• About Us
  • Advertising
  • Digital Magazine
  • Supplements
  • Media Pack
  • Privacy Policy
  • Contact us
CXO Insight Middle East
  • News
  • Opinion
  • Business
    • Industries
      • Transport
      • Retail
      • Government
      • Real Estate
      • Education
      • Energy
      • Banking and Finance
    • Channel
  • Future
    • Tech
    • Gadgets
    • Science
    • Space
    • Sustainability
  • Events
    • Channel Insights Summit 2025
    • Insight Innovation Summit
    • CXO50 Oman
    • CXO50
    • ICT Awards
      • Dubai 2025
      • Saudi Arabia
    • Cyber Strategists Summit
    • Cloud Connect 2025
    • Channel Awards 2024
    • All events
  • GITEX
  • Digital Magazine
No Result
View All Result
CXO Insight Middle East
  • News
  • Opinion
  • Business
    • Industries
      • Transport
      • Retail
      • Government
      • Real Estate
      • Education
      • Energy
      • Banking and Finance
    • Channel
  • Future
    • Tech
    • Gadgets
    • Science
    • Space
    • Sustainability
  • Events
    • Channel Insights Summit 2025
    • Insight Innovation Summit
    • CXO50 Oman
    • CXO50
    • ICT Awards
      • Dubai 2025
      • Saudi Arabia
    • Cyber Strategists Summit
    • Cloud Connect 2025
    • Channel Awards 2024
    • All events
  • GITEX
  • Digital Magazine
No Result
View All Result
CXO Insight Middle East
No Result
View All Result

ESET Reveals Russian APT groups, continue their attacks against Ukraine

by CXO Staff
February 1, 2023
in News

ESET released its latest APT Activity Report, covering the period from September until the end of December 2022 (T3 2022).

ESET Reveals Russian APT groups, continue their attacks against Ukraine

ESET Research today released its latest APT Activity Report, which summarises discoveries about select advanced persistent threat (APT) groups that were observed, investigated, and analysed by ESET researchers between September and the end of December (T3) 2022. During this period, Russia-aligned APT groups continued to be particularly involved in operations targeting Ukraine, deploying destructive wipers and ransomware. Goblin Panda, a China-aligned group, started to duplicate Mustang Panda’s interest in European countries. Iran-aligned groups continued to operate at a high volume, too.

In Ukraine, ESET detected the infamous Sandworm group using a previously unknown wiper against an energy sector company. Nation-state or state-sponsored actors usually operate APT groups; the described attack happened in October during the same period when Russian armed forces began launching missile strikes targeting energy infrastructure. While ESET is not able to show that those events were coordinated, it suggests that Sandworm and the Russian military have related objectives.

ESET has named the latest wiper, from a series of previously discovered wipers, NikoWiper. This wiper was used against a company in the energy sector in Ukraine in October 2022. NikoWiper is based on SDelete, a command line utility from Microsoft that is used for securely deleting files.

In addition to data-wiping malware, ESET discovered Sandworm attacks using ransomware as a wiper. In those attacks, although ransomware was used, the final objective was the same as for the wipers: data destruction. Unlike traditional ransomware attacks, the Sandworm operators do not intend to provide a decryption key.

In October 2022, ESET detected Prestige ransomware being deployed against logistics companies in Ukraine and Poland. And in November 2022, ESET discovered new ransomware in Ukraine written in .NET that we named RansomBoggs. ESET Research publicly reported this campaign on its Twitter account. Along with Sandworm, other Russian APT groups such as Callisto and Gamaredon have continued their spearphishing campaigns against Ukraine to steal credentials and install implants.

ESET researchers also detected a MirrorFace spearphishing campaign targeting political entities in Japan and noticed a gradual change in the targeting of some China-aligned groups – Goblin Panda started to duplicate Mustang Panda’s interest in European countries. Last November, ESET discovered a new Goblin Panda backdoor, which we named TurboSlate, in a government organisation in the European Union. Mustang Panda has also continued to target European organisations. Last September, we detected a Korplug loader used by Mustang Panda at an organisation in Switzerland’s energy and engineering sector.

Iran-aligned groups continued their attacks, too – besides Israeli companies, POLONIUM also started targeting the foreign subsidiaries of Israeli companies, and MuddyWater probably compromised a managed security service provider.

North Korea-aligned groups used old exploits to compromise cryptocurrency firms and exchanges in various parts of the world. Interestingly, Konni has expanded the repertoire of languages it uses in its decoy documents to include English, which means it might not be aiming at its usual Russian and South Korean targets.

For more technical information, check the full “ESET APT Activity Report” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

ESET APT Activity Reports contain only a fraction of the cybersecurity intelligence data provided to ESET private APT report customers. ESET prepares in-depth technical reports and frequent activity updates detailing activities of specific APT groups in the form of ESET APT Reports PREMIUM to help organisations tasked with protecting citizens, critical national infrastructure, and high-value assets from criminal and nation-state-directed cyberattacks. More information about ESET APT Reports PREMIUM that deliver high-quality, strategic, actionable, and tactical cybersecurity threat intelligence is available on the ESET Threat Intelligence page.

Tags: APT Activity ReportESETreport
ShareTweet

Related Posts

NTT DATA launches AI-powered SDI services for Cisco products
Future

NTT DATA launches AI-powered SDI services for Cisco products

NTT DATA is marking a major milestone in its 30-year collaboration with Cisco by launching AI powered Software Defined Infrastructure...

June 13, 2025
Gartner forecasts rise of Guardian agents
Future

Gartner forecasts rise of Guardian agents

By 2030, guardian agent technologies will account for at least 10 to 15% of agentic AI markets, according to Gartner....

June 12, 2025

Discussion about this post

Latest Issue

Tech predictions for 2024 and beyond

Amazon’s Werner Vogels on how cloud, data, and culture are shaping AI

June 13, 2025
WSO2 acquires API analytics and monetisation startup Moesif

Bold visions, stronger partnerships: AWS co-innovates across the Middle East

June 13, 2025
NTT DATA launches AI-powered SDI services for Cisco products

NTT DATA launches AI-powered SDI services for Cisco products

June 13, 2025

The most trusted source of strategic intelligence for IT decision makers in the Middle East.

About

  • About Us
  • Advertising
  • Digital Magazine
  • Supplements
  • Media Pack
  • Contact Us

Policies

  • Privacy Policy

© 2024 – CXO Insight Middle East. All Rights Reserved.

Facebook-f X-twitter Linkedin
Separated they live in Bookmarksgrove right at the coast of the Semantics, a large language ocean. A small river named Duden.

About

  • About Us
  • Site Map
  • Contact Us
  • Career

Policies

  • Help Center
  • Privacy Policy
  • Cookie Setting
  • Term Of Use

Join Our Newsletter

© 2024 – CXO Insight Middle East. All Rights Reserved.

Facebook-f Twitter Youtube Instagram

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In
Join our mailing list
Sign up here to get the latest news, updates and special offers delivered directly to your inbox.
No Result
View All Result
  • News
  • Opinions
  • Business
    • Industries
      • Transport
      • Retail
      • Government
      • Real Estate
      • Education
      • Energy
      • Banking and Finance
  • Channel
  • Future
    • Tech
    • Gadgets
    • Science
    • Space
    • Sustainability
  • Events
    • Channel Insights Summit 2025
    • Insight Innovation Summit
    • CX50 Oman
    • CXO50
    • ICT Awards
      • Dubai
      • Saudi Arabia
    • Cyber Strategists Summit
    • Cloud Connect 2025
    • Channel Awards 2023
    • All events
  • Videos
  • GITEX GLOBAL
  • Digital Magazine

© 2024 - CXO Insight Middle East. All Rights Reserved.