Mastodawn

Folks do realize the people telling you QC will be a thing and break RSA and EC are exactly the same folks who were telling you AGI will be a thing, who were the exact same folks telling you the metaverse is the next big thing, who are the exact same folks telling you NFTs would take off, who were the exact same folks telling you bitcoin would replace Visa, who were....

Ján Trenčanský 1d ago

Show thread

Kevin Beaumont 2d ago

A thing being repeated across businesses worldwide, including at Microsoft, is C level execs struggling to know why most staff aren’t using Copilot for M365, despite how much it costs.

Because most staff don’t spend all day in Teams meetings reading out PowerPoint slides to people who pretend to care. They have actual jobs. Doing work. Which they know how to do. Because it is their job.

Ján Trenčanský 1d ago

ESET Research 1d ago

#ESETresearch has identified a Silver Fox campaign that actively takes advantage of the current annual tax filing and organizational change season in Japan, a period when companies generate a high volume of legitimate financial and HRrelated communications. https://www.welivesecurity.com/en/business-security/cunning-predator-how-silver-fox-preys-japanese-firms-tax-season/
In this operation, Silver Fox sends tailored spearphishing emails crafted to look like one of such communication. To make the emails appear authentic, the attackers often include the name of the targeted company directly in the subject line.
The sender fields often impersonate employees at the targeted companies. This indicates Silver Fox performs reconnaissance before attacking. Using names that the targets are likely to recognize, makes it more difficult to distinguish the messages from real internal notifications.
The emails typically contain either a malicious attachment or a link leading to a malicious file. The files are named to resemble common HR, financial, or tax-related documents.
Opening the malicious files drops ValleyRAT, a remote access trojan that Silver Fox has used across multiple campaigns. Once deployed, it enables the actor to take remote control of the machine and harvest sensitive information. ESET products detect this malware as Win64/Valley.
Note that even though ESET observes the most activity in Japan, Silver Fox also currently operates in Taiwan, India, Indonesia, Australia, the United Kingdom, and Brazil. IoCs available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/silver_fox

Ján Trenčanský 2d ago

Ian Campbell 🏴2d ago

RE: https://mastodon.social/@campuscodi/116297091873542455

How you know it's not a genuine Unit42 communication is that they don't start the email off with three paragraphs and four links about how great Palo Alto products are.

Ján Trenčanský Mar 19

ESET Research Mar 19

#ESETresearch analyzed more than 80 EDR killers, seen across real-world intrusions, and used ESET telemetry to document how these tools operate, who uses them, and how they evolve beyond simple driver abuse. https://www.welivesecurity.com/en/eset-research/edr-killers-explained-beyond-the-drivers/
By following attacker workflows, we identified how affiliates reuse the same vulnerable drivers across unrelated codebases and how individual EDR killers switch drivers over time, demonstrating that driver-centric attribution is unreliable.
We emphasize that in RaaS gangs, it is the affiliates, not the operators, who select and deploy the EDR killers, complicating defense strategies, but also revealing otherwise hidden affiliations.
Our research highlights a significant rise in commercialized tooling, including packer-as-a-service ecosystems and hardened EDR killers that incorporate encrypted drivers, obfuscation, and external payload staging.
Based on these findings and the difficulties of driver blocking, we emphasize a prevention-first approach to defense that focuses on stopping the user-mode component of the EDR killer before any vulnerable driver is loaded, rather than relying solely on kernel-level blocking.
IoCs are available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/edr_killers

EDR killers explained: Beyond the drivers

ESET researchers dive deeper into the EDR killer ecosystem, disclosing how attackers abuse vulnerable drivers.

Ján Trenčanský Mar 17

Barberousse Mar 17

@ESETresearch is looking for an additional Strategic Threat Analyst to join our team!
The role is mostly focused on the socio/geopolitical context of the APT/cyberespionage landscape (i.e. don't expect to reverse engineer malware 😉)

My colleague who's been doing this job for about a year just said that it's "the coolest job in the world". I'm not sure how much of that was a joke, but he doesn't seem to be too miserable in his role 😄

#FediHire #FediJob

https://jobs.eset.com/en-US/ESET_External/job/Analyste-du-renseignement-stratgique-sur-les-menaces---Cyberespionnage---Strategic-Threat-Intelligence-Analyst---Cyberespionage_JR-05715

Analyste du renseignement stratégique sur les menaces – Cyberespionnage / Strategic Threat Intelligence Analyst – Cyberespionage

Résumé du poste / Summary English version follows ------------------------------------------------------------------------------------------------------------------------------- Nous sommes à la recherche d'un.e Analyste du renseignement stratégique sur les menaces axé sur le cyberespionnage pour rejoindre l'un des centres de R&D suivants: Bratislava, Montréal, Prague – tous faisant partie d’ESET Recherche. Description du poste / Job description ESET Recherche ESET Recherche est une équipe de chercheur.euse.s du monde entier qui analysent et ont l'intention de perturber les opérations de cyberespionnage et de cybercriminalité les plus complexes. Nous travaillons en collaboration avec d'autres équipes internes pour améliorer les produits d’ESET et créer des détections de logiciels malveillants résilientes. Notre objectif principal est de comprendre comment les groupes de menaces opèrent pour mieux protéger notre clientèle et perturber les activités malveillantes. Notre équipe produit des rapports privés à la disposition de la clientèle d'ESET Threat Intelligence (https://www.eset.com/ca-fr/entreprises/services/threat-intelligence/). Nous partageons également notre expertise publiquement sur le blogue d'ESET (https://www.welivesecurity.com/fr/a-propos-eset-recherche/) et lors de conférences techniques renommées dans le monde entier, notamment Black Hat, Botconf, CYBERWARCON, RSA et Virus Bulletin. En tant qu'Analyste du renseignement stratégique sur les menaces, vous collaborerez avec des chercheurs.euse.s en logiciels malveillants spécialisé.e.s dans la rétro-ingénierie et le suivi du réseau, enrichirez nos rapports de renseignements stratégiques et informerez nos clients des dernières tendances dans le paysage cyber. Ce rôle n'implique pas la chasse aux menaces ou la recherche technique sur les menaces. Rôle et responsabilités Analyser les tendances et les impacts des opérations de cyberespionnage et de cybersabotage, et évaluer ces opérations d'un point de vue géopolitique. Rédiger des rapports du renseignement stratégique sur les menaces en tirant parti des recherches techniques existantes effectuées par les équipes de recherche en logiciels malveillants d'ESET, de l’OSINT et de votre propre analyse. Enrichir les rapports techniques d’informations sur la motivation des attaquants, la victimologie et le contexte géopolitique plus large pour améliorer le travail de l’équipe de recherche sur les logiciels malveillants. Résumer les données du renseignement, par exemple afin de contribuer à notre rapport d’activité APT semestriel. Intéragir et répondre aux solicitations de la clientèle de nos services de renseignement sur les menaces. Donner des présentations lors de conférences publiques. Déplacements internationaux, jusqu'à 20 % Compétences techniques, connaissances et qualifications 5 ans d'expérience dans le renseignement stratégique sur les cybermenaces ou dans un domaine connexe (géopolitique, etc.). Connaissance approfondie de la géopolitique régionale, en particulier en Asie ou en Europe de l'Est. Connaissance des auteurs de cybermenaces (APT) et du monde du renseignement. Expertise dans l'analyse du renseignement sur les menaces, y compris l'attribution de cyberincidents. Familiarité avec des frameworks tels que MITRE ATT&CK, la Kill Chain ou le diamond model. Solides compétences en rédaction et en expression orale en anglais (la plupart des publications et des engagements d’allocutions se feront en anglais). Capacité de transmettre du contenu technique à des personnes non techniques. Esprit de synthèse et capaciter à résumer des analyses complexes sous la forme de rapports et briefings courts. Connaissance de l’écosystème médiatique et maîtrise de l’évaluation des sources. En retour, nous vous proposons Culture décontractée, amicale et ouverte sans code vestimentaire formel Environnement de travail diversifié et multiculturel Activités d'équipe engageantes et événements de l'entreprise (y compris les consolidations d'équipe et les 5 à 7) Options de modèle de travail hybride Occasions d'assister à divers formations, cours, conférences et rencontres Avantages supplémentaires, tant financiers que non financiers ------------------------------------------------------------------------------------------------------------------------------- We are looking for a Strategic Threat Intelligence Analyst focused on cyberespionage to join one of the following R&D centers: Bratislava, Montreal, Prague - all part of ESET Research. ESET Research ESET Research is a team of researchers all over the world who analyze, and intend to disrupt, the most complex cyberespionage and cybercrime operations. We work in collaboration with other internal teams to improve ESET products and create resilient malware detections. Our primary goal is to understand how threat groups operate to better protect our customers and disrupt malicious activities. Our team produces private reports available to ESET Threat Intelligence customers (https://www.eset.com/int/business/services/threat-intelligence/). We also share our expertise publicly on ESET’s blog (https://www.welivesecurity.com/en/about-eset-research/) and at renowned technical conferences worldwide, including Black Hat, Botconf, CYBERWARCON, RSA, and Virus Bulletin. As a strategic threat intelligence analyst, you will collaborate with malware researchers specializing in reverse-engineering and network tracking, enhance our reporting with strategic-level insights, and brief our customers on the latest trends in the cyber landscape. This role does not involve threat hunting or technical threat research. Duties and responsibilities Analyze cyberespionage/cyber sabotage operations trends and impacts and evaluate these operations from a geopolitical perspective. Write strategic threat intelligence reports by leveraging existing technical research done by ESET malware researchers, OSINT, and your own analysis. Enrich technical reports with information about attackers’ motivation, victimology, and the broader geopolitical context to enhance malware researchers’ work. Summarize intelligence data, for example, by contributing to our bi-annual “APT Activity Report”. Brief customers of our threat intelligence services. Deliver presentations at public conferences. International travel, up to 20% Key technical skills, knowledge and qualifications 5 years of experience in strategic cyber threat intelligence or related field (geopolitics, etc.). In-depth knowledge of regional geopolitics, especially in Asia or Eastern Europe. Familiarity with cyberespionage threat actors (APTs) and the intelligence landscape. Expertise in threat intelligence analysis, including cyber-incident attribution. Familiarity with frameworks such as MITRE ATT&CK, the Kill Chain or the diamond model. Strong English writing and speaking skills (most of the publications and speaking engagements will be delivered in English). Ability to convey technical content to non-technical people. Ability to synthesize information and distill complex analyses into concise reports and briefings. Knowledge of the media ecosystem and strong source‑evaluation skills. In return, we offer you Casual, friendly and open culture with no formal dress code Diverse and multicultural work environment Engaging team activities and company events (including team buildings and after work gatherings) Hybrid work model options Opportunities for attending diverse trainings, courses, conferences, and meetups Additional benefits and perks, both financial and non-financial #LI-MF1 #senior #LI-Hybrid Avantages du poste / Benefits Santé et bien-être Régime d'assurance privée collective Plan d'épargne retraite collectif Programme d'activité physique Supports à vélos intérieurs et programme de partage de vélos Bureau à domicile Jours de congé supplémentaires Horaires de travail flexibles Bureau Rafraîchissements au bureau (fruits, snacks, boissons et café) Petit-déjeuner 5 à 7 / Réunions après le travail Activités de renforcement de l'esprit d'équipe Salon commun (« Living room ») avec PlayStation, ping-pong et baby-foot Activités de Noël Autres Apprentissage LinkedIn/ Udemi Programme de fidélisation (jours de vacances supplémentaires, bonus financier, gâteaux) Recommandation d'un ami Licence ESET gratuite pour les amis et la famille Cadeaux de Noël ________________ Health & well-being Group private insurance plan Group retirement savings plan Physical activity program Interior bike racks and bike sharing program Home office Extra days off Flexible work hours Office Refreshments in office (fruit, snacks, drinks & coffee) Breakfast 5 à 7 / Afterwork get togethers Teambuilding activities Common lounge ("Living room") with PlayStation, ping-pong and foosball tables Christmas activities Other LinkedIn Learning/ Udemi Loyalty program (extra vacation days, financial bonus, cake/cupcakes) Friend referral Christmas gifts Emplacement principal / Primary location Montreal Autres lieux d'implantation / Additional locations Type d'heure / Time type Full time Join ESET Talent Community and we will contact you. This is an option for candidates who haven't found any interesting job opening and would like to send us their CV. ESET® provides cutting-edge digital security to prevent attacks before they happen. By combining the power of AI and human expertise, ESET stays ahead of known and emerging cyberthreats — securing businesses, critical infrastructure, and individuals. Whether it’s endpoint, cloud or mobile protection, our AI-native, cloud-first solutions and services remain highly effective and easy to use. Driven by science, ESET technology includes robust detection and response, ultra-secure encryption, and multifactor authentication. With 24/7 real-time defense and strong local support, we keep users safe and businesses running without interruption. An ever-evolving digital landscape demands a progressive, evidence-based approach to security. ESET is committed to world-class scientific research and powerful threat intelligence, backed by R&D centers and a strong global partner network. ESET's purpose is not only to provides cutting-edge digital security, but also to actively contribute to a more innovative and responsible society in terms of education, science and research. At ESET, diversity, equity, and inclusion (DEI) are integral to our corporate culture. We believe in creating a respectful environment, where everyone feels valued and respected, welcoming applications from individuals of all backgrounds, including race, gender, age, religion, disability, and sexual orientation. Learn more about ESET.

Ján Trenčanský Mar 11

ESET Research Mar 10

#ESETresearch has analyzed the resurgence of Sednit – one of the most long‑running Russia‑aligned APT groups – now using a modern toolkit built around paired implants, BeardShell and Covenant, each using a different cloud provider for resilience. https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/
ESET researchers tied Sednit’s advanced implant team reboot to a 2024 case in Ukraine, where SlimAgent emerged – a keylogger built on the codebase of the infamous Xagent, Sednit’s flagship 2010-era backdoor.
Sednit also deployed BeardShell, an implant that executes PowerShell commands via a legitimate cloud service and uses a distinctive obfuscation technique also found in Xtunnel, Sednit’s network pivoting tool from the 2010s.
Across 2025–2026, Sednit paired BeardShell with Covenant, the final block of its modern toolkit – a heavily reworked open-source implant built for long‑term espionage with a new protocol riding on another legitimate cloud provider.
Detailed analysis of Sednit’s modern toolkits is available at https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/

Ján Trenčanský Mar 10

Merill Fernando

Mar 10

Microsoft Authenticator is about to wipe work accounts from jailbroken/rooted phones automatically 👏.

No IT config needed. 🔥

3-phase rollout starting Feb 2026:
⚠️ Warn → 🚫 Block → 🗑️ Wipe

Let your help desk and security teams know.

🔗 https://support.microsoft.com/en-us/account-billing/jailbreak-root-detection-in-microsoft-authenticator-9f0431bd-675a-4f2d-b8fb-7acd18deaadc

Ján Trenčanský Mar 9

Marcus Hutchins

Mar 8

It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths.

Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it.

The problem is, if a company has no real US footprint (no US corporate entity, offices, servers, etc.), then a US court typically doesn't have the jurisdiction to compel the company to hand over customer data (except in some rare circumstances). Even if the court approved the warrant anyway, it wouldn't really be legally binding.

Which is why the Mutual Legal Assistance Treaty (MLAT) exists. MLAT enables law enforcement agencies in one company to send requests for information to law enforcement agencies in another. Switzerland has such a treaty with the US. This means that the FBI can request that Swiss authorities hand over a Swiss company's data on their behalf.

Any country requesting information held by a company in a foreign jurisdiction would typically do so via MLAT. Which means from Proton's perspective, the legal request would appear to originate from their local law enforcement, not the FBI. Which they clearly understand based on their Reddit post.

Saying "we don't respond to legal requests from anywhere other than Swiss authorities" seems very intentionally worded to give the impression that the company does not cooperate with foreign law enforcement. But since it'd be the Swiss authorities handling any such requests, they'd have to comply, since as they admitted, they have to comply with local laws.

There is, however, some useful (but more nuanced) information here:

Firstly, MLAT requests are handled by local law enforcement according to local law. So if there is a difference between the law of the sending and recipient country, that might mean the MLAT request is denied. That probably doesn't mean much, because if you're on the FBI's radar, the chances are you did something that is also massively illegal in Switzerland too.

Secondly, they are 100% correct in saying that no other service provider is going to do any better. They're all beholden to local laws, and the ones that think they're not tend to get their doors blown off by SWAT like CyberBunker did. The only exception is if the company resides in a country which does not cooperate with US law enforcement (which Proton does not).

But the part that's extremely disingenuous is that the "we only respond to requests from the Swiss authorities". That statement is likely intended to imply they don't cooperate with law enforcement in any other countries, which is simply not true. Switzerland has MLAT agreements with over 30 counties.

People really need to understand that no company is going to shield you from the FBI (or any reputable law enforcement agency). They'll use misleading statements to make it sounds like they don't cooperate with law enforcement, but they do. They have to.

Ján Trenčanský Mar 3

RE: https://mastodon.social/@campuscodi/116166718383800713

GRU clearly targeting @catsalad

Github	https://github.com/j91321
Bluesky	https://bsky.app/profile/j91321.bsky.social