Published on: 2025-04-10

Intelligence Report: ESET security scanner vulnerability used to deploy TCESB malware – TechRadar

1. BLUF (Bottom Line Up Front)

A critical vulnerability in ESET’s endpoint protection solution was exploited by the threat group known as ToddyCat to deploy TCESB malware. The flaw, identified as CVE-2024-11859, allowed attackers to hijack the loading process of system libraries. ESET has since patched the vulnerability. Organizations using ESET are advised to update their systems immediately and enhance monitoring for potential threats.

2. Detailed Analysis

The following structured analytic techniques have been applied for this analysis:

General Analysis

The vulnerability in ESET’s command-line scanner was exploited using a “bring your own vulnerable driver” approach. This allowed ToddyCat to deploy a modified version of the open-source tool EDRSandBlast, known as TCESB, which can alter OS kernel structures and disable notification routines. The attack primarily targeted government, military, and critical infrastructure sectors in Asia and Europe.

3. Implications and Strategic Risks

The exploitation of this vulnerability poses significant risks to national security and regional stability, particularly in Asia and Europe. The ability of TCESB to bypass standard security mechanisms increases the threat level to critical infrastructure and sensitive governmental operations. Economic interests may also be at risk due to potential disruptions and data breaches.

4. Recommendations and Outlook

Recommendations:

• Organizations using ESET should immediately apply the latest security patches and conduct thorough security audits.
• Enhance monitoring and detection capabilities to identify and mitigate potential threats from similar vulnerabilities.
• Consider implementing additional layers of security to protect critical infrastructure and sensitive data.

Outlook:

Best-case scenario: Rapid adoption of patches and enhanced security measures prevent further exploitation of the vulnerability.
Worst-case scenario: Delayed response and inadequate monitoring lead to widespread exploitation and significant data breaches.
Most likely scenario: Organizations gradually implement patches and improve security protocols, reducing but not eliminating the threat.

5. Key Individuals and Entities

ToddyCat – The threat group responsible for exploiting the ESET vulnerability.
Kaspersky – The security researchers who identified and reported the vulnerability.
ESET – The cybersecurity company whose product was exploited.