Check Point Software Technologies researchers have reported on a new version of shellcode-based downloader GuLoader, which was the fourth most prevalent malware last month, according to the company’s Global Threat Index for May 2023.
With fully encrypted payloads and anti-analysis techniques, the latest form can be stored undetected in well-known public cloud services, including Google Drive. Meanwhile, Qbot and Anubis took first place on their respective lists, and Education/Research remained the most exploited industry.
The GuLoader malware, widely used by cybercriminals to bypass antivirus detection, has undergone significant changes. The latest iteration employs a sophisticated technique of replacing code in a legitimate process, facilitating its evasion from process monitoring security tools. The payloads are fully encrypted and stored undetected in renowned public cloud services, including Google Drive.
This unique blend of encryption, raw binary format, and separation from the loader makes the payloads invisible to antivirus programs, posing a significant threat to users and businesses worldwide.
Last month also saw both Qbot and Anubis taking first place on their respective lists. Despite efforts to slow down malware distribution by blocking macros in Office files, Qbot operators have been quick to adapt their distribution and delivery. It has recently been seen abusing a dynamic link library (DLL) hijacking flaw in the Windows 10 WordPad program to infect computers.
“Public tools and services are increasingly being exploited by cybercriminals to deliver and store malware campaigns. The trustworthiness of a source no longer guarantees complete security,” says Maya Horowitz, vice-president: research at Check Point Software. “This highlights the urgent need for education on identifying suspicious activities.
“We strongly advise against disclosing personal information or downloading attachments unless the authenticity and benign nature of the request have been confirmed. Additionally, it’s crucial to have advanced security solutions like Check Point Horizon XDR/XPR in place, which can effectively identify if an allegedly benign behavior is actually malicious, providing an extra layer of protection against sophisticated threats.”
The Education/Research sector continues to be the most targeted industry, according to Check Point’s Index. The report also revealed that the “Web Servers Malicious URL Directory Traversal” vulnerability is the most exploited, impacting 49% of organizations globally. This is closely followed by “Apache Log4j Remote Code Execution” and “HTTP Headers Remote Code Execution” vulnerabilities, affecting 45% and 44% of organisations worldwide, respectively.
Top malware families
Qbot was the most prevalent malware last month with an impact of 6% worldwide organisations, followed by Formbook with a global impact of 5% and AgentTesla with a global impact of 3%.
In South Africa, Qbot was the most prevalent malware last month with an impact of 6,11%, followed by FormBook with an impact of 5,87% and NJRat with an impact of 2,69%.
1 – Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection. Commencing in 2022, it emerged as one of the most prevalent Trojans.
2 – FormBook – FormBook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.
3 – NJRat – NJRat is a remote accesses Trojan, targeting mainly government agencies and organizations in the Middle East. The Trojan has first emerged on 2012 and has multiple capabilities: capturing keystrokes, accessing the victim’s camera, stealing credentials stored in browsers, uploading and downloading files, performing process and file manipulations, and viewing the victim’s desktop. NJRat infects victims via phishing attacks and drive-by downloads, and propagates through infected USB keys or networked drives, with the support of Command & Control server software.
Top attacked industries globally
Last month, Utilities remained in first place as the most exploited industry in Africa, followed by Transportation and Retail/Wholesale.
Top exploited vulnerabilities
Last month, “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability, impacting 49% of organisations globally, followed by “Apache Log4j Remote Code Execution” impacting 45% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.
1 – ↔ Web Servers Malicious URL Directory Traversal – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.
2 – ↔ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
3 – ↔ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
Top mobile malwares
Last month Anubis rose to first place as the most prevalent Mobile malware, followed by AhMyth and Hiddad.
1 – Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
2 – AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which usually used to steal sensitive information.
3 – Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.