ESET Research investigates the Gentlemen ransomware author group and its defense evasion tools

The Gentlemen Group develops, maintains and provides to affiliates a proprietary EDR-killers suite called 'GentleKiller', with at least eight variants based on vulnerable or malicious drivers and integrated with third-party tools (HexKiller, ThrottleBlood and HavocKiller). The unified avoidance strategy reinforces impersonation and protection, while victimology shows a non-centered global distribution
Tagged under:

ESET Research: China-linked FishMonger upgrades its arsenal and targets governments in Asia and Latin America

ESET has discovered two new Windows variants of the SprySOCKS backdoor attributed to the FishMonger group. Active between 2023 and 2024 against government entities in Honduras, Taiwan, Thailand and Pakistan, they support communications via TCP, UDP and WebSocket and implement over 30 commands. The WIN_DRV variant employs a kernel driver to hide a TCP backdoor e
Tagged under:

ESET Recognized as the Only Challenger in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection

ESET, the global European cybersecurity market leader, has been recognized as a “Challenger” in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection¹ for the third consecutive year, thanks to its ESET PROTECT product range. The company has achieved this recognition for 16 consecutive years and has been named “Challenger” 7 times in the last few
Tagged under:

ESET releases SMB IT Readiness Index 2026, highlighting growing confidence but also concerns about AI technologies

Most SMEs are optimistic about their cyber resilience and satisfied with their cybersecurity budgets ESET, the global European cybersecurity market leader, has published its '2026 SME Cyber ​​Readiness Index', based on a global survey of 4,400 SME decision-makers who

ESET discovers the new arsenal of Webworm, a pro-Chinese APT active against European governments

ESET Research analyzed the recent activities of the pro-China APT group Webworm, a group that began using new backdoors for Command and Control (C&C) communications via Discord and the Microsoft Graph API in 2025, deciphering over 400 Discord messages. Among the tools used, EchoCreep and GraphWorm stand out. Webworm has also shifted its focus towards entities

ESET Research APT Report: China-aligned groups spy on Venezuela and Gulf, targeting AI robotics in South Korea

The latest APT Activity Report from ESET Research traces the map of threats between Venezuela, Syria, Gulf countries, South Korea and Ukraine ESET, a global leader in the cybersecurity sector, has published its latest APT Activity Report, which highlights the activities of some APT (Advanced Persistent Threat) groups documented by ESET Research between

ESET accelerates AI innovation with investments aimed at managing a rapidly expanding attack surface

ESET announces a €40 million investment to expand its R&D team and accelerate the development of a multi-layered AI security stack, a new generation of AI SOC and AI models designed with a security-first approach. Since March 2026, ESET has examined 800,000 unique AI skills, reporting 25,000 of them

ESET enhances its commitment to customized solutions with ESET PRIVATE on a global scale

ESET PRIVATE enables large enterprises and public sector organizations to adopt tailor-made solutions, ensuring cyber resilience at scale. The new portfolio, featuring advanced threat scanning, IT/OT protection, security for air-gapped environments, threat intelligence and customized managed security, will be presented at ESET WORLD 2026, scheduled for Berlin

ESET Research discovers CallPhantom scam on Google Play: fake registrations in exchange for real money

A new Android scam called CallPhantom falsely promises access to call, SMS and WhatsApp logs for any number in exchange for payment. 28 apps identified on Google Play with over 7.3 million downloads. Some apps bypass the official payment system, making refunds difficult ESET Research has identified some apps on Google Play

ESET Research found that ScarCruft, a North Korea-aligned APT, compromised a gaming platform with a supply chain espionage attack

The APT ScarCruft group compromised a video game platform used by ethnic Koreans in China's Yanbian region. The RokRAT backdoor was released via a malicious update of the Windows client, which installed the more advanced BirdCall. Android games have also been infected by Trojans with a variant of BirdCall. The goal