@ESET

Technology improves our lives and how business is done more than anyone might have imagined. When that technology enables progress, ESET is here to protect it.

 Bratislava, Slovakia
eset.com/
Joined June 2009
  • Tweets18.4K
  • Following3.3K
  • Followers274K
#ESETresearch discovered SparroWocky, a new backdoor of the #FamousSparrow APT group. This new malware has quickly replaced SparrowDoor as the 🇨🇳 China-aligned group’s flagship backdoor. welivesecurity.com/en/eset-r… 1/6

Beware the SparroWock: The backdoor that bites, the commands that catch

ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group

welivesecurity.com
2
37
1
111
9,780
Join #ESETresearch’s Filip Jurčacko at #LABScon2026, on Sept. 18 at 2:15 PM MST in Scottsdale, AZ for CinderRelay: The Linux Backbone of ScarCruft’s Covert Network. 1/4
1
7
13
7,045
#ESETresearch discovered #GuardBreaker - a technique used by 🇷🇺 Russia-aligned UAC-0099 against a victim in 🇺🇦Ukraine, interfering with AI-assisted malware analysis by deliberately triggering LLM safety mechanisms. @reib3n1 1/3
4
67
8
190
30,648
ESET detections of #ClickFix doubled (+108%) between H2 2025 and H1 2026 as attackers expanded beyond fake CAPTCHAs to AI platforms (#AI-fix), browser extensions (#CrashFix), and cloud authentication workflows (#ConsentFix). 1/5
2
17
1
28
3,896
#ESETresearch discovered and reported to @certcc 11 old Microsoft-signed UEFI shim bootloaders that allow bypassing UEFI Secure Boot on most UEFI systems. Read about it at welivesecurity.com/en/eset-r… @smolar_m 1/5

Forgotten UEFI shims undermining Secure Boot

ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities.

welivesecurity.com
3
54
96
13,464
ESET Threat Report H1 2026: thousands of malicious Agentic AI skills identified, first AI-powered Android malware appears, and ClickFix expands beyond fake CAPTCHA prompts. Attackers are rapidly adapting to new platforms and technologies . Full report: web-assets.esetstatic.com/wl…
16
1
30
4,300
#ESETresearch has published a technical analysis of new malicious tools and major infrastructure changes observed in 2025 in the arsenal of the Russia-aligned #Gamaredon #APTgroup targeting Ukraine 🇺🇦. Blogpost: welivesecurity.com/en/eset-r… 1/8

Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances

ESET Research analyzes Gamaredon’s new toolset and the group’s growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate stolen data.

welivesecurity.com
1
27
2
54
9,694
🫡🌴 Happy to have @GoAztecs and @ESET on board with @TylerReddick this weekend at @NASCARSanDiego!
15
163
4,658
#ESETresearch analyzed the robust EDR-killer toolset of the RaaS gang Gentlemen. Thanks to our continued incident-level visibility, we could provide a uniquely deep view into the group’s EDR-killer development practices. welivesecurity.com/en/eset-r… 1/6

Killing me gently: Inside Gentlemen’s EDR killer framework

ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen

welivesecurity.com
4
32
100
10,183
#ESETresearch has observed DeadLock ransomware expanding its use of Polygon blockchain smart contracts. Previously used only for chat proxy server address rotation, DeadLock has now added a new contract with the gang's DLS entries - a first of its kind we are aware of. 1/6
1
14
1
33
8,580
#ESETresearch discovered two as-yet undocumented Windows variants of #SprySOCKS, a previously Linux-only backdoor reportedly used by #FishMonger. We attribute the new Windows variants to #FishMonger with high confidence. welivesecurity.com/en/eset-r… 1/4

FishMonger’s arsenal upgraded: SprySOCKS for Windows

ESET researchers have discovered SprySOCKS for Windows, FishMonger’s backdoor weaponizing a kernel driver for advanced stealthiness.

welivesecurity.com
3
24
83
8,208
#ESETresearch has discovered a supply-chain attack targeting stock investors in 🇻🇳Vietnam, distributing SPECTRALVIPER through the update mechanism of the FireAnt Metakit stock investment platform. welivesecurity.com/en/eset-r… 1/4
3
31
1
112
9,122
Detailed analysis of the supply chain, the contour of OceanLotus’s victimology in recent years, and the architecture of its signature backdoor, SPECTRALVIPER, is available at:  welivesecurity.com/en/eset-r… 3/4

OceanLotus: From external espionage to domestic targeting

ESET researchers show how OceanLotus, a Vietnam-aligned APT group, has put an increasing focus on domestic espionage between 2024 and 2026.

welivesecurity.com
1
5
16
2,116
It's not AI attacking us. It's humans using AI who are attacking us. As always, @TonyAtESET @eset has the best cybersecurity advice for all of us. Get our full conversation on a recent episode of The AmberMac Show or over on YouTube. #Partner
5
11
1,123
#ESETresearch released its latest APT Activity Report (Oct 2025–Mar 2026): 🇨🇳China-aligned groups focused on Venezuela, Gulf states, and AI & robotics industry in 🇰🇷South Korea, while 🇰🇵North Korea-aligned APTs targeted the nuclear sector. Full report: web-assets.esetstatic.com/wl…
1
38
6
120
15,201
“You need good threat hunters that understand how AI operates as a cybersecurity tool.” If you’re a business leader, you need to hear this conversation about cyber readiness with @TonyAtESET, Chief Security Evangelist at @ESET North America. Get the full episode of The AmberMac Show wherever you get your podcasts. #Cybersecurity #SmallBusiness #Partner

This video is larger than Cloudflare's 512 MB cache, so it can't be played through. More donations are needed to cover a larger cache. Donate

1
2
9
2,071
#ESETresearch analyzed 2025 activity of the 🇨🇳-aligned Webworm APT group, focusing on its evolving toolset and techniques. welivesecurity.com/en/eset-r… 1/8

Webworm: New burrowing techniques

ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal.

welivesecurity.com
4
22
1
78
7,817
#ESETresearch uncovered a new compromise that we attribute to #FrostyNeighbor, using links in malicious PDFs sent via spearphishing attachments to target governmental organizations in Ukraine. @dmnsch welivesecurity.com/en/eset-r… 1/5
2
27
2
51
9,478
#ESETresearch has uncovered CallPhantom scam apps, previously available on Google Play, that claim to provide call history data for any phone number, in exchange for payment. That’s impossible – and the data is entirely fabricated. @LukasStefanko welivesecurity.com/en/eset-r… 1/5
2
16
29
4,611
#ESETresearch uncovered a multiplatform supply-chain attack by the 🇰🇵 #ScarCruft APT group targeting the Yanbian region via backdoor-laced Windows and Android games. welivesecurity.com/en/eset-r… 1/6

A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games.

welivesecurity.com
1
25
1
50
9,001
Load more