ESET Analysis, Menace Stories
A view of the H2 2024 menace panorama as seen by ESET telemetry and from the angle of ESET menace detection and analysis specialists
16 Dec 2024
•
,
3 min. learn
Within the ordinary cat-and-mouse sport with defenders, the second half of 2024 has seen the cybercriminals retaining busy, discovering safety loopholes and revolutionary methods to broaden their sufferer pool. In consequence, we’ve seen new assault vectors and social engineering strategies, new threats skyrocketing in our telemetry, and takedown operations resulting in shake-ups of established cybercriminal ranks.
Infostealers are one of many menace classes to expertise a reshuffle, with the long-dominant Agent Tesla malware dethroned by Formbook – a well-established menace designed to steal all kinds of delicate knowledge. Regardless of being round for nearly a decade, Formbook continues to draw a large felony consumer base due to its malware-as-a-service (MaaS) mannequin and steady improvement.
Lumma Stealer, a more recent addition to the infostealer scene, and one other MaaS, is changing into more and more wanted by cybercriminals: showing in a number of notable malicious campaigns in H2 2024, ESET telemetry noticed its detections shoot up virtually 400% between reporting durations. RedLine Stealer, one other infamous “infostealer as a service”, met a really completely different destiny: after a takedown by worldwide authorities in October 2024, RedLine Stealer seems to have reached the tip of its line. We are able to, nonetheless, anticipate that its demise will result in the enlargement of different related threats, desirous to fill its place.
Unsurprisingly, with cryptocurrencies reaching document values in H2 2024, cryptocurrency pockets knowledge was one of many prime targets of malicious actors. In our telemetry, this was mirrored in an increase in cryptostealer detections throughout a number of platforms. Curiously, the rise was probably the most dramatic on macOS, the place so-called Password Stealing Ware – closely focusing on cryptocurrency pockets credentials – greater than doubled in comparison with H1. Additional, Android monetary threats, focusing on banking apps in addition to cryptocurrency wallets, grew by 20%.
Android and iOS customers alike needs to be looking out for a novel assault vector, caught within the wild and analyzed by ESET researchers in H2 2024. In these assaults, cybercriminals have leveraged Progressive Net App (PWA) and WebAPK applied sciences to bypass conventional safety measures tied to cellular apps. Since neither PWAs nor WebAPKs require customers to grant express permissions to put in apps from unknown sources, cellular customers might find yourself unwittingly putting in malicious apps that steal banking credentials. And until there’s a change in how cellular platforms strategy these applied sciences, we anticipate that extra refined and various phishing campaigns using PWAs and WebAPKs will emerge.
Social media waters have change into much more murky just lately, with a flood of recent scams cropping up, utilizing deepfake movies and company-branded posts to lure victims into fraudulent funding schemes. These scams, tracked by ESET as HTML/Nomani, noticed a 335% enhance in detections between reporting durations, and we don’t anticipate their progress to decelerate.
H2 2024 additionally gave rise to a brand new rip-off focusing on customers of fashionable lodging reserving platforms, reminiscent of Reserving.com and Airbnb. Utilizing a toolkit named Telekopye, initially developed to defraud folks on on-line marketplaces, the scammers use compromised accounts of reliable lodging suppliers to single out individuals who have just lately booked a keep, then goal them with fraudulent cost pages.
The ransomware panorama was reshaped by the takedown of former chief LockBit, making a vacuum to be stuffed by different actors. RansomHub, a ransomware as a service first noticed in H1 2024, stacked up tons of of victims by the tip of H2 2024, establishing itself because the newly dominant participant.
I want you an insightful learn.
Observe ESET analysis on Twitter for normal updates on key developments and high threats.
To study extra about how menace intelligence can improve the cybersecurity posture of your group, go to the ESET Menace Intelligence web page.
