SLEEPWALKER Backdoor: A Stealthy Windows Implant Triggered by a Single Network Packet
A newly documented Windows backdoor named SLEEPWALKER has been detailed by independent malware researcher Dominik Reichel. The implant remains dormant in memory…
Tag: ESET
ESET Management Agent: Target for DLL Side-Loading
ESET Management Agent is a Windows executable (ERAAgent.exe) that SLEEPWALKER abuses via DLL side-loading. The backdoor impersonates dpapi.dll and loads each time…
WindRelay Android Malware Turns Phones into NFC Relays for Payment Fraud
Cybersecurity researchers at Group-IB have uncovered a new Android malware family called WindRelay that turns victims' smartphones into NFC relays for contactless…
Polish Power Plant Breach via Private Cellular Network Shuts Turbine
Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power (CHP) plant by breaching…
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign involving a malicious program disguised as a Notepad++…
ESET — Cybersecurity product profile
ESET was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts
Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into…
11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
Cybersecurity researchers at ESET have discovered 11 old, Microsoft-signed UEFI shim bootloaders that could be exploited to bypass Secure Boot protections on…
CVE-2026-10797: UEFI Shim Certificate Revocation Bypass
CVE-2026-10797 refers to a long-patched issue in UEFI shim that allowed the certificate-based revocation mechanism to be bypassed by modifying the second-stage…
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented modular malware framework codenamed Avalon, which is distributed via a multi-stage phishing…