Check Point Research’s Global Threat Index for June 2020 shows that the Phorpiex botnet has been delivering the Avaddon ransomware, a new ransomware-as-a-service (RaaS) variant that emerged in early June, via malspam campaigns.
This has led to it jumping 13 places to second in the Top Malware listing and doubling its impact on organisations worldwide compared to May.
As reported previously by Check Point researchers, Phorpiex is known for spreading large-scale sextortion malspam campaigns, as well distributing other malware families.
The latest malspam messages distributed via Phorpiex try to entice recipients into opening a Zip file attachment by using a wink emoji in the email subject. If a user clicks on the file, the Avaddon ransomware is activated, scrambling data on the computer and demanding a ransom in return for file decryption.
In its 2019 research, Check Point found over a million Phorpiex-infected Windows computers. Researchers estimated the annual criminal revenue generated by Phorpiex botnet at approximately $500 000.
Meanwhile, the Agent Tesla remote access trojan and info-stealer continued to have a significant impact throughout June, moving up from second place in May to 1st place, while the XMRig cryptominer remains in third place for the second month running.
“In the past, Phorpiex, also known as Trik, was monetized by distributing other malware such as GandCrab, Pony or Pushdo, using its hosts to mine cryptocurrency, or for sextortion scams. It’s now being used to spread a new ransomware campaign,” says Maya Horowitz, director: threat intelligence and research: products at Check Point.
“Organisations should educate employees about how to identify the types of malspam that carry these threats, such as the latest campaign targeting users with emails containing a wink emoji, and ensuring they deploy security that actively prevents them from infecting their networks.”
The research team also warns that “OpenSSL TLS DTLS Heartbeat Information Disclosure” is the most common exploited vulnerability, impacting 45% of organizations globally, closely followed by “MVPower DVR Remote Code Execution” which impacts 44% of organizations worldwide. “Web Server Exposed Git Repository Information Disclosure” remains in third place, with a global impact of 38%.
In terms of malware families, Agent Tesla is the most popular malware with a global impact of 3% of organisations, closely followed by Phorpiex and XMRig affecting 2% of organisations each.
This month’s top exploited vulnerability is “OpenSSL TLS DTLS Heartbeat Information Disclosure”, affecting 45% of organizations globally, closely followed by “MVPower DVR Remote Code Execution” which impacts 44% of organisations worldwide. “Web Server Exposed Git Repository Information Disclosure” remains in third place, with a global impact of 38%.
This month Necro is the most popular mobile malware family, following by Hiddad and Lotoor.