ESET's Threat Report covers the period between December 2023 and May 2024
ESET, a global European leader in the cybersecurity market, has published the latest Threat Report, which summarizes the trends observed by detection systems from December 2023 to May 2024. Over the last six months, a dynamic landscape of financial-themed threats on Android has emerged, targeting victims' mobile banking funds both in the form of "traditional" banking malware and, more recently, cryptostealers. Infostealer malware is currently capable of appearing as a genAI tool, and the new GoldPickaxe mobile malware is capable of stealing facial recognition data to create deepfake videos that are then used by malware operators to authenticate fraudulent financial transactions. Video games and cheating tools used in online multiplayer games were recently discovered to contain infostealer malware such as RedLine Stealer, which according to ESET telemetry, saw several detection peaks in the first half of 2024.
"GoldPickaxe has versions for both Android and iOS and has targeted victims in Southeast Asia through localized malicious applications. When ESET researchers investigated this malware family, they discovered that an older Android model of GoldPickaxe, called GoldDiggerPlus, has also spread to Latin America and South Africa, actively targeting victims in these regions," he explains Jiří Kropáč, Director of ESET Threat Detection.
In recent months, Infostealer-type malware has also begun to exploit the imitation of genAI tools. In H1 2024, Rilide Stealer was spotted using the names of genAI assistants, such as OpenAI's Sora and Google's Gemini, to lure potential victims. In another malicious campaign, infostealer Vidar hid behind a supposed Windows desktop app for the Midjourney AI image generator, even though the Midjourney AI model is only accessible via Discord. Since 2023, ESET Research has observed an increase in AI abuse by cybercriminals, a trend that is expected to continue.
Video game enthusiasts who have ventured outside the official gaming ecosystem have been attacked by infostealers. In fact, some cracked video games and cheating tools used in online multiplayer games were recently discovered to contain infostealer malware, such as Lumma Stealer and RedLine Stealer. RedLine Stealer has seen several detection spikes in H1 2024 in ESET telemetry, caused by campaigns in Spain, Japan and Germany. The most recent waves have been so significant that RedLine Stealer detections in H1 2024 exceeded those in H2 2023 by a third.
Balada Injector, a gang known for exploiting vulnerabilities in WordPress plugins, continued to run rampant in the first half of 2024, compromising over 20,000 websites and accumulating over 400,000 detections in ESET telemetry for the variants used in their recent campaign. On the ransomware front, previous leader LockBit was ousted by Operation Chronos, a global law enforcement-led intervention in February 2024. While ESET telemetry recorded two notable LockBit campaigns in the first half of 2024, these were found to be the work of gangs not affiliated with LockBit who used the disclosed LockBit builder.
The ESET Threat Report includes news on a recent in-depth investigation into one of the most advanced and still growing server-side malware campaigns: the Ebury Group, with its malware and botnet. Over the years, Ebury has been used as a backdoor to compromise nearly 400,000 Linux, FreeBSD, and OpenBSD servers; more than 100,000 were still compromised at the end of 2023.
For more information, see l’ESET Threat Report H1 2024 on WeLiveSecurity.com and participate in the webinar Threat Report H1 2024: analysis, trends and tools to prevent next cyber attacks which will be held on July 17, 2024 at 10.30 am.
