ESET Research

ESET Research
Name	ESET Research
Type	Research division
Founded	1992
Headquarters	Bratislava, Slovakia
Area served	Global
Parent organization	ESET
Products	Security research, threat intelligence, tools

ESET Research is the advanced security research division of a multinational cybersecurity company headquartered in Bratislava. The group conducts malware analysis, threat intelligence, vulnerability research, and incident response while engaging with international institutions and technology firms. Its outputs inform software vendors, academic institutions, law enforcement agencies, and standards bodies across Europe and North America.

History

Founded within a commercial Antivirus software vendor during the early 1990s, the team evolved alongside major events such as the rise of ILOVEYOU, Nimda, and Conficker outbreaks. Throughout the 2000s and 2010s, the unit expanded research into advanced persistent threats exemplified by incidents like Stuxnet, Duqu, and Flame. It has interfaced with multinational operations tied to cases investigated by organizations such as Europol, INTERPOL, and national CERTs including US-CERT and CERT-EU. The group adapted to paradigm shifts prompted by disclosures from Edward Snowden and regulatory frameworks like the General Data Protection Regulation while participating in conferences such as Black Hat USA, DEF CON, and RSA Conference.

Research Focus and Areas

Research spans malware family attribution tracing back to campaigns associated with states and criminal syndicates tied to events like the Sony Pictures hack, exploit development exposed by Project Zero, and supply-chain compromises reminiscent of the SolarWinds intrusion. The team conducts vulnerability discovery relevant to vendors like Microsoft, Apple Inc., Google, Oracle Corporation, and Adobe Systems; analyzes exploitation techniques referenced in publications by MITRE (including Common Vulnerabilities and Exposures concepts) and contributes to mitigation approaches aligned with NIST guidance. Work includes heuristic detection research influenced by historical products from companies like Symantec, McAfee, and Kaspersky Lab and contemporary analysis of ransomware campaigns connected to groups tracked by entities such as FBI and CISA.

Publications and Contributions

The group publishes technical whitepapers, blog posts, and peer-reviewed articles presented at venues including Usenix, ACM Conference on Computer and Communications Security, and IEEE Symposium on Security and Privacy. Reports frequently reference threats tied to geopolitical events such as NotPetya and actors examined in literature about APT operations like those associated with APT28 and APT29. Contributions include coordinated disclosure advisories with vendors like Cisco Systems and Juniper Networks and collaborative advisories for incidents investigated alongside Interpol task forces and national security agencies such as the National Security Agency. Researchers have co-authored works with affiliates from universities such as Comenius University, Masaryk University, University of Oxford, and Princeton University.

Tools, Datasets, and Services

The lab develops analysis tools and datasets used by forensic practitioners and academia, interoperating with platforms from VirusTotal, MISP, and Wireshark. Tool releases and detection signatures integrate with endpoint products inspired by early architectures from McAfee and Trend Micro and interoperate with orchestration frameworks like SOAR tools used by SOCs at firms including FireEye and CrowdStrike. Datasets support machine learning research comparable to benchmarks from ImageNet (for methodology analogy) and are used in collaboration with cloud providers such as Amazon Web Services and Microsoft Azure for scalable analysis.

Collaborations and Partnerships

The research division partners with technology firms, academic labs, standards organizations, and law enforcement—a network including Google Project Zero, Microsoft Security Response Center, ENISA, and regional CERTs such as CERT.SK and CERT.PL. Joint efforts with academic groups at institutions like Charles University, MIT, and ETH Zurich produce joint publications and student internships. Cooperative investigations have occurred alongside corporate partners such as Intel Corporation, AMD, Samsung Electronics, and ABB when industrial control systems were implicated in incidents reminiscent of BlackEnergy campaigns. The group participates in industry consortia and working groups connected to ISO standards and contributes to disclosure processes advocated by entities like FIRST.

Awards and Recognitions

Researchers and teams have been cited at international conferences including awards presented at Black Hat Europe and recognition from industry analysts such as Gartner and Forrester Research. Individual contributors have been acknowledged in community fora and program committees for venues including USENIX and ACM. Institutional acknowledgements include collaborative commendations from agencies such as Europol for assistance in transnational cybercrime investigations and partnerships lauded by national research funding bodies in Slovakia and the European Commission.

Category:Computer security companies Category:Malware researchers Category:Cyber threat intelligence