ESET WeLiveSecurity
eset · B · active
https://www.welivesecurity.com/en/
ESET research blog; particularly strong on European APT activity. RSS at https://www.welivesecurity.com/en/rss/feed/ mirrors the listing. 2026-05-08 audit: 5 dated posts latest 2026-05-07 on CallPhantom, ScarCruft. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.welivesecurity.com/en/ (listing) then webfetch per-article URL; RSS mirror at https://www.welivesecurity.com/en/rss/feed/. AVOID: No issues; WebFetch works on listing and detail. No bridge needed.. | 2026-07-05 admiralty audit: B, vendor research lab, original telemetry-driven research (esp. EU APTs); live, keep active. | 2026-10-06 (S3, not re-verified by the main agent): https://www.welivesecurity.com/en/rss/feed/ parses with 20 dated items and could be pinned as rss_url. | 2026-10-14 intel run: `feed https://www.welivesecurity.com/en/rss/feed/ 20` returns 20 dated items on the direct transport; rss_url pinned and fetch_method switched from webfetch. | 2026-10-11 quality audit: the RSS feed parses with 30 dated items; pinned as the discovery path. | 2026-10-23 (S3): recipe: the research feed .../eset-research/feed/ answers 404 and the main feed lagged the 2026-10-22 post; `extract https://www.welivesecurity.com/en/eset-research/` returns the dated research listing, then drill each post with `extract`. | 2026-10-29 (S3): Recipe confirmed (2026-10-29): the RSS feed https://www.welivesecurity.com/en/rss/feed/ lagged (newest item 2026-10-26, a video) and did not carry the ESET APT Activity Report published 2026-10-28; `python3 tools/fetch_source.py extract https://www.welivesecurity.com/en/eset-research/` returns the dated research listing (cards with dates; hrefs are relative /en/eset-research/<slug>/) and found it. The record is not i
Cited in 16 entries
Citation cadence
Citation days per ISO week (25 weeks of coverage span, total 16).
- MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors2026-10-29
- MythicRatatoskr: ESET documents a Go backdoor that hides its command server inside the Yggdrasil mesh network, and a UAC-0099 to Sandworm access handoff that ended in a Group Policy wiper attack on a Ukrainian grain logistics firm2026-10-23
- Cisco Talos: malware now embeds natural-language instructions aimed at LLM triage pipelines, from a copied comment to template-sprayed prompts across four families, and a Russia-aligned group uses it too2026-10-09
- FamousSparrow retires SparrowDoor for SparroWocky, a modular backdoor with BOF-loading and call-stack spoofing, deployed almost exclusively against Latin American governments2026-09-18
- TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)2026-07-25
- CVE-2026-8863, CVE-2026-10797, forgotten pre-0.9 UEFI shims bypass Secure Boot via a signature-length validation mismatch2026-07-14
- ESET Threat Report H1 2026: first Android malware using generative AI at runtime, ClickFix detections more than double, record QR-phishing, 100+ EDR-killers2026-07-09
- ESET's 2025 Gamaredon paper: exfil and C2 moved wholesale onto trusted cloud services (ANNUAL REPORT)2026-06-26
- Operation Endgame dismantles the Amadey and StealC malware-as-a-service backbone2026-06-25
- ESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer framework2026-06-19
- FishMonger (I-SOON) ports its SprySOCKS backdoor to Windows with a kernel-driver rootkit2026-06-17
- ESET: OceanLotus (APT32) compromises a stock-trading platform's update server, selective SPECTRALVIPER delivery, no integrity checks to defeat2026-06-12
- ESET APT Activity Report Q4 2025–Q1 2026: Sandworm strikes NATO energy, Lazarus targets EU drone sector, UNC5221 pivots to Ivanti SPAWN toolset2026-05-30
- WatchGuard documents Grandoreiro's Delphi-DLL-side-loading + WebSocket/STUN C2 against Portuguese & Spanish banks; ESET maps parallel Android BTMOB MaaS2026-05-29
- Webworm (China-aligned) turns to European government targets with the EchoCreep (Discord) and GraphWorm (Microsoft Graph and OneDrive) backdoors, ESET reports2026-05-21
- FrostyNeighbor (Ghostwriter, UNC1151): since March 2026, geofenced PDF lures deliver a JavaScript PicassoLoader and Cobalt Strike to Ukrainian government organisations2026-05-15