ESET researchers attribute this attack with high confidence to the Tick APT group.

ESET researchers uncovered an attack occurring in the network of an East Asian data-loss prevention company with a customer portfolio that includes government and military entities.

How the data-loss prevention company was initially compromised is unknown. During the intrusion, the attackers deployed a previously undocumented downloader named ShadowPy, and they also deployed the Netboy backdoor (aka Invader) and Ghostdown downloader.īased on Tick’s profile, and the compromised company’s high-value customer portfolio, the objective of the attack was most likely cyberespionage. In this blogpost, we provide technical details about the malware detected in the networks of the compromised company and of its customers. The attackers compromised the DLP company’s internal update servers to deliver malware inside the software developer’s network, and trojanized installers of legitimate tools used by the company, which eventually resulted in the execution of malware on the computers of the company’s customers.

The incident took place in the network of an East Asian company that develops data-loss prevention (DLP) software.

ESET Research uncovered a campaign by APT group Tick against a data-loss prevention company in East Asia and found a previously unreported tool used by the groupĮSET researchers discovered a campaign that we attribute with high confidence to the APT group Tick.

Eset protection standard