2023’s Most Wanted Malware

Researchers have uncovered a new malware campaign for Emotet Trojan, which has risen to become one of the most prevalent forms of malware and Emotet attackers have been exploring alternative ways to distribute malicious files since Microsoft announced they will block macros from office files.

In the latest campaign, the attackers have adopted a new strategy of sending spam emails containing a malicious OneNote file. Once opened, a fake message appears to trick the victim into clicking the document, which downloads the Emotet infection.

Once installed, the malware can gather user email data such as login credentials and contact information. The attackers then use the gathered information to expand the reach of the campaign and facilitate future attacks.

According to the 2023 Global Threat Report from  Check Point Software Technologies “While big tech companies do their best to cut off cybercriminals at the earliest point, it’s near impossible to stop every attack from bypassing the security measures. We know that Emotet is a sophisticated Trojan and it is no surprise to see it has managed to navigate Microsoft’s latest defences.

“The most important thing people can do is make sure they have appropriate email security in place, avoid downloading any unexpected files and adopt heathy scepticism about the origins of an email and its contents” said Maya Horowitz, VP Research at Check Point.
 
Check Point also report that “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organisations globally, followed by “HTTP Headers Remote Code Execution”with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%."

This vulnerability has been in evidence since 2020 and the fact it continues to be a highly prevalent threat presents a professional challenge to CISOs and cyber security teams.  

Top malware families

According to Check Point's findings, Qbot was the most prevalent malware in March 2023, with an impact of more than 10% on worldwide organisations respectively, followed by Emotet and Formbook with a 4% global impact.

  • Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.
  • Emotet - Emotet is an advanced, self-propagating and modular Trojan. Emotet used to be employed as a banking Trojan but has recently been used as a distributor to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
  • FormBook – FormBook is an Infostealer targeting Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. Formbook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes and can download and execute files according to orders from its C&C.

Commenting on QBot attacks, Tim Callan, Chief Experience Officer at Sectigo, said "As a social engineering scam, employees should be informed how to spot fraudulent emails... Industries must rapidly train their employees to spot and avoid the latest attack vectors. Implementing email certificates is a quick and easy fix to decrease the chances of BEC attacks, combined with ongoing employee training."

Top Attacked Industries Globally

Education & Research have remained the most attacked industry globally, followed by Government/Military and then Healthcare.

  • Education/Research
  • Government/Military
  • Healthcare

Top Exploited Vulnerabilities

Apache Log4j Remote Code Execution was the most exploited vulnerability, impacting 44% of organisations globally, followed by HTTP Headers Remote Code Execution with 43% of organisations worldwide and MVPower DVR Remote Code Execution with a global impact of 40%.

  • Apache Log4j Remote Code Execution (CVE-2021-44228) - A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
  • HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) - HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
  • MVPower DVR Remote Code Execution - A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.

Top Mobile Malware

Last month, Ahmyth moved to the top spot as the most prevalent mobile malware, followed by Anubis and Hiddad.

  • AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites.
    When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera.
  • Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
  • Hiddad - Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.

Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud which provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles.

The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, the intelligence and research Arm of Check Point Software Technologies. The complete list of the top ten malware families in March can be found on the Check Point blog.

You Might Also Read: 

Check Point Launches Horizon Security:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« TikTok Will Comply With US Law
EU Payroll & HR Services Giant Under Attack »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ThaiCERT

ThaiCERT

ThaiCERT is the national Computer Security Incident Response Team (CSIRT) for Thailand.

Netsparker

Netsparker

Netsparker provide a web application security scanner to automatically find security flaws in your websites, web applications and web services.

RiskSense

RiskSense

RiskSense empowers enterprises and governments to reveal cyber risk, quickly orchestrate remediation, and monitor the results.

Skkynet Cloud Systems

Skkynet Cloud Systems

Skkynet is a leader in real-time data systems for the secure management and control of industrial processes (SCADA) and embedded devices (M2M).

Khipu Networks

Khipu Networks

Khipu Networks is an award winning Cyber Security Company delivering a wide range of network, wireless and security solutions, technologies and services across multiple sectors.

Steganos

Steganos

Steganos offers highly secure and easy to use software tools that protect and secure on and offline data.

Cybersprint

Cybersprint

Cybersprint's Digital Risk Protection platform continuously monitors your digital footprint so you can make informed decisions on exposure to online threats, identify vulnerabilities and take action.

Cybercrime Investigation & Coordinating Center (CICC)

Cybercrime Investigation & Coordinating Center (CICC)

The Cybercrime Investigation and Coordinating Center (CICC) is an attached agency of the Philippines Department of Information and Communications Technology (DICT).

Industrial Internet Consortium (IIC)

Industrial Internet Consortium (IIC)

The Industrial Internet Consortium is the world's leading organization transforming business and society by accelerating the Industrial Internet of Things (IIoT).

US Venture Partners (USVP)

US Venture Partners (USVP)

USVP is a leading Silicon Valley venture capital firm focusing on early-stage start-ups that transform cybersecurity, enterprise software, consumer mobile and e-commerce, and healthcare.

10dot Cloud Security

10dot Cloud Security

10dot Cloud Security is a security service management company. Our solutions give you contextualised visibility into your network security.

Seigur

Seigur

Seigur is an IT consultancy business providing flexible legal and cyber security services for IT and data privacy programmes.

Narf Industries

Narf Industries

Narf Industries are a small group of reverse engineers, vulnerability researchers and tool developers that specialize in tailored solutions for government and large enterprises.

People Driven Technology

People Driven Technology

People Driven Technology is a customer-obsessed organization. We leverage our decades of business, technology, and engineering experience to deliver outcomes for our clients.

Questex Asia Total Security Conference

Questex Asia Total Security Conference

Questex Asia’s Total Security Conferences is one of the industry’s most prestigious and engaging forums for the region's top information security leaders and business decision-makers.

Argantic

Argantic

Argantic aims to help organisations thrive and reach their full potential in a modern cloud-centric era.