOS that have been exploited by commercial
surveillance companies. Google’s Threat Analysis Group [63] revealed that it found commercial surveillance software developer Cytrox packaging exploits for several zero-day vulnerabilities, with one ofthem affecting Android. High-profile and carefully chosen victims are first served with the Alien trojan,
which then loads the Predator spyware onto their Android devices to exfiltrate their data and spy on
their activities. Google claims that Cytrox sold these zero-day attacks to various government-backed
threat actors.

is not compatible with the device that the person is currently using and modded apps are sometimes
recompiled to work even on device models that the original does not support. Another reason is thatthe developer has not made the app available in certain regions. Due to sanctions following Russia’s
invasion of Ukraine, people in Russia and Belarus can no longer download or update [64] paid apps
from Google Play. Sanctions also mean that developers from those countries can no longer place their
paid apps on the platform.
In Russia, this has led to the launch of NashStore (meaning Our Store), which offers apps for theowners of Android devices in Russia, Kazakhstan, Belarus, Kyrgyzstan, and Armenia. The above­
mentioned reasons may explain why ESET telemetry saw most Android/AdDisplay.Fyben PUA
detections in Ukraine, Mexico, Russia, Turkey, and Poland.
All of the other Android detection categories monitored by ESET experienced a decline in T2 2022
– Ransomware decreased by 8%, Stalkerware by 10%, Clickers by 30%, SMS Trojans by 32%, andCryptominers by 48.5%.
Even banking malware saw a decrease of 17%; this category had experienced relatively steady andsometimes very strong growth in the past, with the exception of T3 2021. Ultimately, this decrease
has put the T2 Android banking malware detections on a similar level as they were at the end of
2021. The global law enforcement takedown [65] of the notorious FluBot Android banking malware [66]is partially behind the decrease in detection numbers in this category. ESET detects this threat asseveral variants of the Android/TrojanDropper.Agent trojan.

-12.3%

Even with this growth, Spyware didn’t come close to reaching the detection numbers of HiddenApps– deceptive apps that hide their own icons, then stealthily display ads – or Adware. HiddenApps also
experienced growth in T2 2022, increasing by 32.4%. In the top 10, this category is represented byAndroid/Hiddad in fifth place.
As is visible in the trend chart, Adware detections saw a steep increase towards the end of T2 2022,
even though the category experienced a mild overall decline of 4.2%. In terms of functionality, Adware
is similar to HiddenApps, but typically doesn’t have the stealthy features made to avoid discovery on
the affected device. Behind the growth of this category towards the end of T2 was Android/AdDisplay.
Fyben PUA. This detection covers modded apps – reworked copies of original apps – that have malicious code injected into the com.android.app.Activity package, which is responsible for the
display of unwanted ads. For obvious reasons, these apps are not available on Google Play.
Even though the official versions of these apps are available in official stores, some people still resort
to downloading modded versions from unofficial download sites. One reason is that the desired app

1-Jan-2022

T1

1-Mar-2022

1-May-2022

T2
1-Jul-2022

Android Banking malware detection trend in T1 2022 – T2 2022, seven-day moving average

ESET THREAT REPORT T2 2022 | 27

The FluBot banking malware had been wreaking havoc in many European countries and in the US,
attacking the customers of various banks and aggressively spreading through SMS. Its infrastructure
was successfully disrupted in May by the Dutch Police and the investigators are now trying to identify
the individuals behind this Android threat. Even with this takedown, ESET still detects many unrelated
Android banking malware variants that can exfiltrate online banking credentials and immediately
access the victim’s finances. Vigilance is therefore always necessary.
In Poland, ESET researchers detected [67] new Android banking malware called ERMAC 2.0; it impersonates the popular food delivery app Bolt Food. Since March 2022, the ERMAC 2.0 banking trojan
has been available for rent on underground forums for USD 5,000 a month and its purpose is to steal
victims’ credentials for various financial and cryptocurrency apps. The list of targeted apps is received
from the attacker’s C&C server and is based on the apps installed on the device. ESET detects thisthreat as a variant of Android/TrojanDropper.Agent trojan, which has been number one on the top 10
Android detection list not only in T2 2022 but also during the last 12 months.
Cleafy [68] found newer versions of the SOVA (owl in Russian) Android banking malware with thefunctionality to intercept multifactor authentication codes. Additionally, this trojan served as a basefor another Android banking trojan described by F5 Labs [69] that they named MaliBot. Both of these
Android banking trojans are detected by ESET as different variants of Android/TrojanDropper.Agent.
Trend Micro [70] also detected several apps on Google Play that, after installing, download additionalbanking malware onto the compromised Android device. As such, ESET detects these malicious apps
as variants of Android/TrojanDownloader.Agent.

One of many FluBot examples detected by ESET: this one was spreading in Germany and impersonating the FedEx app

ERMAC 2.0 impersonating the popular food delivery app Bolt Food
ESET THREAT REPORT T2 2022 | 28

macOS AND iOS
macOS detections continued to decline throughout T2 2022, with the Adware category losing one-fifth of its detection numbers.
In T2 2022, macOS detections saw a decline of 15.1%, with the Adware category experiencing thelargest decrease in detection numbers (20.3%). This type of detection covers programs that display
unsolicited ads, and is represented in the top 10 macOS detection list by OSX/Pirrit, OSX/Bundlore,
OSX/MaxOfferDeal, OSX/Genieo, and OSX/VSearch. All of these adware families saw decreasing
numbers of detections, with the exception of OSX/MaxOfferDeal – compared to T1 its detections
increased by 30% in T2. OSX/MaxOfferDeal displays unwanted online ads and redirects users to websites that can be riddled with malicious links; ESET products detected it in T2 mainly in the UnitedStates and France.
Even though their numbers also declined (by 15.7%), Potentially Unwanted Applications (PUAs) continued to be the most widespread type of macOS detection. In T2 2022, PUAs accounted for 44% of
all macOS detections and were represented in the top 10 by OSX/Mackeeper, which has the potential
to mislead users into unnecessary purchases, OSX/GT32SupportGeeks, which is often presented as amacOS performance scanner reporting alleged issues, and OSX/Coinminer, which uses the system’s
resources to mine digital currency.
All

TrojanAdware

PUA

PUsA

Other

-15.1%

T2

T1
1-Jan-2022

1-Mar-2022

1-May-2022

1-Jul-2022

macOS detection trend in T1 2022 – T2 2022, seven-day moving average

OSX/Mackeeper PUA

30.0%

OSX/Pirrit adware

9.3%

OSX/Bundlore adware

6.7%

OSX/GT32SupportGeeks PUA

5.9%

OSX/MaxOfferDeal adware

5.0%

OSX/Genieo adware

5.0%

OSX/Keygen PUsA

4.6%

OSX/TrojanDownloader.Adload trojan

4.1%

OSX/VSearch adware

2.3%

OSX/CoinMiner PUA

2.2%

Top 10 macOS detections in T2 2022

Potentially Unsafe Applications (PUsAs) also declined by just a smidge (-1.2%) and the only
category that experienced a very minor increase in numbers was Trojans (2.6%), represented by
OSX/TrojanDownloader.Adload, which is currently number eight on the top 10 macOS detection list.
In July, ESET researchers [14] warned about a new campaign using a fake update of the Salesforce
customer relationship management (CRM) software. Its goal was to deploy the Sliver [71] malware tomacOS and Windows systems. The macOS compromise chain is very similar to a COVID-19-themed
campaign previously documented by SentinelOne [13]; however, this newer campaign didn’t include
the “covid” malware and only installed the Sliver implant, which has sufficient functionality to deploy
additional malware if needed. The download page included a link to a PDF document that contains
instructions on how to install the file – one of the instructions basically guides the victim into disabling macOS security features. ESET products detect this threat as variants of the aforementioned
OSX/TrojanDownloader.Adload trojan.
ESET telemetry registered the most macOS detections in T2 2022 in the United States (23.8%), Japan(11%), France (7.8%), Germany (4.4), and the United Kingdom (3.9%). The macOS detection numbers
in all of these countries saw decreasing numbers, with the United Kingdom experiencing the biggest
drop among this group, by 38.5%.

ESET THREAT REPORT T2 2022 | 29

0.0%

23.8%

Global distribution of macOS detections in T2 2022

PDF document navigating the victim into disabling macOS security features

Even though the overall macOS detection numbers are decreasing, ESET researchers continue todiscover new threats to the users of this platform being deployed by various APT groups. As described in the Featured story, ESET researchers discovered a previously unknown macOS backdoor,
which they dubbed CloudMensis [6], that spies on users of macOS systems and exclusively uses public
cloud storage services to communicate back and forth with its operators. The limited distribution of
OSX/CloudMensis.A suggested to the researchers that it is used as part of a targeted operation. Lateron, this hypothesis was corroborated – ESET researchers were able to attribute CloudMensis to the
ScarCruft APT group.
In previous issues, the ESET Threat Report has extensively covered the topic of Pegasus, thecommercial phone hacking tool developed by the NSO Group. In T2 it was revealed [72] that the tool
was used by at least five member states of the European Union. And to show that it is not the only
commercial-grade spyware targeting high-profile individuals, Google’s Threat Analysis Group (TAG) [73]informed the public about the iOS version of another commercial-grade spyware called Hermit, spyingon users in Italy and Kazakhstan.

To address the security issues related to iOS spyware, such as Pegasus and Hermit, Apple included
a new security feature in iOS 16, which was released in September 2022. The feature is called
Lockdown Mode: it limits certain functions of the iPhone and some of its apps that can be vulnerable
to an attack. For instance, it blocks attachments in messages (except for pictures), FaceTime calls if
the iPhone has not called that contact before, incoming invitations, configuration profiles, and wired
connections to a computer or an accessory. This function also blocks attempts to enroll the iPhone
into mobile device management software. Lockdown Mode will also be part of macOS Ventura scheduled to be released in October. According to ESET researchers, protecting against the aforementioned
CloudMensis malware may be one of the reasons some users would want to enable this additionalfeature on their Apple devices. Another new security feature of iOS 16 is that security updates no longer require a full iOS update and can be installed automatically: this option has to be enabled manually
via Settings → General → Software Update.
Vulnerabilities tied to Pegasus are, however, not the only ones that Apple device owners should beconcerned about. In August, Apple released patches for two new zero-day vulnerabilities (CVE-202232893 [74] and CVE-2022-32894 [75]) that may have been actively exploited [76], according to Apple.
The first vulnerability was found in Apple’s WebKit (HTML rendering software) and allows a malicious
website to trick iPhones, iPads, and Macs into running unauthorized software. The second vulnerability then allows the attacker, who has already exploited the WebKit vulnerability, to gain control of theoperating system kernel, which would allow the attacker to take over control of the whole device. An
update is therefore highly advised.

ESET THREAT REPORT T2 2022 | 30

IoT SECURITY
While zombie botnet Mozi started losing steam, other Mirai-based botnets used T2 2022 to expand while updating the list of vulnerabilities they exploit.
Is Mozi, the biggest zombie IoT botnet monitored by ESET research, finally dying? Our telemetry datasuggests just that, as the number of bots dropped by 23%, falling from 500,000 compromised devices
in T1 to 383,000 in T2. The number of attacks took the same downward path, plunging from 5.6 million in T1 to 4.3 million in T2, meaning an equal decline of 23%. Most of these attacks were aimed atmachines in the US (30.4%).

0.0%

76.8%

As in the previous periods, the largest portion of the botnet was geolocated in China (53%) and India(35%). Of the approximately 94,000 targeted IPs, most were in Germany (17%), the United States (8%),
and Japan (7%).
Most of these statistics confirm the assumption that the Mozi botnet is on autopilot, running without
human supervision since its reputed author was arrested [77] in 2021. Subsequently, the distributionof both attacker IPs and target IPs as well as the share of individual countries have hardly changed.
There was also no change in the list of vulnerabilities abused to spread Mozi malware and the shareof attacks caused by each one of them.
However, that’s not the case for other botnets monitored by ESET researchers, with the ZHtrap
botnet being a prime example. The number and distribution of its bots have changed dramaticallybetween T1 and T2 2022.
While the number of ZHtrap attacks dropped from 106,000 to 58,000 – taking a 45% dip – thegeolocations of its bots changed massively. Almost 77% of attacks caused by this botnet in T2 2022
came from the Netherlands, an increase of 48 percentage points compared to T1. The second largest
ZHtrap bot activity was seen in Egypt, growing from nonexistent in T1 to a 10% share in T2 2022,
pushing the United States down to the third place with 5% (-23 percentage points).
While the operators didn’t seem interested in the US as the location of their bot farm, they moved
most of their payload servers there, growing their share to 53% in T2 versus 9% in T1. In contrast,
ZHtrap shut down a large part of its payload servers in the Netherlands, its share dropping from 41%
in T1 to 16% in T2.
In stark contrast to Mozi, the list of vulnerabilities used to spread ZHtrap has also changed dynamically. In T1 2022, it was spreading almost exclusively (99.5%) via the old CVE-2015-2051 [78] in D-Linkrouters. In T2, this weakness remained the number one choice but was used in “only” 80% of attacks,

Global distribution of ZHtrap bot activity in T2 2022

followed by the EDB-41471 [79] bug in MVPower DVR devices with 13%. Also, two recently reported
flaws – one in Confluence servers (CVE-2022-26134 [80]) and another in Zyxel devices (CVE-202230525 [81]) – were at least tested by the operators as a distribution vector.
Of course, ZHtrap and Mozi aren’t the only two botnets that used Mirai’s leaked source code tobuild their own malware. Gafgyt, BotenaGo, Dofloo, and Tsunami are just a few of the most prominent names that ESET labels with one umbrella name – “Mirai-based botnets”. This diverse group
cumulatively accounted for 11.7 million attacks in T2 2022, a 61% increase compared to T1 2022.
What significantly influenced these figures was our recent addition of detection for attacks against
a patched 2019 flaw in NVMS-9000 Digital Video Recorders [82]. Despite this vulnerability not having
a CVE or EDB entry, it has become quite prevalent in T2 2022 and is now the second most “popular”
attack vector, accounting for 21% of attempts caused by Mirai-based botnets.

ESET THREAT REPORT T2 2022 | 31

0.4% 0.3% 1.2%
0.7%
0.9%
1.5%
1.9%
9.3%

EDB-41471

0.0%

24.9%

0.0%

21.7%

0.0%

37.9%

NoName (NVMS-9000 DVR)
EDB-44760
CVE-2017-18368
CVE-2019-12725
CVE-2022-1388

21.5%
62.3%

CVE-2018-10562
EDB-31683
CVE-2018-20062
Other

Vulnerabilities most exploited by Mirai-based botnets in T2 2022

Another strong contributor to the same 11.7 million attacks was the vulnerability found in D-Linkrouters EDB-44760 [83]. Between T1 and T2 2022, its detection numbers grew more than twentyfold, making it the third most exploited flaw, with 9.3%. However, both previously mentioned vulnerabilities are still dwarfed by the EDB-41471 [79] bug in MVPower DVR devices, which claimed a 62.3%
share of the Mirai-based detection pie.
From a geographic point of view, the United States withstood 25% of attacks by the Mirai-based
botnets – not counting Mozi and ZHtrap – followed by Germany with 7.1% and the United Kingdom
with 6.6%. Considering only the targeted IP addresses, Germany (16%) led the pack, followed by the
US (9%) and Japan (6%).
Regarding the infrastructure of Mirai-based botnets, 8% of their payload servers disappeared between
T1 and T2 2022. Most of those remaining were detected in the US (38%), Netherlands (11%), andGermany (9%). As for bots, these were most prevalent in China (21%), the US (16%) and Egypt (15%).
Moving away from the botnets, the number of user-requested router scans in ESET security products
fell by 17%, with the number of tested routers falling by 21%. Due to a smaller scan base, the numberof devices that were using easy-to-guess passwords declined proportionately, dropping by 25%. The
dip in the T2 data was probably caused by the Northern Hemisphere summer vacations and lower
overall activity in July and August.
With IoT devices, even basic vulnerabilities can be a major issue, since patching them is seldom as
straightforward as with computers, phones, and tablets. But when a critical CVSS 9.8 flaw hits the

Global distribution of Mirai-based attacks, bots and payload servers (from top to bottom) in T2 2022

ESET THREAT REPORT T2 2022 | 32

market, threat actors don’t wait long to start exploiting it. This was the case with CVE 2022-1388[84] found in F5 Big-IP network devices. It allowed an unauthenticated attacker to gain full control ofvictims’ devices – and based on news stories there were a few occasions where it was even used towipe them [85].
In T2 2022, ESET telemetry reported over 100,000 exploitation attempts targeting CVE 2022-1388 in
F5 devices. If not blocked, the established connections would have been used to drop and run a Linuxshell script that would then download a Mirai binary from a predefined list of URL links. Several Miraibased botnets exploited this vulnerability to expand their bot network.
The last four months were rife with experiments that showed how vulnerable the IoT-powered world
can become. Manufacturers including Honda [86], Hyundai/Kia [87], and Tesla [88] saw their products
broken into by researchers, who not only gained access but started and even drove off in them.
In T2 2022, Forescout researchers also presented proof-of-concept ransomware [89] that can target
IoT, IT, and operational technology (OT). Not exactly a new idea, as this type of threat has been predicted for years [90], but certainly one worth keeping in mind as more PoCs like this are being published.
In T1 2022, we mentioned the sabotage of Viasat’s KA-SAT satellite network [91], which caused major
disruptions to communications and forced the company to distribute 30,000 replacement modems.
In T2, Ukraine, the European Union, and the Five Eyes nations all attributed the incident to Russia [92].

EXPERT COMMENT
According to expectations, the zombie-like Mozi botnet is slowly starting to lose steam, which opens
up the field to other Mirai-based botnets. And as our data shows, these are becoming increasingly
powerful and widespread, experimenting with vulnerabilities both old and new, including those from
popular vendors. What this means for organizations and users is that patching is of the utmost importance, especially in developed countries, which are still the main targets of most IoT threats monitoredby our systems.
Milan Fránik, ESET Malware Researcher

ESET THREAT REPORT T2 2022 | 33

EXPLOITS
While attack attempts against RDP, SQL and SMB followed a downward spiral in T2 2022, new exploits like Log4Shell and Spring4Shell grew in popularity.
After an unprecedented drop in RDP password-guessing attacks in T1 2022, the detection trend did notrecover and stayed down at levels not seen since 2020. The decrease between the two periods was stilla whopping 89.4%, going from 123 billion detections to 13 billion; however, this difference was mostly
caused by the high volumes of blocked attempts in the first days of January 2022. On an average day inT2 2022, 104 million RDP connection attempts were blocked compared to 1 billion in T1 2022.

0.0%

30.9%

0.0%

10.8%

The trend of unique clients reporting an RDP attack attempt declined at a much slower pace, going
down by 22.8% between T1 and T2, stabilizing in May. The average number of unique clients facing an
RDP attack attempt in May through August 2022 receded from 102,000 to 73,000 devices.
The reasons for the decline remain the same as in T1: less remote work, better countermeasures
implemented by security and IT departments, and Russia’s war with Ukraine, which seems to have
impacted portions of the attacking infrastructure. Another factor that might cause further drops
in RDP attacks is the default protection [93] in Windows 11 against brute-force attacks. However,its effects will probably become apparent only after more organizations have adopted the newest
version of that operating system.
Global distribution of RDP password guessing attack attempt sources in T2 2022

Unique clients reporting RDP attacks (right axis)
140

5.0
4.5

120

4.0
3.5

-22.8%

3.0
2.5
2.0
1.5
1.0
0.5

T1

T2

0.0
1-Jan-2022

100

Thousands

Billions

RDP connection attempts (left axis)

80
60
40

-89.4%

20
01-Mar-2022

1-May-2022

1-Jul-2022

Trends of RDP connection attempts and number of unique clients in T1 2022 – T2 2022, seven-day moving average

Global distribution of RDP password guessing attack attempt targets in T2 2022

ESET THREAT REPORT T2 2022 | 34

From a geographical standpoint, most of the 13 billion blocked RDP attacks in T2 2022 were aimed
at Poland (10.8%), the United States (10.2%), and Spain (7.3%). Keeping a distant lead, Russian IP
addresses were responsible for the largest portion of the attacks (31%), followed by IPs in the
US (14%) and Panama (8%). It is important to note that the use of VPNs and proxy services might
influence these statistics.
In comparison to RDP, attacks against public-facing SQL services only saw one sharp drop in January
after which detection numbers found steady ground. Attack attempts declined from 859 million in
T1 to 612 million in T2 2022, meaning a 29% reduction. The number of unique clients closed T2 2022with a negligible 1.8% decline. On an average day in May through August 2022, SQL services had towithstand 4.9 million attack attempts.
Geographically, the country that saw the most attacks against SQL services in T2 was Turkey. Threat
actors hit it especially hard on July 1 and July 20, causing peaks in our data that accounted for 65% and
61% of SQL attack detections on those days. The last uptick in SQL data occurred on August 31, with
the United Kingdom facing 49% of SQL attacks on that day, followed by Austria with 19%.
In contrast with SQL and RDP, the trend of attacks targeting SMB services kept its balance. Blocked
connection attempts went from 356 million in T1 to 324 million in T2 2022, accounting for a minor
decline of only 9%. The number of unique clients reporting such incidents remained steady, losing
only 0.7%. On an average day in T2 2022, ESET’s brute-force attack protection blocked 2.6 million
malicious SMB connection attempts.
SMB attack attempts (right axis)

5.0

SQL attack attempts (right axis)-89.4% RDP

4.5-28.7% SQL-8.9% SMB

4.0
3.5

T1

3.0
2.5
2.0
1.5

T2

1.0

35
30
25
20
15
10
5

0.5

0

0.0
1-Jan-2022

1-Mar-2022

1-May-2022

1-Jul-2022

Trends of RDP, SMB and SQL attack attempts per client in T1 2022 – T2 2022, seven-day moving average

Millions

Billions

RDP attack attempts (left axis)

Password guessing

1%
1%
1%
1%

Apache log4j CVE-2021-44228

18%

Apache Struts2 CVE-2017-5638
SMB.DoublePulsar scan

41%

3%

Apache spring4shell CVE-2022-22963,22965
MS IIS CVE-2015-1635

6%

Pulse Secure CVE-2019-11510
MS SMB1 EternalBlue

7%
8%

MS RDP CVE-2019-0708 Bluekeep

13%

MS Exchange Exploit.CVE-2021-26855
Other

External network intrusion vectors reported by unique clients in T2 2022

The country facing the biggest portion of the attacks aimed at SMB was Mexico with 35%, followed by
France with 16% and the US with 9%.
Regarding the most prevalent network intrusion vectors in T2 2022, password guessing kept its leadwith 41% of the detection pie – identical to its share in T1.
The second most favored vector was the critical Log4J vulnerability, with 13%, which became increasingly popular among threat actors. T2 2022 data showed a 14% growth in exploitation attempts correlating with news reports of ransomware gangs [94] and sophisticated groups such as Mercury [95]and Lazarus [96] abusing the vulnerability. Despite a patch being available, it seems Log4J isn’t goingaway anytime soon – with CISA’s Cyber Safety Review Board calling it endemic [97].
In T1 2022, another high-profile vulnerability called Spring4Shell came to light and started to gain
traction. Despite having potentially less severe consequences than Log4J, it followed a similar trajectory, demonstrating the potential to become one of the top network attack vectors. After T2 2022, we
can say that scenario did not materialize, at least not yet.
Spring4Shell remained fifth among the top 10 network intrusion vectors, but its share grew from 4%
in T1 to 6% in T2 2022. Its overall detections in May through August also went up by 113%; however,
the trendline showed a major drop of activity around May 20.
Last but not least, a new zero-day vulnerability surfaced in T2 2022. The now-patched CVE-202230190 [98] – also known as Follina – affects Microsoft’s Support Diagnostic Tool and enables an

ESET THREAT REPORT T2 2022 | 35

Log4J
1-Jan-2022

1-Mar-2022

1-May-2022

Spring4Shell
1-Jul-2022

Detection trend of Log4J exploitation attempts in T1 and T2 2022, seven-day moving average

9-Apr-2022

9-May-2022

9-Jun-2022

9-Jul-2022

9-Aug-2022

Detection trend of Spring4Shell exploitation attempts in April through August 2022, seven-day moving average

attacker to take control of a victim’s device. The bug also made headlines [99] because it has beenused by state-backed threat actors targeting EU and US organizations. CERT-UA even pointed its
finger at APT28 [100] as the possible culprit.
ESET telemetry reported hundreds of attempts to exploit Follina, demonstrated by several spikes inour detection data. The countries facing most of the attacks were Spain (20%), the US (7.5%) and theUnited Arab Emirates (7.3%).

EXPERT COMMENT
A likely explanation for the sudden drop in Spring4Shell detections is that a group of threat
actors tested the vulnerability as an intrusion vector and decided to drop it due to unsatisfactory
performance. Another is that they decided to use a different attack avenue for the time being.
Ladislav Janko, ESET Senior Malware Researcher

Follina30-May-2022

30-Jun-2022

31-Jul-2022

31-Aug-2022

Detection trend of attack attempts targeting the Follina vulnerability in T2 2022, seven-day moving average

ESET THREAT REPORT T2 2022 | 36

UPCOMING PRESENTATIONSAVAR 2022
Lazarus declares war on Windows system monitoring [101]ESET RESEARCHCONTRIBUTIONS

Since late 2021, Lazarus group malware authors have been improving new malware that isable to turn off as many Windows monitoring features as possible, effectively blinding mostmonitoring tools, security solutions, and event logging. In their presentation, ESET seniormalware researcher Peter Kálnai and ESET malware analyst Matěj Havránek will focus on themost recent version of this malicious module, discovered in summer 2022 and containing newly
added blinding features. They will demonstrate how these mechanisms operate and whatchanges the malware makes to the system once the module is executed. For developers of
security products, the contents of this session should provide the impetus to reevaluate theirimplementations and to increase their solutions’ self-protection.
Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin [101]ScarCruft, also known as APT37 and Reaper, is an espionage group that has been operating
since at least 2012 and primarily focuses on South Korea. Last year, ScarCruft conducted awatering-hole attack on a South Korean newspaper site. This attack was previously publicly
described as having the BLUELIGHT backdoor as its final payload. However, as ESET malware
researcher Filip Jurčacko will explain in his presentation, ESET Research discovered a second,
more sophisticated backdoor called Dolphin that was deployed on selected compromised machines via BLUELIGHT. In his talk, Jurčacko will present a technical description of the Dolphin
backdoor and its capabilities, provide useful information for threat hunters looking to track
ScarCruft activity, and show the evolution of multiple Dolphin versions that ESET researchers
observed after their initial discovery.
Behind the MirrorFace mask: LODEINFO malware interfering with Japanese elections [101]Latest engagements and achievementsof ESET Research experts

In the weeks leading up to the Japanese House of Councillors election in July 2022, the APTgroup that ESET researchers track as MirrorFace launched a spearphishing campaign against
Japanese political entities. Once the victims opened the malicious attachments, LODEINFO
malware – in use since 2019 and exclusively against Japanese entities – was executed, opening
the door for the threat actor to move to the next stage of the attack. In his presentation, ESET
malware researcher Dominik Breitenbacher will introduce the audience to the MirrorFace APTgroup, a threat actor exclusively targeting Japanese entities with the LODEINFO malware, andwill then provide a detailed description of the campaign against Japanese political entities. In theprocess, Breitenbacher will unearth MirrorFace tactics and procedures that haven’t been published in detail before. The presentation will close by describing the evolution of the LODEINFO
malware over the past few years.
ESET THREAT REPORT T2 2022 | 37

SparklingElf, recent supplies to SparklingGoblin’s Linux malware arsenal, new ties to APT41 [101]ESET researchers Thibaut Passilly and Vladislav Hrčka will present the discovery of a Linux variantof SideWalk, a modular Windows backdoor belonging to the SparklingGoblin APT group, that was
originally named StageClient. The researchers also discovered that the backdoor exhibits a hugefunctionality overlap with the Specter IoT botnet malware, a modular Linux RAT, that creates an all
but indisputable link between the malware authors, meaning that these tools come from the same
threat actor. During their presentation, the ESET researchers will explain the connections between
StageClient and Specter, introduce the SparklingGoblin APT group to the audience, and describe thecode similarities between StageClient and SideWalk. Lastly, they will describe how the Linux userland
rootkit, discovered alongside StageClient, injects itself into processes and hides its files and network
connections to achieve stealthiness.

Ekoparty 2022
Ukraine’s past and present cyberwar [102]For the past eight years, Ukraine has been the target of enormous cyber-aggression by numerous
APT groups. ESET principal malware researcher Robert Lipovsky will walk attendees through themost notable attacks, including those against the country’s power grid with a special focus on thelatest attempt: Industroyer2. This new version of the only malware specifically designed to trigger
electricity blackouts was deployed in Ukraine amidst the ongoing Russian invasion. As in 2016 withthe original Industroyer, the aim of this cyberattack was to cause a major power outage – but thistime the attackers failed. Lipovsky will outline how the attack unfolded, why it was unsuccessful, andreverse engineer the samples, showing how the code evolved since the first version. The presentation
will also focus on the evolution of disruptive wiper campaigns of the Sandworm APT group – from theinfamous NotPetya worm, through the HermeticWiper campaign that ESET discovered on February
23, 2022, only a few hours before the invasion, and on to CaddyWiper. It will also disclose how theattackers have recently been trolling ESET.

reliability of these indicators were discussed, along with how they can be combined to arrive at amore accurate conclusion. Attendees were also presented with the pitfalls associated with each ofthem, with examples of how we can get it wrong. This part of the presentation also brought up otherobstacles encountered when doing attribution, including the varying definitions of certain APT groups
among various researchers, along with tool sharing and so-called “umbrella groups” that encapsulate
multiple subgroups.

LABSConPhosphorescent Connections and Shifting Oil Reserves: Overlap in Middle Eastern Threat Actors [104]In his presentation, ESET senior threat intelligence analyst Adam Burgher revealed insights into recent campaigns deployed by Middle Eastern threat actors OilRig, APT35 (aka Phosphorus), and Agrius.
Attendees learned about a new OilRig campaign and the group’s shift in C&C methodology; a sharp
APT35 pivot from public vulnerability exploitation to a low-key custom backdoor campaign that is
ongoing; and an Agrius wiping campaign called Fantasy Vacation that targets the diamond industry
and has ties to APT35.

Black Hat USA 2022

DELIVERED PRESENTATIONSBSides Montreal
Clustering malware activity: How we do attribution [103]In this presentation, ESET malware researcher Alexandre Côté Cyr explained how ESET Researchdoes attribution using technical artifacts (such as code similarity), infrastructure, TTPs, and socio­
political factors like victimology. Concrete examples from previous research were showcased toillustrate how these indicators can be used, or misused, to cluster activity. The relative merits andIndustroyer2: Sandworm's Cyberwarfare Targets Ukraine's Power Grid Again [105]
ESET senior malware researcher Anton Cherepanov and ESET principal researcher Robert Lipovsky
provided technical details on Industroyer2, a new version of the only malware specifically designed totrigger electricity blackouts. Its latest observed variant was detected in Ukraine amidst the ongoing
ESET THREAT REPORT T2 2022 | 38

war, aiming to cause a major electricity outage in a region with a population of more than two million,
using components amplifying the impact. Joining the presentation was Deputy Director of Ukraine’s
State Service of Special Communications and Information Protection, Victor Zhora. This is the firsttime that a Ukrainian governmental representative has taken part in such a high-profile cybersecurity
conference. The Industroyer2 attack was thwarted thanks to the swift response of Ukrainian defenders and CERT-UA. ESET Research provided the Ukrainian side with crucial analysis of this threat. In thepresentation, the researchers showed data linking this attack to the notorious Sandworm APT groupand discussed why and how the attack was mostly unsuccessful. On top of that, the attendees were
provided with actionable advice for defenders, including log entries, EDR rules, and detection/hunting
rules for Snort and YARA.

Virus Bulletin 2022
Lazarus & BYOVD: Evil to the Windows core [106]In their session, ESET malware researcher Peter Kálnai and ESET malware analyst Matěj Havránek
took a deep technical dive into a malicious component that was used in an attack by the Lazarus APTgroup in late 2021. Previously undocumented, this malware is a sophisticated user-mode module thatuses the Bring Your Own Vulnerable Driver (BYOVD) technique, leveraging a vulnerability in a legitimate, signed Dell driver. After gaining write access to kernel memory, the module’s global goal is toblind security solutions and monitoring tools. This is tactically realized via several distinct mechanismsthat target important kernel functions, structures, and variables of Windows systems from versions
7.1 up to Windows Server 2022. Kálnai and Havránek explained these mechanisms by demonstrating
how they operate and what changes they make to system monitoring once the user-mode module is
executed. Our researchers also compared this Lazarus case to other APT groups abusing BYOVD, as it
possesses a complex bundle of ways to disable monitoring interfaces not seen in the wild thus far.
Creepy things that glow in the dark: a deep look at POLONIUM’s undocumented tools [107]
POLONIUM is a threat actor that was first publicly documented in June 2022 by Microsoft researchers. While public visibility of the group’s activities is very limited, ESET telemetry shows that
POLONIUM has in fact been active since at least September 2021, continuously developing new
tools and improving its existing ones. The presentation explained and exposed various componentsof POLONIUM’s toolset – the findings of ESET malware researcher Matias Porolli, presented by ESET
principal researcher Robert Lipovsky, show that the group uses four previously undocumented backdoors, and several in-house-developed tools, including custom keyloggers and a tool to capture snapshots from the webcam. Lipovsky also shared insights about how the group operates, its victimology,
network infrastructure, the tricks that POLONIUM operators use to try to evade detection, and how
they abuse cloud storage services for command and control. The presentation concluded with ashowcase of possible overlaps with other APT groups.

RSA Conference 2022
ESPecter: Showing the Future of UEFI Threats [108]In recent years, it has become clear that UEFI threats are real and have been deployed in the wild.
UEFI implants such as LoJax and MosaicRegressor have used the lowest level of persistence, SPI
flash, but the actors behind the ESPecter bootkit think that compromising the bootloader is the way.
This session by ESET head of threat research Jean-Ian Boutin and ESET malware researcher Martin
Smolár described ESET’s discovery of the aforementioned ESPecter – a previously undocumented
real-world UEFI bootkit persisting on the EFI System Partition (ESP). This session raised awareness of
UEFI threats affecting the ESP and provided guidance and resources for defenders to help secure theirpre-OS environments. Boutin and Smolár’s analysis of this previously unknown, real-world UEFI ESP
bootkit helped attendees understand details of the techniques used by these threats. Although UEFI
threats are very rare, ESET’s discovery of ESPecter shows they are definitely not mere specters.

CODE BLUE 2022 REcon 2022 SecTor 2022
Under the hood of Wslink’s multilayered virtual machine (CODE BLUE 2022) [109]Under the hood of Wslink’s multilayered virtual machine (REcon 2022) [110]Under the hood of Wslink’s multilayered virtual machine (SecTor 2022) [111]Wslink is a unique loader, linked to the Lazarus group, that ESET researchers discovered anddocumented at the end of 2021. Most Wslink samples are packed and protected with an advanced
virtual machine (VM) obfuscator; the samples contain no clear artifacts, such as specific section
names, that easily link them to an already known and publicly described obfuscator. This VM
additionally introduces several other obfuscation techniques such as insertion of junk code, encodingof virtual operands, duplication of virtual opcodes, opaque predicates, merging of virtual instructions,and a nested VM. In his presentation, ESET malware researcher Vladislav Hrčka analyzed the internalsof the VM and described ESET Research’s semiautomated approach to seeing through the obfuscation techniques in a reasonable time. The approach was demonstrated on a few chunks of bytecodefrom a protected sample and the results were compared against a subsequently discovered
non-obfuscated sample to confirm the validity of the method.

ESET THREAT REPORT T2 2022 | 39

MITRE ATT&CK CONTRIBUTIONSESET will be participating in the next round of MITRE Engenuity ATT&CK [112] evaluations that will
focus on tactics, techniques, and procedures (TTPs) applied by the Turla APT group. Turla is a cyber­espionage group that has been active for more than 12 years. It has compromised many governments, especially diplomatic entities, all around the world, operating a large malware arsenal that
ESET Research has documented over the last few years [113] [114] [115] [116] [117]. Besides ourresearch, we also made several contributions [118] to the MITRE ATT&CK Enterprise Matrix related
to the Turla Group [119].
ESET’s research into APT groups like Turla has directly or indirectly helped many organizations andnation-states successfully thwart potential attacks by providing much-needed visibility into TTPs
used by those very same groups for economic, espionage, geopolitical, or criminal purposes. ESET
will again participate in both the Detection and the Protection evaluation rounds; results are to be
expected during the second quarter of 2023.

The vulnerabilities can be exploited to achieve arbitrary code execution in the early phases of theplatform boot, possibly allowing the attackers to hijack the OS execution flow and disable some
important security features. These vulnerabilities were caused by insufficient validation of the
DataSize parameter passed to the UEFI Runtime Services function GetVariable. An attacker
could create a specially crafted NVRAM variable, causing buffer overflow of the data buffer in thesecond GetVariable call.
It’s a typical UEFI “double GetVariable” vulnerability that can be identified in the firmware code by
the IDA plugin efiXplorer. However, the vulnerabilities we found were not covered [123] by this plugin
at the time of discovery. To help fellow researchers discover similar vulnerabilities and improve overall
real-world UEFI firmware security, we submitted our improvements to the efiXplorer repository [124].

OTHER CONTRIBUTIONSESET researchers discovered three buffer overflow vulnerabilities in the UEFI firmware of several
Lenovo Notebook devices, affecting more than 70 various models, including several within the
ThinkBook series. All of these vulnerabilities were reported to the manufacturer on February 18.
Lenovo acknowledged them, and released a security advisory [11] on June 12 containing a list ofaffected devices and firmware update instructions.
CVE-2022-1890 [120]
UEFI BIOS images of several Lenovo laptop models contained a buffer overflow vulnerability leading toarbitrary code execution while processing the System NVRAM variable inside the ReadyBootDxe driver.
CVE-2022-1891 [121]UEFI BIOS images of several Lenovo laptop models contained a buffer overflow vulnerability
leading to arbitrary code execution while processing the System NVRAM variable inside the
SystemLoadDefaultDxe driver.
CVE-2022-1892 [122]
UEFI BIOS images of several Lenovo laptop models contained a buffer overflow vulnerability
leading to arbitrary code execution while processing the OilSetup NVRAM variable inside the
SystemBootManagerDxe driver.
ESET THREAT REPORT T2 2022 | 40

CREDITSABOUT THE DATA IN THIS REPORTTeamContributors

The threat statistics and trends presented in this report are based on global telemetry data from ESET.
Unless explicitly stated otherwise, the data includes detections regardless of the targeted platform.

Peter Stančík, Team Lead

Dušan Lacika
Igor Kabina
Ján Šugarek
Jean-Ian BoutinJiří Kropáč
Juraj Jánošík
Ladislav Janko
Lukáš Štefanko
Marc-Étienne M.LéveilléMartin Červeň
Michal Malík
Milan Fránik
Miroslav Baláž
Miroslav Legéň
Patrik Sučanský
Peter Kálnai
Radim Raszka
Robert Kapp
Vladimír Šimčák
Zuzana Legáthová
Zoltán Rusnák

Klára Kobáková, Managing Editor
Aryeh Goretsky
Branislav Ondrášik
Bruce P. Burrell
Hana Matušková
Nick FitzGerald
Ondrej Kubovič
Zuzana Pardubská

Foreword
Roman Kováč, Chief Research Officer

Further, the data excludes detections of potentially unwanted applications [125], potentially unsafe
applications [126] and adware [127], except where noted in the more detailed, platform-specificsections and in the Cryptocurrency threats section.
This data was processed with the honest intention to mitigate all known biases, in an effort tomaximize the value of the information provided.
Most of the charts in this report show detection trends rather than provide absolute numbers. Thisis because the data can be prone to various misinterpretations, especially when directly compared toother telemetry data. However, absolute values or orders of magnitude are provided where deemed
beneficial.

ESET THREAT REPORT T2 2022 | 41

REFERENCES[1] https://www.pcloud.com/[21] https://twitter.com/ESETresearch/status/1559553324998955010[2] https://office.hancom.com/[22] https://nvd.nist.gov/vuln/detail/CVE-2017-11882[3] https://nvd.nist.gov/vuln/detail/CVE-2020-9934[23] https://en.wikipedia.org/wiki/Advance-fee_scam[4] https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consentand-control-tcc-framework-for-4e14806f1de8[24] https://asec.ahnlab.com/en/34793/[5] https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-frommercenary-spyware/[25] https://www.recordedfuture.com/amid-rising-magecart-attacks-online-ordering-platforms[26] https://www.bleepingcomputer.com/news/security/lockbit-30-introduces-the-first-ransomwarebug-bounty-program/[6] https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos[27] https://twitter.com/vxunderground/status/1561262483448512513
spyware/[7] https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html[8] https://malpedia.caad.fkie.fraunhofer.de/actor/apt37[9] https://attack.mitre.org/groups/G0067/[10] https://twitter.com/ESETresearch/status/1575103839115804672[11] https://support.lenovo.com/us/en/product_security/len-91369[12] https://twitter.com/ESETresearch/status/1547166334651334657[13] https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malwaremasquerades-as-apple-wears-face-of-apt/[14] https://twitter.com/ESETresearch/status/1547943014860894210[15] https://twitter.com/ESETresearch/status/1527531726905409536[16] https://www.welivesecurity.com/2022/05/20/sandworm-ukraine-new-version-arguepatchmalware-loader/[17] https://twitter.com/ESETresearch/status/1524731829139476480[18] https://twitter.com/ESETresearch/status/1526183746524876802[19] https://twitter.com/ESETresearch/status/1521735320852643840[20] https://twitter.com/h2jazi/status/1555205042331947011[28] https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/[29] https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/[30] https://thehackernews.com/2022/07/new-rust-based-ransomware-family.html[31] https://www.lpalmieri.com/posts/error-handling-rust/[32] https://www.bleepingcomputer.com/news/security/ransomware-hacking-groups-move-fromcobalt-strike-to-brute-ratel/[33] https://www.bleepingcomputer.com/news/security/automotive-supplier-breached-by-3ransomware-gangs-in-2-weeks/[34] https://www.bleepingcomputer.com/news/security/fbi-zeppelin-ransomware-may-encryptdevices-multiple-times-in-attacks/[35] https://www.coveware.com/blog/2022/7/27/fewer-ransomware-victims-pay-as-mediumransom-falls-in-q2-2022[36] https://rusi.org/explore-our-research/publications/commentary/ransomware-now-threatens-global-south[37] https://www.state.gov/reward-offers-for-information-to-bring-conti-ransomware-variant-coconspirators-to-justice/[38] https://www.phmsa.dot.gov/news/phmsa-issues-proposed-civil-penalty-nearly-1-millioncolonial-pipeline-company-control-room[39] https://www.cisa.gov/uscert/ncas/alerts/aa22-187a[56] https://thehackernews.com/2022/08/hackers-stole-crypto-from-bitcoin-atms.html[40] https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-smalland-midsize-businesses-with-h0lygh0st-ransomware/[57] https://www.sec.gov/news/press-release/2022-78[41] https://www.qnap.com/en/security-advisory/QSA-22-21[58] https://www.welivesecurity.com/2020/09/02/kryptocibule-multitasking-multicurrencycryptostealer/[42] https://www.bleepingcomputer.com/news/security/new-redeemer-ransomware-versionpromoted-on-hacker-forums/[59] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/
clipminer­-­bitcoin-mining-hijacking[43] https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree[60] https://www.bleepingcomputer.com/news/security/massive-facebook-messenger-phishingoperation-generates-millions/[44] https://www.bleepingcomputer.com/news/security/conti-ransomware-shuts-down-operationrebrands-into-smaller-units/[61] https://faq.whatsapp.com/824303528016260/?locale=en_US[45] https://www.bleepingcomputer.com/news/security/foxconn-confirms-ransomware-attackdisrupted-production-in-mexico/[62] https://www.trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials-crypto-related-keys.html[46] https://www.darkreading.com/attacks-breaches/costa-rica-declares-state-of-emergency-undersustained-conti-cyberattacks[63] https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/[47] https://www.bleepingcomputer.com/news/security/building-materials-giant-knauf-hit-by-blackbasta-ransomware-gang/[48] https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-onsecurity-giant-entrust-leaks-data/[49] https://thehackernews.com/2022/05/us-charges-venezuelan-doctor-for-using.html[50] https://www.bleepingcomputer.com/news/security/astralocker-ransomware-shuts-down-andreleases-decryptors/[51] https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-astralockeryashma-ransomware-victims/[52] https://www.europol.europa.eu/media-press/newsroom/news/
hit-ransomware-no-more-ransom-now-offers-136-free-tools-to-rescue-your-files[53] https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blockinginternet-macros-by-default-in/bc-p/3566717/highlight/true#M4281[64] https://support.google.com/googleplay/android-developer/answer/11950272?hl=en[65] https://www.europol.europa.eu/media-press/newsroom/news/
takedown-of-sms-based-flubot-spyware-infecting-android-phones?
[66] https://www.welivesecurity.com/2021/05/17/take-action-now-flubot-malware-may-be-on-itsway/[67] https://twitter.com/ESETresearch/status/1526897310231322630[68] https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly[69] https://www.f5.com/labs/articles/threat-intelligence/f5-labs-investigates-malibot[70] https://www.trendmicro.com/en_us/research/22/g/examining-new-dawdropper-banking-dropperand-daas-on-the-dark-we.html[71] https://github.com/BishopFox/sliver[72] https://www.politico.eu/article/pegasus-use-5-eu-countries-nso-group-admit/[54] https://thehackernews.com/2022/06/new-emotet-variant-stealing-users.html[73] https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-andkazakhstan/[55] https://www.bleepingcomputer.com/news/security/bored-ape-yacht-club-otherside-nfts-stolenin-discord-server-hack/[74] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32893[75] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32894

[76] https://www.theguardian.com/technology/2022/aug/18/apple-security-flaw-hack-iphone-ipadmacs[77] https://twitter.com/360Netlab/status/1420390398825058313[78] https://nvd.nist.gov/vuln/detail/CVE-2015-2051[79] https://www.exploit-db.com/exploits/41471[80] https://nvd.nist.gov/vuln/detail/CVE-2022-26134[81] https://nvd.nist.gov/vuln/detail/CVE-2022-30525[82] https://isc.sans.edu/diary/Scanning+Activity+for+NVMS-9000+Digital+Video+Recorder/25434[83] https://www.exploit-db.com/exploits/44760[84] https://nvd.nist.gov/vuln/detail/CVE-2022-1388[97] https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf[98] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30190[99] https://www.wired.com/story/microsoft-follina-vulnerability-windows-office-365/[100] https://cert.gov.ua/article/341128[101] https://aavar.org/cybersecurity-conference/index.php/agenda/[102] https://www.ekoparty.org/en_US/[103] https://bsidesmtl.ca/bsides-montreal-2022-september-10-2022/program-2022/[104] https://www.labscon.io/speakers/adam-burgher/[105] https://www.blackhat.com/us-22/briefings/schedule/#industroyer-sandworms-cyberwarfaretargets-ukraines-power-grid-again-27832[85] https://www.bleepingcomputer.com/news/security/critical-f5-big-ip-vulnerability-exploited-towipe-devices/[106] https://www.virusbulletin.com/conference/vb2022/abstracts/lazarus-byovd-evil-windows-core/[87] https://www.thedrive.com/news/how-thieves-are-stealing-hyundais-and-kias-with-just-a-usbcable[108] https://www.rsaconference.com/library/presentation/usa/2022/especter%20first%20
real-world%20uefi%20bootkit%20persisting%20on%20esp[88] https://arstechnica.com/information-technology/2022/06/
hackers-out-to-steal-a-tesla-can-create-their-very-own-personal-key/[109] https://codeblue.jp/2022/en/talks/?content=talks_21[107] https://www.virusbulletin.com/conference/vb2022/abstracts/[86] https://www.thedrive.com/tech/i-tried-the-honda-keyfob-hack-on-my-own-car-it-totally-worked creepy-things-glow-dark-deep-look-poloniums-undocumented-tools/[89] https://thehackernews.com/2022/06/researchers-demonstrate-ransomware-for.html[90] https://www.welivesecurity.com/2017/01/25/rot-ransomware-things/[91] https://news.viasat.com/blog/corporate/ka-sat-network-cyber-attack-overview[92] https://thehackernews.com/2022/05/eu-blames-russia-for-cyberattack-on-ka.html[93] https://thehackernews.com/2022/07/microsoft-adds-default-protection.html[94] https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html[95] https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/[110] https://cfp.recon.cx/2022/talk/7EQPJX/[111] https://sector.ca/sessions/under-the-hood-of-wslinks-multilayered-virtual-machine/[112] https://attackevals.mitre-engenuity.org/enterprise/turla/[113] https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf[114] https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf[115] https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf[116] https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-wateringholes/[117] https://www.welivesecurity.com/2020/05/26/agentbtz-comratv4-ten-year-journey/[96] https://www.bleepingcomputer.com/news/security/lazarus-hackers-target-vmware-servers-with[118] https://attack.mitre.org/software/S0126/
log4shell-exploits/[119] https://attack.mitre.org/groups/G0010/[120] https://github.com/eset/vulnerability-disclosures/commit/b7db546f7b58dc88509898d77bfdc89
59b929eb0#diff-1b088545db98018b1b6c3909d4e879c0033325f4c3762a4afcb55a819c5cddb8[121] https://github.com/eset/vulnerability-disclosures/commit/b7db546f7b58dc88509898d77bfdc89
59b929eb0#diff-da115c7f06d6e27f4d388104dc64d82b1a101d13ed7339cdd3c5e94fd7d3056d[122] https://github.com/eset/vulnerability-disclosures/commit/b7db546f7b58dc88509898d77bfdc89
59b929eb0#diff-c0af4b8268b4ec4c292409326bfcf5e982993cf5275bcf0d2aa85ef18876a551[123] https://i.blackhat.com/eu-20/Wednesday/eu-20-Labunets-efiXplorer-Hunting-For-UEFIFirmware-Vulnerabilities-At-Scale-With-Automated-Static-Analysis.pdf[124] https://github.com/binarly-io/efiXplorer/commit/6bccee7b6817c8af6a737c24c25e88435a85a3f0[125] https://help.eset.com/glossary/en-US/unwanted_application.html[126] https://help.eset.com/glossary/en-US/unsafe_application.html[127] https://help.eset.com/glossary/en-US/adware.html

About ESETFor more than 30 years, ESET® has beendeveloping industry-leading IT security
software and services to protect businesses,
critical infrastructure and consumers worldwide
from increasingly sophisticated digital threats.
From endpoint and mobile security to endpoint
detection and response, as well as encryption
and multifactor authentication, ESET’s highperforming, easy-to-use solutions unobtrusively
protect and monitor 24/7, updating defenses
in real time to keep users safe and businesses
running without interruption. Evolving threats
require an evolving IT security company thatenables the safe use of technology. This isbacked by ESET’s R&D centers worldwide,
working in support of our shared future. For
more information, visit www.eset.com or follow
us on LinkedIn, Facebook, and Twitter.

© 2022 ESET, spol. s r.o. - All rights reserved.
Trademarks used herein are trademarks or registered trademarks of ESET, spol. s r.o.
All other names and brands are registered trademarks of their respective companies.

WeLiveSecurity.com@ESETresearch
ESET GitHub