Cybercriminals have allegedly breached Comsecure, an Israeli distributor of ESET’s software and cybersecurity products, to send phishing emails to Israeli organizations containing data wiping malware disguised as cybersecurity software. The phishing campaign began on October 8th, when emails from the legitimate eset[.]co[.]il domain were sent to Israel-based customers from ESET’s “Advanced Threat Defense Team”. The phishing emails warned that the recipient had recently been targeted by government-backed attackers and offers the recipient a link to download an advanced cybersecurity tool: “ESET Unleashed”. The link directs users to the legitimate eset[.]co[.]il domain which hosts a ZIP archive containing four DLL files digitally signed by ESET’s code signing certificate along with an executable “Setup.exe” that is not signed. “Setup.exe” is the data wiper, designed to delete all the files off of a victim’s computer while corrupting the partition table to make data recovery difficult. ESET released a statement on October 18th, 2024, noting that the company was “…aware of a security incident which affected our partner company in Israel last week”. ESET’s announcement states that a “limited malicious campaign was blocked within ten minutes”, and that their customers are secure. As of the time of this writing, the attack has not yet been attributed to a specific threat actor. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.
- Bleeping Computer Article: ESET Partner Breached
- Security Week Article: ESET Distributors Systems Abused